CVE-2026-59242 Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

CVE-2026-59242 Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

CVE-2026-58076: Deserialization of Untrusted Data

Apache Airflow's serialization layer reconstructed exception nodes by calling importstring on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's executorconfig reaches that branch, so a D...

PT-2026-71139

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The serialization layer fails to restrict the classes imported during the reconstruction of exception nodes. By calling import string on a class name and instantiating it with arguments from a...

CVE-2026-71577

A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server token...

CVE-2026-71577: Insufficiently Protected Credentials

A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server token...

CVE-2026-61808

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...

PT-2026-69135

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.5rc1 Description The API server binds to all network interfaces with authentication disabled by default. This allows an unauthenticated network attacker to read indexed document content, upload or delete document...

CVE-2026-61808: Missing Authentication for Critical Function

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...

EUVD-2026-53700

A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation results in missing authentication. The attack may be performed from remote. The exploit is now public and may be used. The...

io.telicent.smart-caches.entity-resolution:cli-canonical-index (>=0.6.2, <=0.6.4), io.telicent.smart-caches.entity-resolution:entity-resolver-api-server (>=0.6.2, <=0.6.4) +1 more potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.33.3)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.33.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: -...

Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

HTTPTriggerSpec.Validate validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only pkg/fission-cli/cmd/httptrigger/create.go:83. The post-CRD-modernization webhook for HTTPTrigger w...

PostgREST API Server - Exposure Detection

PostgREST API Server was detected and appeared to be accessible without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """PostgREST API Server was detected and appeared to be accessible without authentication.""" from kittysploit import from lib.protocols.http.httpclient import...

CData API Server < 23.4.8844 - Path Traversal Detection

A path traversal vulnerability exists in the Java version of CData API Server 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. !/usr/bin/env python3 -- coding: utf-8 -- """A path...

Burp Rest API Server Running Detection

Detects Burp Rest API Server Running. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Burp Rest API Server Running.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Burp Rest API Server Running Detection',...

Traccar Server Settings - Disclosure Detection

Traccar exposes server settings at the /api/server endpoint without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Traccar exposes server settings at the /api/server endpoint without authentication.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

PraisonAI - Authentication Bypass Detection

PraisonAI 2.5.6 to 4.6.34 contains a broken authentication caused by disabled default authentication in legacy Flask API server, letting remote attackers access /agents and trigger workflows without token, exploit requires network access to API server. !/usr/bin/env python3 -- coding: utf-8 --...

OPENSUSE-SU-2026:11390-1 kubernetes1.35-apiserver-1.35.7-1.1 on GA media

These are all security issues fixed in the kubernetes1.35-apiserver-1.35.7-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11389-1 kubernetes1.34-apiserver-1.34.10-1.1 on GA media

These are all security issues fixed in the kubernetes1.34-apiserver-1.34.10-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-66005

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...