Browse All CVEs
39,681 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-113421 |
high | 7.3 | 0.0011 | 2026-11-03 | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a | |
CVE-2026-115231 |
high | 8.5 | 0.0011 | 2026-11-03 | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mod | |
CVE-2026-103327 |
medium | 5.3 | 0.0011 | 2026-11-03 | The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity | |
CVE-2026-4052 |
critical | 9.8 | 0.0036 | 2026-11-03 | This issue only impacts deployments where WSO2 Identity Server is configured as a Resident | |
CVE-2026-13594 |
critical | 9.1 | 0.0114 | 2026-11-03 | Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are | |
CVE-2026-16900 |
high | 7.5 | 0.0154 | 2026-11-03 | Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable | |
CVE-2026-103653 |
medium | 6.7 | 0.0029 | 2026-11-03 | An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::cr | |
CVE-2026-74846 |
— | — | 0.0027 | 2026-11-03 | Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on | |
CVE-2026-120988 |
medium | 6.1 | 0.0015 | 2026-11-03 | billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improp | |
CVE-2026-45192 |
medium | 6.5 | 0.0043 | 2026-11-03 | A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow | |
CVE-2026-40861 |
medium | 6.5 | 0.0069 | 2026-11-03 | A Dag author could either (a) create a symlink under their task's log directory pointing t | |
CVE-2026-40961 |
high | 7.2 | 0.0065 | 2026-11-03 | A bug in the login redirect route in Apache Airflow allowed authenticated users to craft U | |
CVE-2026-40963 |
low | 3.1 | 0.0048 | 2026-11-03 | The structure_data endpoint in the Airflow UI returned external dependency graph nodes for | |
CVE-2026-41014 |
medium | 4.3 | 0.0037 | 2026-11-03 | The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access cont | |
CVE-2026-41017 |
medium | 5.9 | 0.0035 | 2026-11-03 | Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, | |
CVE-2026-41084 |
high | 7.5 | 0.0048 | 2026-11-03 | A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dag | |
CVE-2026-42252 |
critical | 9.1 | 0.0038 | 2026-11-03 | Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Paramete | |
CVE-2026-42358 |
medium | 6.5 | 0.0034 | 2026-11-03 | A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered | |
CVE-2026-42359 |
high | 8.8 | 0.0057 | 2026-11-03 | A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an | |
CVE-2026-42360 |
medium | 6.5 | 0.0035 | 2026-11-03 | A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key mas | |
CVE-2026-45360 |
high | 7.3 | 0.0068 | 2026-11-03 | Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.des | |
CVE-2026-45426 |
low | 3.1 | 0.0036 | 2026-11-03 | Exploitation requires the attacker to already be an authenticated Airflow worker holding a | |
CVE-2026-46764 |
medium | 4.3 | 0.0037 | 2026-11-03 | The Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` in Apache Airflow fet | |
CVE-2026-48726 |
medium | 6.5 | 0.0038 | 2026-11-03 | A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens v | |
CVE-2026-49267 |
medium | 5.9 | 0.0019 | 2026-11-03 | Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers establishe | |
CVE-2026-75157 |
high | 7.5 | 0.0044 | 2026-11-03 | 1 PoC | Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permis |
CVE-2026-75158 |
medium | 4.3 | 0.0064 | 2026-11-03 | Apache Airflow's `/assets/events` API returned asset events for every Dag in the deploymen | |
CVE-2026-82355 |
medium | 4.2 | 0.0073 | 2026-11-03 | When a request to the Airflow core API carries both a session cookie and an explicit `Auth | |
CVE-2026-86473 |
critical | 9.1 | 0.0075 | 2026-11-03 | Apache Airflow: the Core API logout endpoint revokes only a session token presented as the | |
CVE-2026-120987 |
— | — | 0.0011 | 2026-11-03 | Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual | |
CVE-2026-108817 |
low | 2.0 | 0.0107 | 2026-11-03 | A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the | |
CVE-2026-84233 |
high | 7.0 | 0.0019 | 2026-11-03 | A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename | |
CVE-2026-84838 |
high | 7.8 | 0.0111 | 2026-11-03 | A flaw was found in rpmuncompress. This command injection vulnerability allows a local att | |
CVE-2026-30911 |
high | 8.1 | 0.0056 | 2026-11-03 | Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Exe | |
CVE-2026-28779 |
high | 7.5 | 0.0070 | 2026-11-03 | Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to pa | |
CVE-2026-49298 |
high | 8.8 | 0.0049 | 2026-11-03 | A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to auth | |
CVE-2026-26929 |
medium | 6.5 | 0.0042 | 2026-11-03 | Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply | |
CVE-2026-28563 |
medium | 4.3 | 0.0046 | 2026-11-03 | Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG | |
CVE-2026-24098 |
medium | 6.5 | 0.0078 | 2026-11-03 | Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI user | |
CVE-2025-68675 |
high | 7.5 | 0.0188 | 2026-11-03 | In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a | |
CVE-2026-22922 |
medium | 6.5 | 0.0045 | 2026-11-03 | Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow a | |
CVE-2025-66388 |
medium | 6.5 | 0.0048 | 2026-11-03 | A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in | |
CVE-2025-68438 |
high | 7.5 | 0.0062 | 2026-11-03 | In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [co | |
CVE-2025-66236 |
high | 7.5 | 0.0044 | 2026-11-03 | Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deploymen | |
CVE-2025-62402 |
medium | 5.4 | 0.0052 | 2026-11-03 | API users via `/api/v2/dagReports` could perform Dag code execution in the context of the | |
CVE-2025-65995 |
medium | 6.5 | 0.0089 | 2026-11-03 | When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the fu | |
CVE-2025-54941 |
medium | 4.6 | 0.0049 | 2026-11-03 | An example dag `example_dag_decorator` had non-validated parameter that allowed the UI use | |
CVE-2025-57735 |
critical | 9.1 | 0.0067 | 2026-11-03 | When user logged out, the JWT token the user had authtenticated with was not invalidated, | |
CVE-2025-54550 |
high | 8.1 | 0.0058 | 2026-11-03 | The example example_xcom that was included in airflow documentation implemented unsafe pat | |
CVE-2025-54831 |
medium | 6.5 | 0.0097 | 2026-11-03 | Apache Airflow 3 introduced a change to the handling of sensitive information in Connectio |