High
CVE-2026-39307
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
High
CVE-2026-35464
pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)
Medium
CVE-2025-64182
OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()
Medium
CVE-2026-26981
OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
Medium
CVE-2025-64183
OpenEXR has use after free in PyObject_StealAttrString
Low
CVE-2025-64181
OpenEXR Makes Use of Uninitialized Memory
Low
CVE-2026-5559
PyBlade: SSTI/RCE via Bypassed AST Validation in sandbox.py
Medium
CVE-2026-35492
kedro-datasets has a path traversal vulnerability in PartitionedDataset that allows arbitrary file write
Medium
CVE-2026-34753
vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `
High
CVE-2026-33752
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
High
CVE-2026-34543
OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
High
CVE-2026-34544
OpenEXR: integer overflow to OOB write in uncompress_b44_impl()
High
CVE-2026-40072
web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling
High
CVE-2026-35029
LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
High
CVE-2026-30762
LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass
High
CVE-2026-35187
pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter
Medium
CVE-2026-34052
LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)
Medium
CVE-2026-35052
D-Tale: Remote Code Execution through redis/shelf storage
High
CVE-2026-35175
Ajenti has an authorization bypass during custom package installation
High
CVE-2026-34954
PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL
High
CVE-2026-34955
PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox
High
CVE-2026-34936
PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback
Medium
CVE-2026-34881
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
Medium
CVE-2026-34939
PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.