Low
CVE-2026-35193
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
High
CVE-2026-44545
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote at
Low
CVE-2026-8404
Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling
Low
CVE-2026-7666
Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake
Low
CVE-2026-6873
Django: signed cookies are vulnerable to salt namespace collisions
High
CVE-2026-5241
huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path
Low
CVE-2026-48587
Django: has_vary_header may expose cached responses when Vary values contain whitespace
High
CVE-2026-4035
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environme
Medium
CVE-2026-35212
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Versions prior to 7.260227.0 are vulnerable to XSS in the rendering of email-message observable bod
Medium
CVE-2026-47265
AIOHTTP is vulnerable to cross-origin redirect with per-request cookies
Medium
CVE-2026-34993
AIOHTTP is Vulnerable to Deserialization of Untrusted Data
High
CVE-2026-3514
Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready'
Medium
CVE-2026-3198
MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions
Medium
CVE-2026-8643
pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory
Critical
CVE-2026-47413
praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members
Medium
CVE-2026-49267
Apache Airflow has no certificate validation on SMTP STARTTLS connections
High
CVE-2026-49298
Apache Airflow: Execution API JWT leaked via KubernetesExecutor worker command-line args
Medium
CVE-2026-46764
Apache Airflow has an Authorization Bypass Through User-Controlled Key
Medium
CVE-2026-48726
A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `FabAuthManager` and `KeycloakAuthManager` d
Medium
CVE-2026-42358
Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Low
CVE-2026-45426
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against D
High
CVE-2026-42359
A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e
Medium
CVE-2026-42360
A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` / `token` / `secret` / `api_key` keys inside a JSON template structure) to be byp
High
CVE-2026-41084
A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`) evaluated authorization against the `dag_id` resolved from the URL path whil
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.