apache__uima-uimaj_CVE-2022-32287_3-3-0

Bienvenido al SDK de Java de Apache UIMA Apache UIMAUIMA le ayuda a gestionar datos no estructurados como textos que se enriquecen con información útil. Por ejemplo, si desea identificar una mención de una entidad en un texto o vincular esa entidad a un conjunto de datos de referencia, Apache UIM...

PYSEC-2026-3989

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-82355: Session Fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CLEANSTART-2026-RF04086 Security fix for CVE-2024-4603 applied in: openssl 3.3.0-r2

Security vulnerability affects the openssl package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-81546

Affinity by Canva versions prior to 3.3.0 (September 2026 release) contain a stack-based buffer overflow caused by inadequate bounds checking when parsing Affinity document files. A threat actor could craft a malicious Affinity document that, when opened by a user, may lead to arbitrary code exec...

CVE-2026-90678

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...

CVE-2026-81787

Unauthenticated Broken Authentication in IMPress for IDX Broker = 3.3.0 versions...

CVE-2026-81787

CVE-2026-81787 affects the WordPress plugin IMPress for IDX Broker (versions ≤ 3.3.0 ). The vulnerability is an unauthenticated Broken Authentication flaw, meaning an attacker with network access and no prior credentials can exploit it. The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:...

EUVD-2026-75521

Subscriber Broken Access Control in IMPress for IDX Broker = 3.3.0 versions...

PT-2026-89435

Subscriber Broken Access Control in IMPress for IDX Broker = 3.3.0 versions...

PT-2026-89434

Unauthenticated Broken Authentication in IMPress for IDX Broker = 3.3.0 versions...

CVE-2026-81826: Insufficient Session Expiration

Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their password does not terminate that...

EUVD-2026-63190

A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to th...

CVE-2026-76795

PullMD 3.2.0's REST API endpoint at /api accepts an unvalidated url argument, enabling remote server-side request forgery (SSRF). CVSS 3.1 scores it HIGH (7.3, network vector, no auth required). A public PoC exploit exists. Upgrade to version 3.3.0 (patch commit 96448894cc93ccecb0bdcbf263a9d25390...

PT-2026-78877

A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to th...

CVE-2026-55090

Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value...

CVE-2026-55090

Etherpad (real-time collaborative editor) versions prior to 3.3.0 are vulnerable to stored cross-site scripting in the HTML export feature. The root cause is in getHTMLFromAtext in src/node/utils/ExportHtml.ts, which interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into s...

EUVD-2026-62734

Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value...