95441 matches found
PYSEC-2026-1174 Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability
An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0...
Apache Superset has improper default REST API permission for Gamma users
An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections...
Apache Superset Deserialization of Untrusted Data vulnerability
If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by t...
PYSEC-2026-1175 Apache Superset Deserialization of Untrusted Data vulnerability
If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by t...
PYSEC-2026-1171 Apache Superset vulnerable to Exposure of Sensitive Information
An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1...
Apache Superset vulnerable to Exposure of Sensitive Information
An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API.This issue affects Apache Superset version 1.3.0 up to 2.0.1...
PYSEC-2026-1152 Apache Airflow ODBC Provider Argument Injection vulnerability
Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache Software Foundation Apache Airflow ODBC Provider. In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of...
Apache Airflow ODBC Provider Argument Injection vulnerability
Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of...
PYSEC-2026-1149 Apache Airflow JDBC Provider Improper Input Validation vulnerability
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s Connection URL parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission...
Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability
Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.Thisvulnerability is considered low since it requires DAG code to use getsqlalchemyconnection and someone with access to connection resources...
Flask-AppBuilder Has No Rate Limiting on Login AUTH DB
ImpactLack of rate limiting will allow an attacker to brute-force user credentials. PatchesAbility to enable rate limiting on Flask-AppBuilder = 4.3.0. Use AUTHRATELIMITED = True and RATELIMITENABLED = True set the limit itself by using AUTHRATELIMIT. Will apply only to database authentication...
PYSEC-2026-1380 Flask-AppBuilder Has No Rate Limiting on Login AUTH DB
Impact Lack of rate limiting will allow an attacker to brute-force user credentials. Patches Ability to enable rate limiting on Flask-AppBuilder = 4.3.0. Use AUTHRATELIMITED = True and RATELIMITENABLED = True set the limit itself by using AUTHRATELIMIT. Will apply only to database authentication...
Apache Airflow Spark Provider vulnerable to improper input validation
Apache Software Foundation Apache Airflow Spark Provider before 4.0.1 is vulnerable to improper input validation because the host and schema of JDBC Hook can contain / and ? which is used to denote the end of the field...
PYSEC-2026-1140 Apache Airflow Spark Provider vulnerable to improper input validation
Apache Software Foundation Apache Airflow Spark Provider before 4.0.1 is vulnerable to improper input validation because the host and schema of JDBC Hook can contain / and ? which is used to denote the end of the field...
PYSEC-2026-1771 pgAdmin 4 vulnerable to directory traversal
pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database...
Apache Superset is vulnerable to Cross-Site Scripting (XSS)
Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0...
invenio-accounts (>=1.0.0a1, <=1.0.0a5), python-database-rest-logging (>=1.0.2, <=1.0.5) potentially affected by CVE-2021-23385 via flask-security (1.7.5)
flask-security PYPI version 1.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on flask-security and may be impacted: - invenio-accounts =1.0.0a1, =1.0.2, =1.0.5 Source cves: CVE-2021-23385 Source advisory: OSV:PYSEC-2026-809...
vuln-poc-research-skill
Vuln-Poc-Research Skill Chinese vuln-poc-research is a...
Vulnerabilities found in UniFi products from Ubiquiti Networks
Ubiquiti Networks has identified vulnerabilities in various UniFi products, including UniFi Connect Application, UniFi Talk Application, UniFi Access Application, UniFi OS, UniFi Network Application, and UniFi Protect Application. These vulnerabilities involve command injection, SQL injection,...