Medium
CVE-2024-4890
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,856
Reset filters
High
CVE-2024-4888
Arbitrary file deletion in litellm
High
CVE-2024-37388
ebookmeta XML External Entity vulnerability
High
CVE-2024-37301
document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection
High
CVE-2024-37300
Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0
Medium
CVE-2024-5550
Arbitrary system path lookup in h20
Medium
CVE-2026-49487
In Apache Airflow before 3.3.0, the REST API task-instance detail and list
Medium
CVE-2026-49296
Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. `GET /api/v2/dagSources/{dag_id}` — and the equivalent Dag-so
Medium
CVE-2026-48828
Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API
Medium
CVE-2026-48891
A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the `de
Medium
CVE-2026-48892
The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRE
Critical
CVE-2026-33264
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a
High
CVE-2024-37061
MLFlow improper input validation
High
CVE-2024-37059
MLFlow unsafe deserialization
High
CVE-2024-37063
ydata cross-site scripting
High
CVE-2024-37065
Skops unsafe deserialization
Medium
CVE-2024-5629
PyMongo Out-of-bounds Read in the bson module
High
CVE-2024-37064
ydata unsafe deserialization
High
CVE-2024-37062
ydata unsafe deserialization
High
CVE-2024-4325
Server-Side Request Forgery in gradio
Medium
CVE-2024-3095
Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever
Low
CVE-2024-35196
Slack integration leaks sensitive information in logs
Medium
CVE-2024-3924
code injection vulnerability exists in the huggingface/text-generation-inference repository
Medium
CVE-2024-4330
path traversal vulnerability was identified in the parisneo/lollms-webui
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.