Medium
CVE-2026-76239
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,801
Reset filters
High
CVE-2026-55253
LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
Medium
CVE-2026-102734
asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
High
ghsa-p77j-g7h5-r2vw
GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)
High
CVE-2026-76221
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)
High
CVE-2026-76222
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
High
CVE-2026-71417
Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
Medium
CVE-2026-71317
Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority
High
CVE-2026-71308
Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates
High
CVE-2026-71307
Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API
Medium
CVE-2026-70667
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)
Medium
CVE-2026-73974
linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)
High
CVE-2026-70666
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
High
CVE-2026-71303
Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist
Medium
CVE-2026-54723
devpi-server may leak database contents
Medium
CVE-2026-71322
Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
Critical
CVE-2026-55211
surfio has an out-of-bounds read
Critical
Exploited in attacks
CVE-2026-64849
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
Medium
CVE-2026-68924
MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
Medium
CVE-2026-68922
MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads
High
CVE-2026-54284
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
Low
CVE-2026-68927
MobSF has SSRF port restriction bypass in assetlinks_check
Critical
CVE-2026-55209
resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read
High
CVE-2026-59893
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.