High
CVE-2026-34222
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
High
CVE-2026-34937
PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
High
CVE-2026-27124
FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities
Medium
CVE-2025-64340
FastMCP has a Command Injection vulnerability - Gemini CLI
Medium
CVE-2026-34400
alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API
Low
CVE-2026-4963
Hugging Face Smolagents has an Injection issue
High
CVE-2025-15381
MLFlow allows Tracing + Assessments Access
High
CVE-2026-34172
Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment
Low
CVE-2026-29071
Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories
Low
CVE-2026-33045
Home Assistant has stored XSS in history-graphs
Low
CVE-2026-33044
Home Assistant has stored XSS in Map-card through malicious device name
Medium
CVE-2026-33936
python-ecdsa: Denial of Service via improper DER length validation in crafted private keys
High
CVE-2026-33980
Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries
Medium
CVE-2026-32794
Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange
Medium
CVE-2026-33699
pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream
Medium
CVE-2026-29070
Open WebUI has unauthorized deletion of knowledge files
High
CVE-2026-24159
NVIDIA NeMo Framework contains a vulnerability leading to Remote Code Execution
High
CVE-2026-24157
NVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading
Low
CVE-2026-4539
Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching
High
CVE-2026-33509
pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
Medium
CVE-2026-28786
Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`
High
CVE-2026-28788
Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
Medium
CVE-2026-33545
MobSF has SQL Injection in its SQLite Database Viewer Utils
Low
CVE-2026-4506
MindSQL is vulnerable to Code Injection through its ask_db function
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.