PYSEC-2026-1149 Apache Airflow JDBC Provider Improper Input Validation vulnerability

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s Connection URL parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission...

Apache Airflow JDBC Provider Improper Input Validation vulnerability

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s Connection URL parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission...

agogosml-cli (0.1.2), chip-wallet-dstack (>=1.3.0, <=1.5.0) +23 more potentially affected by CVE-2023-32758 via git-url-parse (>=1.0.2, <=1.2.2)

git-url-parse PYPI version =1.0.2, =1.3.0, =1.11.4rc1, =0.3.1.1, =0.5.0, =0.0.4rc12, =0.1.2, =0.1.0, =0.0.1, =0.25.0, =0.3.10, =0.6.8 and more Source cves: CVE-2023-32758 Source advisory: OSV:PYSEC-2026-1404...

CVE-2026-48828

creationtimestamp| type| source ---|---|--- 2026-07-07 11:34:37+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2j5dmjes2x 2026-07-07 12:16:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2li2o6vg2w...

CVE-2026-14476

creationtimestamp| type| source ---|---|--- 2026-07-07 11:32:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2iytgfgd2a 2026-07-20 13:12:20+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mr3enz3dlw2l 2026-07-20 14:14:46+00:00| seen|...

PYSEC-2026-1064 Open redirect in web2py

Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack...

Cross-site Scripting in django-ajax-utilities

A vulnerability was found in Mobile Vikings Django AJAX Utilities and classified as problematic. This issue affects the function Pagination of the file djangoajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to cross site...

PYSEC-2026-803 Cross-site Scripting in django-ajax-utilities

A vulnerability was found in Mobile Vikings Django AJAX Utilities and classified as problematic. This issue affects the function Pagination of the file djangoajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to cross site...

PYSEC-2026-809 Flask-Security vulnerable to Open Redirect

This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...

CVE-2026-57868

creationtimestamp| type| source ---|---|--- 2026-07-07 08:39:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq27ddn7ny2u...

CVE-2026-8309

creationtimestamp| type| source ---|---|--- 2026-07-07 08:24:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq26ii7rnj2b...

CVE-2026-57871

creationtimestamp| type| source ---|---|--- 2026-07-07 08:02:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq25c7qnkf2a...

CVE-2026-5730

creationtimestamp| type| source ---|---|--- 2026-07-07 07:59:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq254tqfsn2a...

CVE-2026-34198

creationtimestamp| type| source ---|---|--- 2026-07-07 04:26:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzr7cexwq2y...

CVE-2026-34171

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/uuid endpoint can perform a state-changing password reset using an attacker-known invitation UUID, allowing an attacker who can cause a victim to visit...

CVE-2026-42200

creationtimestamp| type| source ---|---|--- 2026-07-07 03:58:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzpnah5yk2y 2026-07-07 06:01:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpzwj4t67o25...

CVE-2026-34170 Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...

EUVD-2026-41997

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...

CVE-2026-34170 Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...

CVE-2026-34171

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/uuid endpoint can perform a state-changing password reset using an attacker-known invitation UUID, allowing an attacker who can cause a victim to visit...