Low
CVE-2026-46497
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 427
Reset filters
High
CVE-2026-45370
python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection
High
CVE-2026-45727
CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion
Medium
CVE-2026-45396
Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation
Medium
CVE-2026-45397
Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure
High
CVE-2026-45348
pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal
Medium
CVE-2026-45347
Open WebUI vulnerable to blind server side request forgery (SSRF) via the PDF generate function
Medium
CVE-2026-45317
Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation
High
CVE-2026-43978
wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager
High
CVE-2026-44541
ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override
Medium
CVE-2026-44968
dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters
Low
CVE-2026-44969
dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled
Medium
CVE-2026-43979
local-deep-research is Vulnerable to HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)
High
CVE-2026-7816
pgAdmin 4: OS command injection vulnerability in Import/Export query export
Medium
CVE-2026-44972
GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
High
CVE-2026-44971
GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
Medium
CVE-2026-44337
PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries
Medium
CVE-2026-44844
eml_parser has recursion DoS via nested message/rfc822 attachments
High
CVE-2026-44307
Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup
High
CVE-2026-44304
Lemur: LDAP Filter Injection enables post-authentication privilege escalation
Medium
CVE-2026-44222
vLLM Vulnerable to Remote DoS via Special-Token Placeholders
Medium
CVE-2026-42303
Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection
Medium
CVE-2026-42080
PPTAgent: Arbitrary File Write via `save_generated_slides`
Medium
CVE-2026-42052
beets has a Cross-site Scripting vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.