Vulnerability-Disclosure-Policy

Vulnerability Disclosure Policy We believe that vulnerability disclosure is a two-way street. Vendors, as well as researchers, must participate in co-ordinated vulnerability disclosure. When Enable Security discovers vulnerabilities through its own research, it will notify vendors of these...

gnome-remote-desktop: gnome-remote-desktop: unauthenticated RDP sockets lack a handshake deadline

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global...

Moderate: Red Hat Security Advisory: gnome-remote-desktop security update

An update for gnome-remote-desktop is now available for Red Hat Enterprise Linux 10.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Moderate: Red Hat Security Advisory: gnome-remote-desktop security update

An update for gnome-remote-desktop is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 10 : gnome-remote-desktop (RHSA-2026:98622)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:98622 advisory. GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment. Security Fixes: gnome-remote-desktop:...

CVE-2026-126087

Untrusted search path in the cross-user process launcher in Open Job Description OpenJD Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user with permission to submit jobs to a queue to execute arbitrary...

CVE-2026-126087

Untrusted search path in the cross-user process launcher in Open Job Description OpenJD Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user with permission to submit jobs to a queue to execute arbitrary...

CVE-2026-126087

The AWS Deadline Cloud worker agent (versions before 0.33.0 ) is vulnerable to an untrusted search path issue in the Open Job Description (OpenJD) Sessions for Python (before 0.11.0) cross-user process launcher on Linux. An authenticated remote user with permission to submit jobs can execute arbi...

PT-2026-144412

Name of the Vulnerable Software and Affected Versions Open Job Description OpenJD Sessions for Python versions prior to 0.11.0 AWS Deadline Cloud worker agent versions prior to 0.33.0 Description An untrusted search path in the cross-user process launcher on Linux allows an authenticated remote...

CVE-2026-82337

Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes wi...

CVE-2026-82337

Apache Airflow is vulnerable to a security issue where deadline alert fields are rebuilt through generic deserialization . This process imports and instantiates classes named in the serialized Dag within the scheduler and API server processes. A Dag author can exploit this to construct classes fr...

CVE-2026-82337

Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes wi...

CVE-2026-82337 Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization

Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes wi...

EUVD-2026-119902

Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes wi...

CVE-2026-111395 Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks

Apache Airflow did not reject reserved serialization keys inside a Dag run's conf. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a conf that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects...

PT-2026-140318

Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes wi...

CVE-2026-82337: Apache Software Foundation Apache Airflow: Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class…

Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes wi...

CVE-2026-62162

The Hydra layer-two scalability solution for Cardano is vulnerable in versions prior to 2.1.0 due to a missing invariant in the Claim branch of hydra-plutus/validators/deposit.ak. The validator fails to require spending the Head state-token UTxO within the same transaction and lacks output constr...

PT-2026-108687

Summary cacheSet only derives its exp cache deadline inside hasIat src/verifier.js:127-140. JWT iat is optional. For a valid token with exp but no iat, cacheSet substitutes clockTimestamp + clockTolerance + cacheTTL src/verifier.js:142-146. Later, the cache path returns the saved payload before...

CVE-2026-96541 Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global...