High
CVE-2026-54058
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 689
Reset filters
Medium
CVE-2026-59198
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
High
CVE-2026-54549
meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch
High
CVE-2026-54547
meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
High
CVE-2026-54567
Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
High
CVE-2026-54234
vLLM has Remote DoS via Invalid Recovered Token Reinjection
High
CVE-2026-50271
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
High
CVE-2026-54446
NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
High
CVE-2026-54447
garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store
High
CVE-2026-57130
PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
High
CVE-2026-57122
PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
Critical
CVE-2026-57116
PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation
High
CVE-2026-57126
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
Medium
CVE-2026-57115
PraisonAI: SpiderTools redirect-target SSRF protection bypass
High
CVE-2026-56834
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
High
CVE-2026-59884
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
Medium
CVE-2026-59203
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
High
CVE-2026-59199
Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
High
ghsa-xf7x-x43h-rpqh
json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS
Medium
CVE-2026-49836
psd-tools vulnerable to arbitrary file write via smart-object filename
Medium
CVE-2026-53720
pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small
High
CVE-2026-54071
BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py
High
CVE-2026-49477
Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser
High
CVE-2026-49476
Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.