CVE-2026-42018 Anonymous user token generation exposure in JFrog Artifactory

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources...

CVE-2026-42018

JFrog Artifactory is affected by CVE-2026-42018, where an unauthenticated caller could receive an internal anonymous-user token when anonymous access is disabled, potentially exposing sensitive resources. This aligns with the provided CVSSv3.1 base score of 7.5 (HIGH) with network attack vector a...

CVE-2026-17110 IBM i is Affected By Multiple Vulnerabilities in SQL

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privilege management...

CVE-2026-17266

IBM i (7.6, 7.5, 7.4, 7.3) is affected by CVE-2026-17266 in Navigator for i, a path traversal flaw that could allow a remote authenticated attacker to obtain sensitive information by improper limitation of a pathname to a restricted directory. CVSS base 6.5 (Network, Low attacker effort, Privileg...

CVE-2026-73296

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, createmobiledatacollectionserver and createmobileactionserver in ufo/client/mcp/httpservers/mobilemcpserver.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without...

CVE-2026-69107

An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions...

CVE-2026-59244 Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an isinstancestr guard — so a secret stored as a JSON Variable and referenced in a template via var.json was displayed in cleartext to any user with...

EUVD-2026-57316

Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an isinstancestr guard — so a secret stored as a JSON Variable and referenced in a template via var.json was displayed in cleartext to any user with...

CVE-2026-54183

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

CVE-2026-65017 Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

EUVD-2026-57272

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-68969

Summary: CVE-2026-68969 affects Apache Airflow where bulk endpoints for variables and connections log secrets in audit logs in cleartext due to improper masking. The endpoints affected are PATCH /api/v2/variables and PATCH /api/v2/connections; bulk requests nest entities two levels deep, bypassin...

EUVD-2026-57270

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...

CVE-2026-68969

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...

CVE-2026-68970 Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level...

EUVD-2026-57269

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level...

CVE-2026-68971

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

CVE-2026-73264

Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated baseurl for the openaicompatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/id/connection, causing...

CVE-2026-70547 Potential unauthorized metadata exposure in JFrog Artifactory

An authenticated user without repository read permission may access package metadata under specific conditions...

CVE-2026-70547

Technical details about CVE-2026-70547 are not publicly available in the provided documents. Monitor for updates from official advisories before drawing conclusions on impact, affected products, or remediation.