Medium
CVE-2025-71378
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,364
Reset filters
High
CVE-2025-71357
Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
High
CVE-2025-71348
Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config
High
CVE-2026-56340
vLLM introduced enhanced protection for CVE-2025-62164
Medium
CVE-2026-56304
picklescan vulnerable to arbitrary file create using logging.FileHandler
Medium
CVE-2026-58203
pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size
High
CVE-2026-59152
LangSmith SDK TracingMiddleware: Arbitrary server-side file read
Medium
CVE-2026-58266
Anki: User scripts in iframes have access to the internal Anki API
Medium
CVE-2026-58198
ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
High
CVE-2026-58499
EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id
High
CVE-2026-76238
stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)
High
CVE-2026-76237
stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)
High
CVE-2026-76236
stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)
Critical
CVE-2026-55447
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
High
ghsa-rpj2-4hq8-938g
VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files
High
ghsa-p5wc-9w9r-m232
Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser
High
ghsa-8823-qg2x-pv9f
Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit
High
CVE-2026-54527
jupyterlab-git extension: Stored XSS leading to RCE
High
CVE-2026-66065
ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
Medium
CVE-2026-67338
JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol
High
CVE-2026-57586
agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
Medium
CVE-2026-58653
praisonai-platform: Authorization Bypass Through User-Controlled Key
Critical
CVE-2026-47103
python-statemachine SCXML <data expr> Eval Injection
Critical
CVE-2026-57125
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.