CVE-2026-68970

Summary: CVE-2026-68970 affects Apache Airflow's Task SDK, where a top-level JSON list stored in a Variable is not masked in task logs or the Rendered Templates UI. Masking applies only to strings and dicts, so list-shaped values are exposed to any authenticated user reading logs or templates. Th...

CVE-2026-68970 Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level...

EUVD-2026-57269

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level...

CVE-2026-65937 WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content...

CVE-2026-65937

CVE-2026-65937 affects WhatsUp Gold versions released before 2026.0.2. An authenticated attacker can bypass frontend controls and inject persistent script content via stored XSS vulnerabilities across the web UI. The CVSS3.1 score is 8.0 (HIGH) with adjacent attack vector, no privileges required,...

PT-2026-71138

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The secrets masker in the UI fails to hide values stored under sensitive key names when they are nested inside a list, tuple, or set beyond the recursion-depth limit. This results in Airflow...

PT-2026-71144

Name of the Vulnerable Software and Affected Versions Semaphore UI versions prior to 2.18.19 Semaphore UI versions 2.19.0-alpha3 through 2.19.5-beta5 Description ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use the 'POST /api/project/id/roles' endpoint to create a...

PT-2026-71145

Name of the Vulnerable Software and Affected Versions Semaphore UI versions prior to 2.18.17 Semaphore UI versions prior to 2.19.5-beta2 Description Improper handling of the git url variable allows a project Manager or Owner to execute arbitrary OS commands within the server process. This occurs...

PT-2026-71132

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The Task SDK fails to mask the contents of a Variable when its JSON value is a list. This occurs because masking is only applied to deserialized values that are strings or dictionaries, leavin...

PT-2026-71143

Name of the Vulnerable Software and Affected Versions Semaphore UI versions prior to 2.18.21 Description The application lacks Cross-Site Request Forgery CSRF protection—a type of attack that tricks a victim into submitting a malicious request—and does not require current-password confirmation at...

PT-2026-71154

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2026-65655

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

EUVD-2026-56924

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655

Temporal UI Server may set OAuth credential cookies without Secure when TLS terminates at a reverse proxy and forwards callbacks to the UI server over HTTP. This can allow an attacker-controlled scenario to access access-token and possibly refresh-token cookies if the attacker can steer UI hostna...

CVE-2026-40375

creationtimestamp| type| source ---|---|--- 2026-08-11 19:01:00+00:00| seen| https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review 2026-08-12 01:00:56+00:00| seen| https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review 2026-08-12 12:45:43+00:00| seen|...

CVE-2026-67179

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits via DNS rebinding, can reach POST /api/runAction on the Dev UI server default port 4000 and execute any registered Genkit action and read the result. Fixed on 2026-06-...

CVE-2026-67179 Genkit improper host header validation

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits via DNS rebinding, can reach POST /api/runAction on the Dev UI server default port 4000 and execute any registered Genkit action and read the result. Fixed on 2026-06-...