CVE-2026-113508

Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL for example the FAB or Keycloak auth managers,...

CVE-2026-113508 Apache Airflow: Logout token revocation fails open; errors silently swallowed

Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL for example the FAB or Keycloak auth managers,...

EUVD-2026-119899

Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL for example the FAB or Keycloak auth managers,...

CVE-2026-113508

The Apache Airflow logout endpoint is vulnerable to a token revocation failure where errors during the revocation process are silently ignored, still reporting a successful logout. This is particularly impactful when using external auth managers (e.g., FAB or Keycloak ) because server-side revoca...

CVE-2026-113508 Apache Airflow: Logout token revocation fails open; errors silently swallowed

Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL for example the FAB or Keycloak auth managers,...

CVE-2026-113508: Apache Software Foundation Apache Airflow: Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during…

Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL for example the FAB or Keycloak auth managers,...

PT-2026-140313

Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL for example the FAB or Keycloak auth managers,...

CVE-2026-91163

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/clientcerts.rs to accept certificates at the TLS layer and defer validation to...

CVE-2026-91163

The Warpgate bastion host (versions prior to 0.29.0 ) contains a vulnerability in its Kubernetes protocol listener. The component warpgate-protocol-kubernetes/src/server/client_certs.rs uses AcceptAnyClientCert to accept certificates at the TLS layer, deferring validation to warpgate-protocol-kub...

CVE-2026-91163 Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/clientcerts.rs to accept certificates at the TLS layer and defer validation to...

CVE-2026-91163 Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/clientcerts.rs to accept certificates at the TLS layer and defer validation to...

PT-2026-136997

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/client certs.rs to accept certificates at the TLS layer and defer validation to...

CVE-2026-91163: warp-tech warpgate: Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/clientcerts.rs to accept certificates at the TLS layer and defer validation to...

CVE-2026-66248 HCL iControl is affected by an Improper Error Handling vulnerability

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks...

CVE-2026-66248: Generation of Error Message Containing Sensitive Information

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks...

EUVD-2026-67011

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the idseccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and...

CVE-2026-81673: Improper Neutralization of Special Elements used in an SQL Command

The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the idvideo and idambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of...

OpenCart Error Log Disclosure Detection

Detected exposed OpenCart error log files that may contain sensitive information including file paths, database errors, PHP warnings, and internal application details. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed OpenCart error log files that may contain sensitive information...

Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/exposestacktraces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue...

CVE-2025-58146 XAPI UTF-8 string handling

There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the notification using the unsanitised input. This causes the database's event thread to terminate and cease further processing. 2. XAPI's UTF-8 encoder implements v3.0 of the Unicode spec, but...