Mittel
CVE-2026-41014
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 4.358
Filter zurücksetzen
Mittel
CVE-2026-41017
Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g. nginx / Envoy /
Mittel
CVE-2026-40861
A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process (read-path attack — e.g. `/etc/passwd` or `airflow.cfg`
Mittel
CVE-2026-45192
A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connecti
Hoch
CVE-2026-45360
Apache Airflow Vulnerable to Deserialization of Untrusted Data
Kritisch
CVE-2026-47416
praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}
Kritisch
CVE-2026-47410
praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset
Kritisch
CVE-2026-47407
PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation
Kritisch
CVE-2026-47391
PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
Kritisch
CVE-2026-47392
PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)
Mittel
CVE-2026-47395
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Kritisch
CVE-2026-47396
PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
Mittel
CVE-2026-47390
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
Hoch
CVE-2026-47398
PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334
Hoch
CVE-2026-76245
stigmem-node's federation peer token timestamp validation may reject valid peer tokens
Mittel
CVE-2026-114109
uv is vulnerable to arbitrary file write through entry point names
Mittel
ghsa-qp9x-wp8f-qgjj
tuf has platform-dependent delegation path matching
Mittel
CVE-2026-47144
Shamefile has an arbitrary file read via shamefile.yaml in shame next
Mittel
CVE-2026-44394
OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token
Mittel
CVE-2026-43000
OpenStack Keystone has an Incorrect Authorization issue
Mittel
CVE-2026-42998
OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential
Hoch
CVE-2026-44797
Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)
Mittel
CVE-2026-44796
Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)
Mittel
CVE-2026-44794
Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.