Critical
CVE-2026-59971
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,997
Reset filters
Medium
CVE-2026-87013
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
High
CVE-2026-87011
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
High
CVE-2026-87995
Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
Medium
CVE-2026-87017
Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
High
CVE-2026-87998
Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
High
CVE-2026-87996
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
High
CVE-2026-87999
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Medium
CVE-2026-50221
OpenStack Swift vulnerable to authenticated server-side request forgery
High
CVE-2025-66336
Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path
Medium
CVE-2026-9073
foreman-mcp-server Inserts Sensitive Information into Log File
Medium
CVE-2026-12773
LiteLLM: MCP Proxy Has Improper Authentication
Low
CVE-2026-12798
BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
Critical
CVE-2026-56315
PickleScan has multiple stdlib modules with direct RCE not in blocklist
Medium
CVE-2026-102830
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
Medium
CVE-2026-102904
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
High
CVE-2026-102831
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
High
CVE-2026-102930
Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
Medium
CVE-2026-103261
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
High
CVE-2026-103262
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
High
CVE-2026-103263
Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
Medium
CVE-2026-102275
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
High
CVE-2026-100845
MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files
Unrated
CVE-2026-100650
vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB,
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.