Lucene search
+L

30773 matches found

OSV
OSV
added 2026/07/07 2:34 p.m.8 views

PYSEC-2026-1392 Frappe vulnerable to information disclosure leading to account takeover

Impact Making crafted requests could lead to information disclosure that could further lead to account takeover. Workarounds There's no workaround to fix this without upgrading. Credits Thanks to Thanh of Calif.io for reporting the issue...

9.3CVSS5.9AI score0.00398EPSS
SaveExploits0References5
OSV
OSV
added 2026/07/07 2:34 p.m.6 views

PYSEC-2026-1134 Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data

Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored...

6.5CVSS5.8AI score0.01201EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/07 2:34 p.m.6 views

PYSEC-2026-1269 Prevent XSS from Confidant API call

Impact What kind of vulnerability is it? Who is impacted? Potential XSS from API calls below: GET /v1/credentials GET /v1/credentials/ GET /v1/archive/credentials/ GET /v1/archive/credentials POST /v1/credentials PUT /v1/credentials/ PUT /v1/credentials// GET /v1/services GET /v1/services/ GET...

5.1CVSS5.9AI score0.00347EPSS
SaveExploits0References9
Snyk
Snyk
added 2026/07/07 12:41 p.m.8 views

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration via the dep.source and dep.target fields in the scheduling graph endpoint. An attacker can obtain identifiers of resources they are not authorized to access by inspecting dependency information exposed...

6.9CVSS6AI score0.0044EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/07 11:45 a.m.6 views

PYSEC-2026-1710 GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace

Summary and impact GoogleOAuthenticator.hosteddomain is used to restrict what Google accounts can be authorized to access a JupyterHub. The restriction is intended to ensure Google accounts are part of one or more Google organizations/workspaces verified to control specified domains. The...

7.5CVSS7AI score0.00589EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/07 11:45 a.m.6 views

PYSEC-2026-1184 Apache Superset SQL injection vulnerability

A wherein JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 2.1.3 or 3.0.2, which...

6.5CVSS7.2AI score0.01178EPSS
SaveExploits0References9
OSV
OSV
added 2026/07/07 11:45 a.m.7 views

PYSEC-2026-1249 Out of memory error when submitting the dataset form with a specially-crafted field

Impact When submitting a POST request to the /dataset/new endpoint including either the auth cookie or the Authorization header with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error the user needs to have permissions to create o...

4.5CVSS6.5AI score0.00576EPSS
SaveExploits0References6
PyPA
PyPA
added 2026/07/07 11:45 a.m.8 views

Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages

ImpactThe Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being...

6.1CVSS6.4AI score0.00609EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/07 11:45 a.m.12 views

Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability

Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow.Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backendNote: thevulnerability is about the information exposed in the logs not abo...

7.5CVSS7AI score0.01203EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/07 11:45 a.m.10 views

Fides Information Disclosure Vulnerability in Config API Endpoint

ImpactThe Fides webserver API allows users to retrieve its configuration using the GET api/v1/config endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the...

6.5CVSS6.5AI score0.00722EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/07 11:45 a.m.12 views

Fides Webserver Vulnerable to SVG Bomb File Uploads

ImpactThe Fides webserver is vulnerable to a type of Denial of Service DoS attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs similar to a billion laughs attack, causing resource exhaustion in Admin UI browser tabs and creating a persistent denial ...

4.9CVSS5.9AI score0.00698EPSS
SaveExploits0References7Affected Software1
OSV
OSV
added 2026/07/07 9:17 a.m.8 views

CVE-2026-48891 Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target

A bug in Apache Airflow's /ui/dependencies scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the dep.source and dep.target fields of trigger / sensor dependency entries. An authenticated UI user with...

4.3CVSS6AI score
SaveExploits0References6
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/07 8:6 a.m.7 views

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server affected by a remote code execution vulnerability

Summary The security issue described in CVE-2026-11536 has been identified in the WebSphere Application Server included as part of IBM Tivoli Composite Application Manager for Application Diagnostics. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

8.5CVSS5.9AI score0.00337EPSS
SaveExploits0Affected Software1
F5 Networks
F5 Networks
added 2026/07/07 7:35 a.m.9 views

K000162117: Linux kernel vulnerability CVE-2023-53552

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: drm/i915: mark requests for GuC virtual engines to avoid use-after-free References to i915requests may be trapped by userspace inside a syncfile or dmabuf dma-resv and held indefinitely across...

7.8CVSS6.1AI score0.00155EPSS
SaveExploits0
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/07 6:11 a.m.10 views

Security Bulletin: Security vulnerabilities have been found in IBM Application Gateway

Summary Security vulnerabilities have been addressed in IBM Application Gateway Vulnerability Details CVEID:CVE-2026-40355 DESCRIPTION: In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls gssacceptseccontext on a system with a NegoEx mechanism...

7.5CVSS6AI score0.00611EPSS
SaveExploits2Affected Software1
Tenable Nessus
Tenable Nessus
added 2026/07/07 12:0 a.m.14 views

Linux Distros Unpatched Vulnerability : CVE-2026-14761

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is the function rstrndup/rstrappend of the file libr/util/str....

5.5CVSS3.8AI score0.00162EPSS
SaveExploits1References2
Tenable Nessus
Tenable Nessus
added 2026/07/07 12:0 a.m.12 views

Linux Distros Unpatched Vulnerability : CVE-2026-14758

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmdanalopcode of the file libr/core/cmdanal.inc.c of th...

5.5CVSS4.5AI score0.00162EPSS
SaveExploits1References2
NOZOMI
NOZOMI
added 2026/07/07 12:0 a.m.11 views

Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0

Summary An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. Impact An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for...

7.1CVSS5.9AI score0.00167EPSS
SaveExploits0Affected Software2
Tenable Nessus
Tenable Nessus
added 2026/07/07 12:0 a.m.13 views

Linux Distros Unpatched Vulnerability : CVE-2026-14787

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in radareorg radare2 up to 6.1.6. Affected is the function cmdprint in the library libr/core/cmdprint.inc of the component pb Pri...

7.8CVSS4.4AI score0.00168EPSS
SaveExploits1References2
Tenable Nessus
Tenable Nessus
added 2026/07/07 12:0 a.m.13 views

Fedora 43 : hplip (2026-7d23917d90)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7d23917d90 advisory. fix CVE-2026-14544 - incomplete fix after CVE-2026-8631 fedora2496773, fedora2496772 Tenable has extracted the preceding description block directly...

9.8CVSS6AI score0.01747EPSS
SaveExploits0References3
Rows per page
Query Builder