Medium
CVE-2026-5832
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-5831
Agions taskflow-ai vulnerable to os command injection in src/mcp/server/handlers.ts
Medium
CVE-2026-40778
Majestic Support <= 1.1.2 - Missing Authorization
Medium
CVE-2026-42652
User Registration <= 5.1.5 - Reflected Cross-Site Scripting
High
CVE-2023-54359
Travel & Tours Meta Search <= 2.3 - Unauthenticated SQL Injection
Critical
CVE-2026-6443
Essentialplugin Plugins (Various Versions) - Injected Backdoor
Medium
CVE-2023-54358
Travel & Tours Meta Search <= 2.3 - Reflected Cross-Site Scripting
Critical
CVE-2026-40088
PraisonAI Vulnerable to OS Command Injection
Critical
Exploited in attacks
CVE-2026-39987
Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
High
ghsa-5478-66c3-rhxr
Pretext: Algorithmic Complexity (DoS) in the text analysis phase
Medium
CVE-2026-39892
Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
Medium
CVE-2026-39844
NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
High
CVE-2026-39983
basic-ftp has FTP Command Injection via CRLF
High
CVE-2026-39976
Laravel Passport: TokenGuard Authenticates Unrelated User for Client Credentials Tokens
High
CVE-2026-39974
n8n-mcp has authenticated SSRF via instance-URL header in multi-tenant HTTP mode
High
CVE-2026-39959
Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service
High
CVE-2026-39885
mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
Critical
CVE-2026-39888
PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
Critical
CVE-2026-39890
PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading
High
CVE-2026-39394
CI4MS Vulnerable to .env CRLF Injection via Unvalidated `host` Parameter in Install Controller
High
CVE-2026-39393
CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass
Medium
CVE-2026-39392
CI4MS has stored XSS in Pages Content Due to Missing html_purify Sanitization
Medium
CVE-2026-39391
CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List
Medium
CVE-2026-39390
CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.