58389 matches found
CVE-2026-54897
A flaw was found in Oj Optimized JSON, a Ruby gem for parsing JSON. This vulnerability, categorized as a heap use-after-free CWE-416, occurs in the Oj::Doc iterators, specifically eachvalue, eachchild, and eachleaf. An attacker could exploit this when a Ruby code block, executed during iteration,...
CVE-2026-54896
A flaw was found in Oj Optimized JSON, a Ruby gem used for processing JSON data. This vulnerability occurs when the software attempts to serialize convert into a format for storage or transmission Exception objects with a very large indentation setting. The internal process for handling this...
PYSEC-2026-827 jwcrypto token substitution can lead to authentication bypass
The JWT code can auto-detect the type of token being provided, and this can lead the application to incorrect conclusions about the trustworthiness of the token. Quoting the private disclosure we received : "Under certain circumstances, it is possible to substitute a .. signed JWS with a JWE that...
CVE-2026-48828
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...
CVE-2026-54899
A flaw was found in Oj Optimized JSON, a Ruby gem for parsing JSON. When a Oj::Parser instance is reused and its symbolkeys setting is toggled from true to false, a heap use-after-free vulnerability occurs. This happens because the internal key cache is freed but its pointer is not cleared,...
EUVD-2026-42028
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...
CVE-2026-48828 Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...
CVE-2026-48828 Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...
CVE-2026-48828
The Bulk Variables API in Apache Airflow fails to pass the variable's key to the redactor for JSON-decodable values. This causes the should_hide_value_for_key check to fail for keys ending in suffixes like *_password, *_token, or *_secret. Consequently, an authenticated user with bulk Variable re...
CVE-2026-48828
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...
CVE-2026-48828 Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...
CVE-2026-48828
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based "shouldhidevalueforkey" check which triggers on secret-suffixed key names like "password" / "token" / "secret" could not fire for JSON-decodable variable values. An authenticated UI/A...
PT-2026-56237
Name of the Vulnerable Software and Affected Versions Chevereto versions 3.7.5 through 4.5.3 Description An issue exists in the self-hosted media-sharing platform where the /json AJAX listing endpoint fails to enforce private profile restrictions. While the profile HTML route /username correctly...
PT-2026-56176
Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.0 Description The Bulk Variables API fails to pass the variable's key to the redactor. This prevents the should hide value for key function from identifying secret-suffixed key names, such as password, toke...
CVE-2026-48828: Exposure of Sensitive Information to an Unauthorized Actor
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...
CVE-2026-55417: Missing Authorization
Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route /username correctly returns 404. However, the /json AJAX listing endpoint does not apply the same check. An...
JWT Ruby Authentication DoS
The vulnerability of the JWT Ruby implementation is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to cause service failures...
Oracle Linux 9 : ruby:4.0 (ELSA-2026-33577)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-33577 advisory. - Fix Net::IMAP ResponseReader quadratic complexity vulnerability. CVE-2026-42245 Resolves: RHEL-181690 - Fix Net::IMAP STARTTLS stripping...
Linux Distros Unpatched Vulnerability : CVE-2026-14803
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path decodevalue...
