Critical
CVE-2026-59971
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 58
Reset filters
High
ghsa-62mm-xwmv-crhg
khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem
Medium
CVE-2026-54553
Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
High
CVE-2026-55533
PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret
High
CVE-2026-55528
praisonaiagents: AgentServer declares auth_token but never enforces it on any route
High
CVE-2026-55541
PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
Medium
CVE-2026-55529
PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server
Medium
CVE-2026-68517
Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard
Critical
CVE-2026-61736
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
High
CVE-2026-59950
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
Critical
CVE-2026-57124
PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai
High
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
Critical
CVE-2026-57123
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
Critical
CVE-2026-57127
praisonai: recipe serve auth middleware silently disables itself when no secret is set
Critical
CVE-2026-57131
PraisonAI: Jobs API exposes agent-execution endpoints with no authentication
High
CVE-2026-56836
PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
Medium
CVE-2026-55837
dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
High
CVE-2026-46608
Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
Low
CVE-2026-53537
python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
Low
CVE-2026-53540
python-multipart: Negative Content-Length in parse_form buffers the entire body in memory
High
CVE-2026-53539
python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
Low
CVE-2026-53538
python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
Medium
CVE-2026-45554
NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes
High
CVE-2026-44716
Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.