CVE-2026-15803

In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for...

CVE-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

CVE-2026-54183

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

CVE-2026-54183

The CVE-2026-54183 issue affects Apache Airflow where the secrets masker in the UI fails to mask deeply nested values inside lists, tuples, or sets when displayed. The root cause is the recursion-depth limit not applying beyond dictionaries, allowing a deeply nested value stored in an Airflow Var...

CVE-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

ECHO-8274-3DD3-6490

Bulletin has no description...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

undici: undici: Denial of Service due to orphaned response body in retry handler

A flaw was found in undici. A remote attacker, by controlling a server, could exploit a vulnerability in undici's retry handler. When a server sends an incomplete response body and then a non-retryable status, the original response body can become orphaned and never properly closed. This leads to...

CVE-2026-47233 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

CVE-2026-47233

CVE-2026-47233 details an incomplete fix in Admidio where field_delete in modules/inventory.php validates only a CSRF token and does not enforce isAdministratorInventory(), allowing any logged-in user to delete non-system inventory fields. The related ItemField::delete() path lacks an admin check...

EUVD-2026-57211

Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanently delete files from folders where they have only view access. The authorization check at the top of modules/documents-files.php evaluates...

CVE-2026-70466

Technical details about CVE-2026-70466 are not publicly available in the provided documents. Monitor Fortinet advisories for updates on affected FortiWeb versions, impact scope, and remediation.

EUVD-2026-57192

A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via...

CVE-2026-9318

creationtimestamp| type| source ---|---|--- 2026-08-12 04:49:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ggty6bussgrsk 2026-08-12 23:31:35+00:00| seen| https://gist.github.com/alon710/ab9c4f805cc0c3bef62e3b400512696a 2026-08-13 00:01:14+00:00| seen|...

MINI-5XQM-Q4JQ-9FMH

Bulletin has no description...

CVE-2026-68442

creationtimestamp| type| source ---|---|--- 2026-08-12 01:13:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fuza67qd5imt3 2026-08-12 23:16:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117085082278939225...

PT-2026-71138

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The secrets masker in the UI fails to hide values stored under sensitive key names when they are nested inside a list, tuple, or set beyond the recursion-depth limit. This results in Airflow...

CVE-2025-59325

CPSD CryptoPro Secure Disk for BitLocker versions before 7.7.4 fails to encrypt initramfs contents, allowing attackers with physical access to recover secrets and cryptographic keys offline. CVSS 7.5 (HIGH) reflects high confidentiality impact with low complexity. No public exploit code is provid...

CVE-2026-73231

creationtimestamp| type| source ---|---|--- 2026-08-11 21:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mstj3scbak2b 2026-09-02 16:35:55+00:00| published-proof-of-concept| https://github.com/faker-js/faker/security/advisories/GHSA-qxc2-j82w-r537...