Browse All CVEs
39,756 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-75157 |
high | 7.5 | 0.0044 | 2026-11-03 | 1 PoC | Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permis |
CVE-2026-75158 |
medium | 4.3 | 0.0064 | 2026-11-03 | Apache Airflow's `/assets/events` API returned asset events for every Dag in the deploymen | |
CVE-2026-82355 |
medium | 4.2 | 0.0073 | 2026-11-03 | When a request to the Airflow core API carries both a session cookie and an explicit `Auth | |
CVE-2026-86473 |
critical | 9.1 | 0.0075 | 2026-11-03 | Apache Airflow: the Core API logout endpoint revokes only a session token presented as the | |
CVE-2026-120987 |
— | — | 0.0011 | 2026-11-03 | Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual | |
CVE-2026-108817 |
low | 2.0 | 0.0107 | 2026-11-03 | A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the | |
CVE-2026-84233 |
high | 7.0 | 0.0019 | 2026-11-03 | A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename | |
CVE-2026-84838 |
high | 7.8 | 0.0111 | 2026-11-03 | A flaw was found in rpmuncompress. This command injection vulnerability allows a local att | |
CVE-2026-30911 |
high | 8.1 | 0.0056 | 2026-11-03 | Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Exe | |
CVE-2026-28779 |
high | 7.5 | 0.0070 | 2026-11-03 | Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to pa | |
CVE-2026-49298 |
high | 8.8 | 0.0049 | 2026-11-03 | A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to auth | |
CVE-2026-26929 |
medium | 6.5 | 0.0042 | 2026-11-03 | Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply | |
CVE-2026-28563 |
medium | 4.3 | 0.0046 | 2026-11-03 | Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG | |
CVE-2026-24098 |
medium | 6.5 | 0.0078 | 2026-11-03 | Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI user | |
CVE-2025-68675 |
high | 7.5 | 0.0188 | 2026-11-03 | In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a | |
CVE-2026-22922 |
medium | 6.5 | 0.0045 | 2026-11-03 | Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow a | |
CVE-2025-66388 |
medium | 6.5 | 0.0048 | 2026-11-03 | A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in | |
CVE-2025-68438 |
high | 7.5 | 0.0062 | 2026-11-03 | In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [co | |
CVE-2025-66236 |
high | 7.5 | 0.0044 | 2026-11-03 | Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deploymen | |
CVE-2025-62402 |
medium | 5.4 | 0.0052 | 2026-11-03 | API users via `/api/v2/dagReports` could perform Dag code execution in the context of the | |
CVE-2025-65995 |
medium | 6.5 | 0.0089 | 2026-11-03 | When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the fu | |
CVE-2025-54941 |
medium | 4.6 | 0.0049 | 2026-11-03 | An example dag `example_dag_decorator` had non-validated parameter that allowed the UI use | |
CVE-2025-57735 |
critical | 9.1 | 0.0067 | 2026-11-03 | When user logged out, the JWT token the user had authtenticated with was not invalidated, | |
CVE-2025-54550 |
high | 8.1 | 0.0058 | 2026-11-03 | The example example_xcom that was included in airflow documentation implemented unsafe pat | |
CVE-2025-54831 |
medium | 6.5 | 0.0097 | 2026-11-03 | Apache Airflow 3 introduced a change to the handling of sensitive information in Connectio | |
CVE-2025-1397 |
medium | 4.8 | 0.0015 | 2026-11-03 | When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the st | |
CVE-2025-5769 |
medium | 6.1 | 0.0017 | 2026-11-03 | The authentication endpoint does not properly encode user-supplied input before rendering | |
CVE-2026-103379 |
medium | 5.3 | 0.0021 | 2026-11-03 | The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, no | |
CVE-2026-104647 |
low | 3.8 | 0.0015 | 2026-11-03 | The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in | |
CVE-2026-104648 |
medium | 4.9 | 0.0023 | 2026-11-03 | The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email | |
CVE-2026-105967 |
medium | 5.8 | 0.0020 | 2026-11-03 | The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-su | |
CVE-2026-105993 |
medium | 5.3 | 0.0019 | 2026-11-03 | The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capabil | |
CVE-2026-106004 |
medium | 5.3 | 0.0019 | 2026-11-03 | The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on on | |
CVE-2026-115205 |
medium | 6.5 | 0.0018 | 2026-11-03 | The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or a | |
CVE-2026-101566 |
high | 7.8 | 0.0011 | 2026-11-03 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite | |
CVE-2026-101676 |
high | 7.8 | 0.0017 | 2026-11-03 | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (comp | |
CVE-2026-77799 |
high | 7.4 | 0.0118 | 2026-11-03 | ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authenti | |
CVE-2026-77800 |
high | 7.7 | 0.0096 | 2026-11-03 | ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication | |
CVE-2025-9566 |
high | 8.1 | 0.0121 | 2026-11-03 | There's a vulnerability in podman where an attacker may use the kube play command to overw | |
CVE-2026-120577 |
high | 8.1 | 0.0061 | 2026-11-03 | The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress | |
CVE-2026-120578 |
medium | 5.3 | 0.0026 | 2026-11-03 | The AI Alt Text Generator plugin for WordPress is vulnerable to authorization bypass in al | |
CVE-2026-120574 |
high | 8.1 | 0.0033 | 2026-11-03 | The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all | |
CVE-2026-120575 |
medium | 6.4 | 0.0021 | 2026-11-03 | The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Store | |
CVE-2026-120561 |
medium | 5.3 | 0.0025 | 2026-11-03 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to una | |
CVE-2026-120563 |
medium | 4.9 | 0.0030 | 2026-11-03 | The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable | |
CVE-2026-120558 |
high | 7.2 | 0.0035 | 2026-11-03 | The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL I | |
CVE-2026-120559 |
high | 7.5 | 0.0067 | 2026-11-03 | The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary | |
CVE-2026-120551 |
medium | 5.3 | 0.0025 | 2026-11-03 | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnera | |
CVE-2026-120552 |
medium | 6.4 | 0.0020 | 2026-11-03 | The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPres | |
CVE-2026-120538 |
high | 8.1 | 0.0043 | 2026-11-03 | The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass lea |