Medium
CVE-2026-44512
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 452
Reset filters
Medium
CVE-2026-53533
aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address
High
CVE-2026-55786
flyto-core has Unauthenticated Command Execution via HTTP MCP `execute_module`
High
CVE-2026-55787
flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf
High
CVE-2026-49852
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
High
CVE-2026-50181
Langroid: Path traversal in the file tools allows read/write outside configured current directory
High
CVE-2026-50180
Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read
High
CVE-2026-52726
Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload
Critical
CVE-2026-50027
mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete
High
CVE-2025-10996
Open Babel has heap buffer overflow in SMILES OBSmilesParser::ParseSmiles
Medium
CVE-2026-55165
Lemur: JWT verifier honors attacker-supplied alg, enabling ATO
Medium
CVE-2026-55162
Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF
Medium
CVE-2026-48990
joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization
High
CVE-2026-48813
Flawfinder output manipulation via untrusted filenames and source text
High
CVE-2026-53925
Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
Medium
CVE-2026-32315
motionEye's World-Readable Configuration File Exposes Admin Password Hash
Medium
CVE-2026-46611
Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
High
CVE-2026-46606
Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
Medium
CVE-2026-55837
dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
High
CVE-2026-54499
Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
High
CVE-2026-54528
jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
High
CVE-2026-12530
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
High
CVE-2026-54695
Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID
Medium
CVE-2026-54014
Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.