Medium
CVE-2026-42032
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
Medium
CVE-2026-42510
OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
Medium
CVE-2026-7206
sqlite-mcp has an Injection issue
Medium
CVE-2026-7212
notes-mcp has a Path Traversal issue
Medium
CVE-2026-7158
mcp-url-downloader has a Server-Side Request Forgery issue
Medium
CVE-2026-7159
mkdocs-mcp-plugin has a Path Traversal issue
Medium
CVE-2026-41132
CKAN has no certificate validation on STMP connection
Medium
CVE-2026-42052
beets has a Cross-site Scripting vulnerability
Low
CVE-2026-7150
auto-favicon has a Server-Side Request Forgery issue
Low
CVE-2026-7142
Wooey has an Incorrect Privilege Assignment issue
Medium
CVE-2026-6357
pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
High
CVE-2026-42203
LiteLLM: Server-Side Template Injection in /prompts/test endpoint
High
Exploited in attacks
CVE-2026-42271
LiteLLM: Authenticated command execution via MCP stdio test endpoints
Medium
CVE-2026-7149
kaggle-mcp has a Path Traversal issue
Medium
CVE-2026-6550
AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache
Low
CVE-2026-6984
AstrBot has Incomplete Filtering of Special Elements
Low
CVE-2026-6878
verl's math_equal() Vulnerable to Arbitrary Code Execution via Unsafe eval()
Low
CVE-2026-41140
Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4
High
CVE-2026-33626
LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
High
CVE-2026-6859
InstructLab Includes Functionality from Untrusted Control Sphere
High
CVE-2026-6855
InstructLab vulnerable to Path Traversal
Medium
CVE-2025-66335
Apache Doris MCP Server vulnerable to SQL Injection via improper query context neutralization
Medium
CVE-2026-3219
pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files
Medium
CVE-2026-6606
AgentScope vulnerable to Server-Side Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.