Unrated
CVE-2026-81714
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 452
Reset filters
Unrated
CVE-2026-81716
openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a bare string-prefix match. A sandboxed pl
Unrated
CVE-2026-81694
openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command'
Unrated
CVE-2026-81690
openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not desce
Unrated
CVE-2026-81684
In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument (on
Medium
CVE-2026-81683
openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Setti
Unrated
CVE-2026-81681
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspac
Critical
ghsa-93qj-5q5v-3c2h
Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
High
CVE-2026-80206
NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
High
ghsa-vwf3-4xxj-qg6h
mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment
High
CVE-2026-79676
NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement
High
ghsa-8cp3-qxj6-px34
utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion
High
ghsa-9qhg-99ww-9mqc
utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target
Critical
CVE-2026-78683
NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
High
CVE-2026-63312
NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read
Medium
CVE-2026-65915
NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol
High
CVE-2026-62384
NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)
Medium
CVE-2026-62383
NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely
Medium
CVE-2026-76239
stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address
Medium
CVE-2026-102734
asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
High
CVE-2026-76222
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
High
CVE-2026-54284
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
High
CVE-2026-59893
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
High
CVE-2026-68519
Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.