Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 34

Reset filters

Medium 19.10.2026

ghsa-pcc4-rvhr-2pr8

Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo

Incomplete cpp #include hardening in the Graphify Fortran extractor allows arbitrary host files to be read and exfiltrated into the knowledge graph when indexing an untrusted repository.

Medium 30.09.2026

CVE-2026-103261

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

High 30.09.2026

CVE-2026-103262

tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

High 30.09.2026

CVE-2026-103263

Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

High 02.09.2026

CVE-2026-82397

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Medium 01.09.2026

CVE-2026-91990

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

Low 01.09.2026

CVE-2026-91991

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

High 31.07.2026

CVE-2026-53502

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

High 23.06.2026

CVE-2026-55488

motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read

High 23.06.2026

CVE-2026-54134

OctoPrint has possible file exfiltration via query parameters on upload endpoints

Medium 22.06.2026

CVE-2026-31978

motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint

High 19.06.2026

CVE-2026-54528

jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

High 15.06.2026

CVE-2026-49855

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

Low 12.06.2026

CVE-2026-49854

Tornado has out-of-bounds memory access via C extension

High 15.06.2026

CVE-2026-49853

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

Medium 10.06.2025

CVE-2025-48879

OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint

High 16.05.2025

CVE-2025-47287

Tornado vulnerable to excessive logging caused by malformed multipart form data

High 22.11.2024

CVE-2024-52804

Tornado has an HTTP cookie parsing DoS vulnerability

High 03.04.2024

CVE-2024-30265

Voilà Local file inclusion

Medium 06.03.2024

CVE-2024-27287

esphome vulnerable to stored Cross-site Scripting in edit configuration file API

Critical 23.06.2026

ghsa-phv5-334h-mxcw

motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal

Medium 15.06.2026

CVE-2026-91992

Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

Critical 03.06.2026

CVE-2026-44180

Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass

High 11.03.2026

CVE-2026-35536

Tornado has cookie attribute injection via .RequestHandler.set_cookie

Showing 1 to 24 of 34 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 34

Know which vulnerabilities affect your application

Application security in your inbox