Browse All CVEs
50,473 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-120988 |
medium | 6.1 | 0.0015 | 2026-11-03 | billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improp | |
CVE-2026-86473 |
critical | 9.1 | 0.0075 | 2026-11-03 | Apache Airflow: the Core API logout endpoint revokes only a session token presented as the | |
CVE-2026-82355 |
medium | 4.2 | 0.0073 | 2026-11-03 | When a request to the Airflow core API carries both a session cookie and an explicit `Auth | |
CVE-2026-75158 |
medium | 4.3 | 0.0064 | 2026-11-03 | Apache Airflow's `/assets/events` API returned asset events for every Dag in the deploymen | |
CVE-2026-75157 |
high | 7.5 | 0.0044 | 2026-11-03 | 1 PoC | Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permis |
CVE-2026-49267 |
medium | 5.9 | 0.0019 | 2026-11-03 | Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers establishe | |
CVE-2026-48726 |
medium | 6.5 | 0.0038 | 2026-11-03 | A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens v | |
CVE-2026-46764 |
medium | 4.3 | 0.0037 | 2026-11-03 | The Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` in Apache Airflow fet | |
CVE-2026-45426 |
low | 3.1 | 0.0036 | 2026-11-03 | Exploitation requires the attacker to already be an authenticated Airflow worker holding a | |
CVE-2026-45360 |
high | 7.3 | 0.0068 | 2026-11-03 | Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.des | |
CVE-2026-42360 |
medium | 6.5 | 0.0035 | 2026-11-03 | A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key mas | |
CVE-2026-42359 |
high | 8.8 | 0.0057 | 2026-11-03 | A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an | |
CVE-2026-42358 |
medium | 6.5 | 0.0034 | 2026-11-03 | A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered | |
CVE-2026-42252 |
critical | 9.1 | 0.0038 | 2026-11-03 | Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Paramete | |
CVE-2026-41084 |
high | 7.5 | 0.0048 | 2026-11-03 | A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dag | |
CVE-2026-41017 |
medium | 5.9 | 0.0035 | 2026-11-03 | Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, | |
CVE-2026-41014 |
medium | 4.3 | 0.0037 | 2026-11-03 | The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access cont | |
CVE-2026-40963 |
low | 3.1 | 0.0048 | 2026-11-03 | The structure_data endpoint in the Airflow UI returned external dependency graph nodes for | |
CVE-2026-40961 |
high | 7.2 | 0.0065 | 2026-11-03 | A bug in the login redirect route in Apache Airflow allowed authenticated users to craft U | |
CVE-2026-40861 |
medium | 6.5 | 0.0069 | 2026-11-03 | A Dag author could either (a) create a symlink under their task's log directory pointing t | |
CVE-2026-45192 |
medium | 6.5 | 0.0043 | 2026-11-03 | A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow | |
CVE-2026-108817 |
low | 2.0 | 0.0107 | 2026-11-03 | A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the | |
CVE-2026-120987 |
high | 7.5 | 0.0014 | 2026-11-03 | Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual | |
CVE-2026-84838 |
high | 7.8 | 0.0112 | 2026-11-03 | A flaw was found in rpmuncompress. This command injection vulnerability allows a local att | |
CVE-2026-84233 |
high | 7.0 | 0.0020 | 2026-11-03 | A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename | |
CVE-2026-30911 |
high | 8.1 | 0.0061 | 2026-11-03 | Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Exe | |
CVE-2026-49298 |
high | 8.8 | 0.0049 | 2026-11-03 | A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to auth | |
CVE-2026-28779 |
high | 7.5 | 0.0079 | 2026-11-03 | Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to pa | |
CVE-2026-28563 |
medium | 4.3 | 0.0052 | 2026-11-03 | Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG | |
CVE-2026-26929 |
medium | 6.5 | 0.0047 | 2026-11-03 | Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply | |
CVE-2026-24098 |
medium | 6.5 | 0.0078 | 2026-11-03 | Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI user | |
CVE-2026-22922 |
medium | 6.5 | 0.0045 | 2026-11-03 | Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow a | |
CVE-2025-68675 |
high | 7.5 | 0.0188 | 2026-11-03 | In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a | |
CVE-2025-68438 |
high | 7.5 | 0.0062 | 2026-11-03 | In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [co | |
CVE-2025-66388 |
medium | 6.5 | 0.0047 | 2026-11-03 | A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in | |
CVE-2025-66236 |
high | 7.5 | 0.0045 | 2026-11-03 | Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deploymen | |
CVE-2025-65995 |
medium | 6.5 | 0.0089 | 2026-11-03 | When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the fu | |
CVE-2025-62402 |
medium | 5.4 | 0.0052 | 2026-11-03 | API users via `/api/v2/dagReports` could perform Dag code execution in the context of the | |
CVE-2025-57735 |
critical | 9.1 | 0.0068 | 2026-11-03 | When user logged out, the JWT token the user had authtenticated with was not invalidated, | |
CVE-2025-54941 |
medium | 4.6 | 0.0049 | 2026-11-03 | An example dag `example_dag_decorator` had non-validated parameter that allowed the UI use | |
CVE-2025-54831 |
medium | 6.5 | 0.0096 | 2026-11-03 | Apache Airflow 3 introduced a change to the handling of sensitive information in Connectio | |
CVE-2025-54550 |
high | 8.1 | 0.0059 | 2026-11-03 | The example example_xcom that was included in airflow documentation implemented unsafe pat | |
CVE-2025-5769 |
medium | 6.1 | 0.0018 | 2026-11-03 | The authentication endpoint does not properly encode user-supplied input before rendering | |
CVE-2025-1397 |
medium | 4.8 | 0.0015 | 2026-11-03 | When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the st | |
CVE-2026-115205 |
medium | 6.5 | 0.0018 | 2026-11-03 | The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or a | |
CVE-2026-106004 |
medium | 5.3 | 0.0019 | 2026-11-03 | The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on on | |
CVE-2026-105993 |
medium | 5.3 | 0.0019 | 2026-11-03 | The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capabil | |
CVE-2026-105967 |
medium | 5.8 | 0.0020 | 2026-11-03 | The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-su | |
CVE-2026-104648 |
medium | 4.9 | 0.0023 | 2026-11-03 | The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email | |
CVE-2026-104647 |
low | 3.8 | 0.0015 | 2026-11-03 | The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in |