High
ghsa-8qx3-8gm5-9cj2
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
ghsa-8cp3-qxj6-px34
utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion
Medium
CVE-2026-12210
utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins
High
ghsa-9qhg-99ww-9mqc
utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target
Critical
CVE-2026-19632
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
High
CVE-2026-55522
PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code
Critical
CVE-2026-79657
NLTK: Allowlisted pickle loaders still permit code execution in current source
Unrated
CVE-2026-78684
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to ini
Critical
CVE-2026-78683
NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
Critical
CVE-2026-78676
GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE
High
CVE-2026-78677
GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
Medium
CVE-2026-78678
GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()
High
CVE-2026-78681
NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses
High
CVE-2026-78682
NLTK: pathsec SSRF protection can be bypassed when a proxy is configured
High
CVE-2026-78675
GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)
Medium
CVE-2026-78125
LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Information Exposure
High
CVE-2026-78292
Hash Form – Drag & Drop Form Builder <= 1.4.1 - Unauthenticated PHP Object Injection
High
CVE-2026-77016
Workeera – AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2026-78286
Geo Controller <= 8.9.8 - Unauthenticated PHP Object Injection
Medium
CVE-2026-13416
CMP – Coming Soon & Maintenance Plugin by NiteoThemes < 4.1.18 - Authenticated (Editor+) Stored Cross-Site Scripting
High
CVE-2026-78271
FluentCRM Pro <= 3.1.12 - Authenticated (Editor+) Privilege Escalation
Medium
CVE-2026-78285
Like Button Rating ♥ LikeBtn <= 2.6.61 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-78257
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.5 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-75977
Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.