Medium
CVE-2026-31815
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 53
Reset filters
High
CVE-2026-22612
Fickling vulnerable to detection bypass due to "builtins" blindness
High
CVE-2025-62172
Home Assistant has Stored XSS vulnerability in Energy dashboard from Energy Entity Name
Medium
CVE-2024-29888
Saleor: Customers' addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method
Low
CVE-2024-29199
Unauthenticated views may expose information to anonymous users
Medium
CVE-2023-46121
yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection
High
CVE-2026-54317
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
Medium
ghsa-g75f-g53v-794x
Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning
High
CVE-2026-44721
open-webui Vulnerable to Stored XSS via Model Description
High
ghsa-v7qw-hx66-4w9x
netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow tables
Medium
CVE-2026-25219
Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access
Medium
ghsa-9gjv-jvm7-vv2v
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
High
CVE-2026-32634
Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
Critical
CVE-2026-32633
Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
Low
ghsa-83pf-v6qq-pwmr
Fickling has a detection bypass via stdlib network-protocol constructors
Medium
CVE-2025-68131
CBORDecoder reuse can leak shareable values across decode calls
High
CVE-2025-64495
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Critical
CVE-2025-10157
Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports
High
CVE-2025-57760
Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)
High
CVE-2025-8747
Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
High
CVE-2025-47783
label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.
Medium
CVE-2023-47037
We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then.
Medium
CVE-2023-32675
Vyper's nonpayable default functions are sometimes payable
High
CVE-2022-36447
chia-blockchain tokens can be inflated to an arbitrary extent
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.