Medium
CVE-2026-27645
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,015
Reset filters
High
CVE-2026-27696
changedetection.io is Vulnerable to SSRF via Watch URLs
High
ghsa-mxhj-88fx-4pcv
Fickling: OBJ opcode call invisibility bypasses all safety checks
High
CVE-2026-27483
MindsDB: Path Traversal in /api/files Leading to Remote Code Execution
Critical
CVE-2026-26198
ormar is vulnerable to SQL Injection through aggregate functions min() and max()
Medium
CVE-2026-27482
Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
Medium
CVE-2026-27199
Werkzeug safe_join() allows Windows special device names
Low
ghsa-83pf-v6qq-pwmr
Fickling has a detection bypass via stdlib network-protocol constructors
Medium
CVE-2026-25739
Indico Affected by Cross-Site-Scripting via material uploads
Medium
CVE-2026-25738
Indico has Server-Side Request Forgery (SSRF) in multiple places
Medium
CVE-2026-25527
changedetection.io is vulnerable to unauthenticated static path traversal
High
CVE-2026-2531
A security vulnerability has been detected in MindsDB up to 25.14.1. This vulnerability affects the function clear_filename of the file mindsdb/utilities/security.py of the component File Upload. Such
Medium
CVE-2019-25338
DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. Attackers can submit different usernames t
Critical
CVE-2026-26217
Crawl4AI Has Local File Inclusion in Docker API via file:// URLs
Critical
CVE-2026-26216
Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter
Medium
CVE-2026-25528
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
Medium
CVE-2026-25480
Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
Medium
CVE-2026-25479
Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns
High
CVE-2026-25478
Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins
High
CVE-2026-25732
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
High
CVE-2026-25640
Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL
High
CVE-2026-25580
Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling
Critical
CVE-2026-25481
Langroid has WAF Bypass Leading to RCE in TableChatAgent
Critical
CVE-2024-5986
H2O has an External Control of File Name or Path vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.