Medium
CVE-2026-34939
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 452
Reset filters
High
CVE-2026-34937
PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
Medium
CVE-2026-28786
Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`
High
CVE-2025-14287
MLflow has a command injection in mlflow/sagemaker/__init__.py
Low
CVE-2026-29790
dbt-common's commonprefix() doesn't protect against path traversal
High
CVE-2026-1669
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
Medium
ghsa-mxwc-wh95-pw4g
Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler
High
CVE-2026-59939
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
Medium
CVE-2026-59930
Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content
Medium
CVE-2026-59927
Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
Medium
CVE-2026-59923
Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
Medium
ghsa-f66q-9rf6-8795
Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion
Low
CVE-2026-1703
pip Path Traversal vulnerability
High
CVE-2026-24123
BentoML has a Path Traversal via Bentofile Configuration
High
CVE-2026-24049
Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack
High
CVE-2026-22870
GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS
High
CVE-2026-22606
Fickling has a bypass via runpy.run_path() and runpy.run_module()
High
CVE-2026-22607
Fickling Blocklist Bypass: cProfile.run()
Medium
CVE-2026-21892
Parsl Monitoring Visualization Vulnerable to SQL Injection
High
CVE-2025-71322
Picklescan Bypasses Unsafe Globals Check using pty.spawn
Medium
CVE-2025-67743
Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service
Medium
CVE-2025-68146
filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
Low
CVE-2025-66040
Spotipy has a XSS vulnerability in its OAuth callback server
High
CVE-2025-12060
Keras Directory Traversal Vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.