11611 matches found
CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id
Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...
CVE-2026-68970 Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI
Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level...
CVE-2026-65937
In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content...
CVE-2026-73285
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...
CVE-2026-66379
An authenticated user may view private Puppet module metadata without repository read access...
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
Summary An authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL string syntax but does not escape % and , which remain active LIKE...
EUVD-2026-57256
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions...
CVE-2026-66384 Authenticated users may write data outside the intended Docker cache path
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions...
CVE-2026-66384
JFrog Artifactory is affected by an improper limitation of a pathname to a restricted directory , allowing an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. The vulnerability carries a CVSS score of 5.3 (MEDIUM) with high integ...
CVE-2026-66384 Authenticated users may write data outside the intended Docker cache path
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions...
CVE-2026-68758 Authenticated users may access restricted Artifactory support information
A low-privileged authenticated user may access restricted support information under specific conditions...
CVE-2026-68758
A low-privileged authenticated user may access restricted support information under specific conditions...
CVE-2026-66375
CVE-2026-66375 concerns JFrog Artifactory metadata : a low-privilege authenticated user can permanently remove protected internal metadata across repositories under specific conditions. The issue is described across multiple sources (NVD, CVE Registry) with related CVSS 3.1 data: AV:N/AC:L/PR:L/U...
CVE-2026-66382
Technical details for CVE-2026-66382 are not publicly available in the provided documents. Monitor official advisories for updates.
CVE-2026-66382 Authenticated users may write files outside the intended Artifactory work directory
An authenticated user may write files outside the intended Artifactory work directory under specific conditions...
EUVD-2026-57251
An authenticated user may write files outside the intended Artifactory work directory under specific conditions...
CVE-2026-66379 Authenticated users may view private Puppet module metadata
An authenticated user may view private Puppet module metadata without repository read access...
CVE-2026-66379
CVE-2026-66379 describes an issue where an authenticated user can view private Puppet module metadata without repository read access. The provided documents do not specify affected product/version or the exact root cause. The NVD entry lists CVSS v3.1 base score 4.3 (Medium) with confidentiality ...