282339 matches found
CVE-2026-86843
The Apache Airflow Teradata provider is vulnerable to SQL injection because the compute-cluster example Dag allows unconstrained free-text Dag Params . These parameters are templated directly into operators that interpolate values into Teradata DDL . An attacker with permission to trigger the Dag...
CVE-2026-81930 Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
CVE-2026-81930 Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
CVE-2026-81930
The Apache Airflow Snowflake provider fails to validate the account and region fields before interpolating them into request URLs. An attacker can provide values containing /, ?, or # to demote the intended domain to a path, query, or fragment, allowing them to control the request host. This enab...
CVE-2026-81930 Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
EUVD-2026-88695
Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. S3ToTeradataOperator and AzureBlobStorageToTeradataOperator interpolate the source bucket's credentials as plain string literals into the CREATE MULTISET TABLE ... LOCATION statement whenever the...
CVE-2026-81862 Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs
Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. S3ToTeradataOperator and AzureBlobStorageToTeradataOperator interpolate the source bucket's credentials as plain string literals into the CREATE MULTISET TABLE ... LOCATION statement whenever the...
intigriti-0926-writeup
Intigriti Challenge 0926 — Critter Gallery: UNION-based SQL In...
CVE-2026-96430
Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter...
CVE-2026-96428
SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter...
CVE-2026-96429
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...
CVE-2026-96430 Flowring Agentflow 4.0 - Exposed Dangerous Method or Function
Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter...
CVE-2026-96430
Flowring Agentflow 4.0 (versions before 2026/08/28) contains an Exposed Dangerous Method or Function within the /WebAgenda/SQLWin.do API endpoint. This vulnerability allows remote authenticated users to execute arbitrary SQL commands via the sql parameter . The impact includes high severity conse...
CVE-2026-96430 Flowring Agentflow 4.0 - Exposed Dangerous Method or Function
Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter...
EUVD-2026-88659
Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter...
EUVD-2026-88658
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...
CVE-2026-96429 Flowring Agentflow 4.0 - SQL Injection
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...
CVE-2026-96429 Flowring Agentflow 4.0 - SQL Injection
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...
CVE-2026-96429
Flowring Agentflow 4.0 (versions prior to 2025/08/08 ) is vulnerable to SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint. This flaw allows remote attackers to execute arbitrary SQL commands by manipulating the id parameter. The vulnerability has a CRITICAL base severity score ...
CVE-2026-96428 Flowring Agentflow 4.0 - SQL Injection
SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter...