High
CVE-2026-40153
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
Medium
CVE-2026-56078
PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling
High
CVE-2026-40116
PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits
High
CVE-2026-39891
PraisonAI has Template Injection in Agent Tool Definitions
High
CVE-2026-40113
PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars
Medium
CVE-2026-40112
PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)
High
CVE-2026-39889
PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server
Medium
CVE-2026-5970
MetaGPT has an Injection issue
Medium
CVE-2026-5974
FoundationAgents MetaGPT vulnerable to OS Command Injection in metagpt/tools/libs/terminal.py
Medium
CVE-2026-5971
FoundationAgents MetaGPT vulnerable to eval injection
Medium
CVE-2026-5972
FoundationAgents MetaGPT vulnerable to os command injection via the Terminal.run_command
Medium
CVE-2026-5973
FoundationAgents MetaGPT vulnerable to OS Command Injection in metagpt/utils/common.py
Medium
CVE-2026-40087
LangChain has incomplete f-string validation in prompt templates
High
CVE-2026-31040
stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution
High
CVE-2026-39308
PraisonAI recipe registry publish path traversal allows out-of-root file write
Medium
CVE-2026-33753
rfc3161-client Has Improper Certificate Validation
Medium
CVE-2026-40071
pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
High
CVE-2026-34589
OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write
Medium
CVE-2026-22680
OpenViking contains a missing authorization vulnerability in the task polling endpoints
High
CVE-2026-34588
OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
High
CVE-2026-34444
Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr
Medium
CVE-2026-1163
parisneo/lollms has an insufficient session expiration vulnerability
Medium
CVE-2026-39413
lightrag-hku: JWT Algorithm Confusion Vulnerability
High
CVE-2026-39306
PraisonAI recipe registry pull path traversal writes files outside the chosen output directory
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.