CVE-2026-73240

Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73237

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73237 Apache Allura: XSS in markdown pipeline

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73237

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73237

CVE-2026-73237 concerns an XSS vulnerability in the Markdown handling pipeline of Apache Allura. Affected versions include 1.10.0 up to but not including 1.19.1. The issue is mitigated by upgrading to version 1.19.1, which contains the fix. The available documents do not specify the exact vulnera...

EUVD-2026-57344

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73238 Apache Allura: XSS in code display

XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73238

Apache Allura contains an XSS in code display vulnerability (CVE-2026-73238) affecting versions before 1.19.1. The issue is addressed by upgrading to Allura 1.19.1. The provided metrics indicate a CVSSv3.1 base score of 6.1 (Medium) with network attack vector, low confidentiality/integrity impact...

CVE-2026-73238

XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

EUVD-2026-57343

XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73239 Apache Allura: Missing permission checks IDOR

Insecure Direct Object Reference IDOR due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

EUVD-2026-57370

Insecure Direct Object Reference IDOR due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73239

CVE-2026-73239 : In Apache Allura, an Insecure Direct Object Reference (IDOR) arises from missing permission checks for multiple Artifact types. Affected versions: before 1.19.1. The advisory recommends upgrading to version 1.19.1 to fix the issue. The available sources consistently describe the ...

CVE-2026-73239

Insecure Direct Object Reference IDOR due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73240

Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

EUVD-2026-57369

Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73240 Apache Allura: Git command injection

Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73240

CVE-2026-73240 affects Apache Allura (before 1.19.1) and involves git command injection via specially crafted inputs. The issue is resolved by upgrading to Allura 1.19.1. This entry is supported by multiple sources in the connected documents, including NVD and CVE records, which explicitly state ...

CVE-2026-68969

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...

CVE-2026-68968

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...