Medium
CVE-2026-57175
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-57177
social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend
Medium
CVE-2026-49264
Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
High
CVE-2026-57171
Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
Medium
CVE-2026-59980
hpack: Unbounded variable integer decoding can cause run-away computation on malformed input
High
CVE-2026-57170
Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Medium
CVE-2026-61541
Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service
Medium
CVE-2026-92164
Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files
Critical
CVE-2026-57149
plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
Medium
CVE-2026-57576
plone.app.dexterity has a Denial of Service due to excessive title or description length
Medium
CVE-2026-93421
Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
High
CVE-2026-61652
Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)
Critical
CVE-2026-91130
Home Assistant: XSS in Statistics Graph Card
Medium
CVE-2026-83805
Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs
Medium
CVE-2026-91129
Home Assistant: mDNS Server-Side Request Forgery
Medium
CVE-2026-85709
lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
High
CVE-2026-85740
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
Critical
CVE-2026-85734
lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
Medium
CVE-2026-86062
lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
Medium
CVE-2026-85725
lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function
Medium
CVE-2026-83801
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text
Critical
CVE-2026-77244
[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token
High
CVE-2026-77271
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)
Medium
CVE-2026-77250
MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.