CVE-2026-47430

Summary The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation CDVWKInAppBrowser.m:560–574. Any web content loaded inside the InAppBrowser can fire any pending Cordova callback...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (=2021.0.1.0), com.bpfaas:bps-config-server-novault-spring-cloud-starter (=3.2.2) +9 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=3.1.0 <=3.1.10)

org.springframework.cloud:spring-cloud-config-server MAVEN version =3.1.0, =2.1.4, =0.1, =6.5.0, =6.5.0, =2.0.1, =3.1.0, =2.1.0, =2.1.1 Source cves: CVE-2026-41002 Source advisory: OSV:GHSA-86WQ-234Q-R6WG...

GHSA-PM44-X5X7-24C4 Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access

Vulnerability Overview An authorization bypass vulnerability exists in Apache Airflow that allows authenticated users to access task execution logs without the required permissions. The Flaw The vulnerability affects environments using custom roles or granular permission settings. Normally, Airfl...

CVE-2025-55715 WordPress Otter - Gutenberg Block Plugin <= 3.1.0 - Sensitive Data Exposure Vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Themeisle Otter - Gutenberg Block otter-blocks allows Retrieve Embedded Sensitive Data.This issue affects Otter - Gutenberg Block: from n/a through = 3.1.0...

PT-2024-23239 · Apache · Apache Dolphinscheduler

Name of the Vulnerable Software and Affected Versions: Apache DolphinScheduler versions 3.1.0 through 3.2.1 Description: A file read and write vulnerability exists in Apache DolphinScheduler, allowing authenticated users to illegally access additional resource files. Recommendations: For Apache...

cc.uncarbon.framework:helio-starter-dubbo (>=1.7.0 <=1.11.1), cn.katool.security:katool-security-core (=1.1.1.RELEASE) +27 more potentially affected by CVE-2023-23638 via org.apache.dubbo:dubbo (>=3.1.0 <=3.1.4)

org.apache.dubbo:dubbo MAVEN version =3.1.0, =1.7.0, =1.8.0, =0.0.1.RC1, =0.0.1.RC1, =0.0.1.RC2 and more Source cves: CVE-2023-23638 Source advisory: OSV:GHSA-933G-V89R-X8PF...

GHSA-8GH8-HQWG-XF34 Starcounter-Jack JSON-Patch Prototype Pollution vulnerability

A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes 'prototype pollution'. The attack can be initiated remotely...

OESA-2022-1689 fish security update

fish is a fully-equipped command line shell like bash or zsh that is smart and user-friendly. fish supports powerful features like syntax highlighting, autosuggestions, and tab completions that just work, with nothing to learn or configure. Security Fixes: fish is a command line shell. fish versi...

PT-2021-23791 · Datalust · Datalust Seq.App.Emailplus

Name of the Vulnerable Software and Affected Versions: Datalust Seq.App.EmailPlus aka seq-app-htmlemail versions 3.1.0-dev-00148 through 3.1.0-dev-00176 Description: The issue arises when Datalust Seq.App.EmailPlus uses cleartext SMTP on port 25 in cases where encryption on port 465 was intended...

ariadne-jwt (>=0.1.0 <=0.1.3), balder (=0.1.24) +39 more potentially affected by CVE-2021-35042 via django (>=3.1.0 <=3.1.12)

django PYPI version =3.1.0, =0.1.0, =0.0.32, =0.0.38, =20.13.1, =0.1.0, =0.10.0, =0.9.0, =0.4.0, =0.12.0, =0.15.3 and more Source cves: CVE-2021-35042 Source advisory: OSV:PYSEC-2021-109...

Octopus Deploy Information Disclosure Vulnerability (CNVD-2020-59032)

Octopus Deploy is an automated deployment and release management tool. An information disclosure vulnerability exists in Octopus Deploy versions 3.1.0 through 2020.4.0. The vulnerability stems from certain scripts that display sensitive information to users in task logs. An attacker can exploit...