Medium
CVE-2026-54009
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 452
Reset filters
Medium
CVE-2026-47425
rattler has an entry-point path traversal in noarch:python install (arbitrary file write)
High
CVE-2026-47397
PraisonAI has an Arbitrary File Write in Python API
High
CVE-2026-48169
PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API
High
CVE-2026-46439
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
Medium
CVE-2026-45774
compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal
High
CVE-2026-45725
compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal
Medium
CVE-2026-45309
AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username
Low
CVE-2026-46497
Crawlee for Python: SSRF via sitemap-derived URLs
High
CVE-2026-46517
lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out
Medium
CVE-2026-46338
Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path
High
CVE-2026-48989
Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS
Medium
CVE-2026-45554
NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes
High
CVE-2026-45804
Diffusers: TOCTOU Trust Remote Code Bypass
High
CVE-2026-44716
Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator
Medium
CVE-2026-45365
Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED]
Medium
CVE-2026-45397
Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure
High
CVE-2026-45349
Open WebUI has Broken Access Control for Completions API
Medium
CVE-2026-44968
dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters
Low
CVE-2026-44970
dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction
High
CVE-2026-44340
PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
High
CVE-2026-44338
PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
Medium
CVE-2026-44844
eml_parser has recursion DoS via nested message/rfc822 attachments
Medium
CVE-2026-44560
Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.