Medium
CVE-2026-48520
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,364
Reset filters
High
CVE-2026-33760
Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints
High
CVE-2026-56258
Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server
Medium
CVE-2026-47155
vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors
High
CVE-2026-41523
vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution
High
CVE-2026-54232
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package.
Critical
CVE-2026-48746
vLLM: OpenAI auth bypass
Medium
CVE-2026-54911
UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()
Medium
CVE-2026-44889
WebOb: Location header normalization during redirect leads to open redirect - again
Medium
CVE-2026-41479
Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type
Critical
CVE-2026-46488
motionEye: Authentication possible via password hash
Medium
CVE-2026-55443
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
High
CVE-2026-54293
Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read
Low
CVE-2026-54280
aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
Low
CVE-2026-54279
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
Medium
CVE-2026-54278
aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
Medium
CVE-2026-54277
aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines
Medium
CVE-2026-54276
aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
High
CVE-2026-54283
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
Low
CVE-2026-54282
Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
Low
CVE-2026-54275
aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
Medium
CVE-2026-54273
aiohttp: HTTP/1 Pipelined Requests Queue Without Limit
Medium
CVE-2026-54274
aiohttp: Incomplete websocket frame payloads bypass memory limits
Low
CVE-2026-50269
aiohttp: CRLF injection in multipart headers
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.