CVE-2026-123753

Server-Side Request Forgery SSRF vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and...

CVE-2026-123766

Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injectio...

CVE-2026-123770

Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not...

CVE-2026-120761

Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:impor...

CVE-2026-120832

Server-Side Request Forgery SSRF vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import locations and in xsd:import and...

CVE-2026-118196

OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: through 1.22.0. Users are recommended to upgrade to version 1.22.1, which fixes the issue...

CVE-2026-124590

A security vulnerability has been detected in zhangbw409 librarymanagersystem f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/com/zbw/controller/UserController.java. The manipulation of t...

CVE-2026-82436

Description "DefaultStateSerializer", used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned. A par...

CVE-2026-82440

Description Nimbus instantiates the class named by a topology's "topology.scheduler.strategy" when scheduling it. The allowlist intended to constrain that choice, "nimbus.scheduler.strategy.class.whitelist", was treated as "allow any class" when unset, and it had no entry in the shipped...

CVE-2026-124589

A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0. This affects the function loadstatedictintomodel of the file omgllava/xtuner/utils/handlemoeloadandsave.py of the component MoE Shard Checkpoint Loader. Executing a manipulation of the argument weightm...

CVE-2026-40913

Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the "ImportError.canread" permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs a...

CVE-2026-50204

Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the "Log.extra" column because the secrets masker matched only on configured sensitive key names. An authenticated low-privilege user with read access to the event-log / audit API — with no prior access to the...

CVE-2026-68982

Apache Airflow's CeleryExecutor ran callback workloads "ExecuteCallback", used for deadline-alert callbacks without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker,...

CVE-2026-76185

Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped "" delimiters, so different team, secret id pairs could collide. In multi-team deployments a Dag author could read another team's Variable or Connection value by crafting a colliding secret id...

CVE-2026-86829

Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for...

CVE-2026-82337

Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes wi...

CVE-2026-86468

Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in cleartext, for example a trailing "--description" on Variable commands, "--conn-extra", and the inline "--password" of "airflow...

CVE-2026-96285

Apache Airflow 3.2.0 before 3.4.0 deserializes stored resume data nextkwargs before checking that it is a dict in the execution API nextkwargs converter since 3.2.0, and in the scheduler/trigger paths since 3.3.0, so constructors of allowed classes are invoked during deserialization. Fixed in 3.4...

CVE-2026-113508

Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL for example the FAB or Keycloak auth managers,...

CVE-2026-124588

A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolvecomponentcls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The atta...

CVE-2026-101031

The "exampledagdecorator" example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's "ipaddress" module and then placed it into a shell command. "ipaddress" accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded...

CVE-2026-92683

Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operato...

CVE-2026-124587

A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the...

CVE-2026-113504

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

CVE-2026-107474

The Apache Airflow connections API did not mask the apprise provider's "config" connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only. Users are...

CVE-2026-111395

Apache Airflow did not reject reserved serialization keys inside a Dag run's "conf". A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a "conf" that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects...

CVE-2026-111421

Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the...

CVE-2026-124586

A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. This manipulation of the argument decimalPosition causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has...

CVE-2026-111452

Apache Airflow's secrets masker matched sensitive key names only in their snakecase form, so values stored under camelCase keys such as "privateKey", "connectionString", "webhookUrl" or "accessKey" — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered...

CVE-2026-111453

Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the "dagid" query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress...

CVE-2026-111454

Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to...

CVE-2026-111455

Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with "commitonsuccess", wrote the tested connection under that ID. A user allowed to create but not edit...

CVE-2026-123870

The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval. When the GITHUBWEBHOOKSECRET configuration value is unset or empty the code default is None, the HMAC signature check is skipped entirely, allowing an unauthenticated network client...

CVE-2026-116337

Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt Network module...

CVE-2026-124584

A vulnerability has been found in wummel patool 4.1.0. This vulnerability affects the function extractgzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads to symlink following. Local access is required to approach this attack. The researcher claim...

CVE-2026-92606

Time-of-check time-of-use TOCTOU race condition vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer allows Leveraging Time-of-Check and Time-of-Use TOCTOU Race Conditions. This issue affects Pardus MyComputer: from 0.8.0 before 0.8.1...

CVE-2026-124582

A vulnerability was identified in WebTorrent up to 2.8.5/3.0.21. Affected by this vulnerability is the function getFileModtimes of the file torrent.js of the component File Path Handler. Such manipulation of the argument file.path leads to path traversal. The attack may be performed from remote...

MSC-2026-13390

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-13387

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Code injection testing – an attacker checks if...

MSC-2026-13389

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-13388

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-13391

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

CVE-2026-124579

A vulnerability was determined in aaPanel BillionMail up to 4.9. Affected by this issue is some unknown functionality of the file core/api/relay/v1/relay.go of the component Relay Configuration API. Executing a manipulation of the argument heloname can lead to injection. The attack may be perform...

CVE-2026-120386

Effekseer improperly validates "effect" files. When a crafted effect file is loaded to the affected runtime, the host process may be forced to crash...

MSC-2026-13386

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

CVE-2026-124576

A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument ordernumber results in enforcement of behavioral...

CVE-2026-124575

A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin...

CVE-2026-124574

A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to...

CVE-2026-124573

A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been made publ...

CVE-2026-124572

A vulnerability has been found in DataLinkDC dinky up to 1.2.5. Affected by this issue is the function CatalogueController.upload of the file dinky-admin/src/main/java/org/dinky/controller/CatalogueController.java of the component Catalogue Upload API. The manipulation leads to path traversal. Th...