Lucene search
+L

77290 matches found

EUVD
EUVD
added 5 days ago7 views

EUVD-2026-57349

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization...

4.3CVSS5.3AI score0.00252EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 5 days ago5 views

CVE-2026-18144

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization...

4.3CVSS5.3AI score0.00252EPSS
SaveExploits0References2Affected Software1
NVD
NVD
added 5 days ago10 views

CVE-2026-68968

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

7.5CVSS0.00416EPSS
SaveExploits0References3
NVD
NVD
added 5 days ago10 views

CVE-2026-68971

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

6.5CVSS0.00328EPSS
SaveExploits0References3
NVD
NVD
added 5 days ago9 views

CVE-2026-65938

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

4.3CVSS0.00161EPSS
SaveExploits0References3
CVE
CVE
added 5 days ago35 views

CVE-2026-69107

CVE-2026-69107 affects JFrog Artifactory. An unauthenticated user may access restricted artifacts under specific conditions. The CVSS v3.1 base score is 5.9 (MEDIUM), with Network attack vector, high attack complexity, no privileges required, and no user interaction. Impact is confidentiality los...

5.9CVSS5.2AI score0.00275EPSS
SaveExploits0References2
OSV
OSV
added 5 days ago6 views

CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

7.5CVSS5.5AI score
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 5 days ago4 views

CVE-2026-68968

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

5.4AI score0.00416EPSS
SaveExploits0References3
EUVD
EUVD
added 5 days ago11 views

EUVD-2026-57271

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

5.4AI score0.00416EPSS
SaveExploits0References2
CVE
CVE
added 5 days ago33 views

CVE-2026-68968

The CVE affects Apache Airflow (Backfill API). A mismatch between dependency parsing and endpoint validation for backfill_id (int() vs NonNegativeInt) allows an authenticated user with edit rights on one Dag to read, pause, and cancel backfills for other Dags. FastAPI resolves dependencies before...

7.5CVSS5.4AI score0.00416EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
added 5 days ago32 views

CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

0.00416EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 5 days ago5 views

CVE-2026-68971

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

5.4AI score0.00328EPSS
SaveExploits0References3
Cvelist
Cvelist
added 5 days ago35 views

CVE-2026-68971 Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

0.00328EPSS
SaveExploits0References2
OSV
OSV
added 5 days ago11 views

CVE-2026-68971 Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

6.5CVSS5.4AI score
SaveExploits0References6
EUVD
EUVD
added 5 days ago8 views

EUVD-2026-57268

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

5.4AI score0.00328EPSS
SaveExploits0References2
CVE
CVE
added 5 days ago28 views

CVE-2026-68971

CVE-2026-68971 (Apache Airflow) describes a cross-team authorization bypass in the asset materialization endpoint (POST /api/v2/assets/{asset_id}/materialize) and the XCom result check on wait_dag_run_until_finished. A team-aware auth manager failed to consult the team-scoped permission, treating...

6.5CVSS5.4AI score0.00328EPSS
SaveExploits0References3Affected Software1
EUVD
EUVD
added 5 days ago8 views

EUVD-2026-57263

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

4.3CVSS5.2AI score0.00161EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 5 days ago5 views

CVE-2026-65938

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

4.3CVSS5.2AI score0.00161EPSS
SaveExploits0References4
CVE
CVE
added 5 days ago30 views

CVE-2026-65938

WhatsUp Gold is affected in versions released before 2026.0.2 by an improper authorization vulnerability in the Scheduled Reports API that lets any authenticated user invoke restricted actions. The issue is documented across CVE-2026-65938 entries (NVD, CVE List) and is addressed in the 26.0.2 re...

4.3CVSS5.2AI score0.00161EPSS
SaveExploits0References3
NVD
NVD
added 5 days ago7 views

CVE-2026-73405

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...

5.3CVSS0.00285EPSS
SaveExploits0References1
Rows per page
Query Builder