High
CVE-2026-77246
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,993
Reset filters
Critical
CVE-2025-66455
LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py
Critical
CVE-2026-59163
Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
High
CVE-2026-33625
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
High
CVE-2026-86049
Jupyter Server: 5xx request logging leaks token-bearing Referer header values
High
CVE-2026-63349
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
Critical
CVE-2026-63374
AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
Medium
CVE-2026-85078
sanic chunked trailer request smuggling allows hidden second request execution
Medium
CVE-2026-69147
vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation
Medium
CVE-2026-57173
vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions
Medium
CVE-2026-59823
LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
Medium
CVE-2026-61589
djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
Medium
CVE-2026-62949
AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION
High
CVE-2026-61599
djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
Critical
CVE-2025-59953
LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy
Medium
CVE-2026-61597
djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
High
CVE-2026-61593
djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session
Medium
CVE-2026-87014
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
Medium
CVE-2026-87015
Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
Medium
CVE-2026-87012
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
Critical
CVE-2026-59971
MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
Medium
CVE-2026-87013
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
High
CVE-2026-87011
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
High
CVE-2026-87995
Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.