High
CVE-2022-4223
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,364
Reset filters
Medium
CVE-2022-4105
Cross-site Scripting in kiwitcms
High
CVE-2022-41547
MobSF allows attackers to read arbitrary files via a crafted HTTP request
High
CVE-2022-39254
When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder
Medium
CVE-2022-3102
jwcrypto token substitution can lead to authentication bypass
Medium
CVE-2022-3355
Inventree vulnerable to Stored Cross-site Scripting
Medium
CVE-2021-23385
Flask-Security vulnerable to Open Redirect
Medium
CVE-2022-3644
Plaintext storage of tokens in pulp_ansible
High
CVE-2022-1941
protobuf-cpp and protobuf-python have potential Denial of Service issue
High
CVE-2022-42906
Powerline Gitstatus vulnerable to arbitrary code execution
High
CVE-2026-57573
Crawl4AI: Unauthenticated SSRF on the Docker server streaming crawl path (/crawl/stream)
Critical
CVE-2026-57572
Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args
High
CVE-2026-55574
vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends
High
CVE-2026-55514
vLLM denial of service via prompt embeds on M-RoPE models
Critical
CVE-2026-57571
Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE
Medium
CVE-2026-55646
vLLM: Speech-to-text upload size limit is enforced after full UploadFile read
High
CVE-2026-54060
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
High
CVE-2026-54059
Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
Medium
CVE-2026-55798
Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
High
CVE-2026-55379
Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
High
CVE-2026-55380
Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
High
CVE-2026-49297
Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination filesystem pa
High
CVE-2026-24012
Uncontrolled Resource Consumption vulnerability in Apache IoTDB.
Critical
CVE-2026-24013
Authentication Bypass by Spoofing vulnerability in Apache IoTDB.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.