Medium
CVE-2024-5225
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,358
Reset filters
High
CVE-2024-34694
LNbits improperly handles potential network and payment failures when using Eclair backend
Medium
CVE-2024-4890
SQL injection in litellm
High
CVE-2024-4888
Arbitrary file deletion in litellm
High
CVE-2024-37301
document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection
Medium
CVE-2024-5550
Arbitrary system path lookup in h20
Medium
CVE-2026-49487
In Apache Airflow before 3.3.0, the REST API task-instance detail and list
Medium
CVE-2026-49296
Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. `GET /api/v2/dagSources/{dag_id}` — and the equivalent Dag-so
Medium
CVE-2026-48828
Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API
Medium
CVE-2026-48891
A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the `de
Medium
CVE-2026-48892
The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRE
Critical
CVE-2026-33264
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a
High
CVE-2024-4325
Server-Side Request Forgery in gradio
Medium
CVE-2024-3095
Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever
Low
CVE-2024-35196
Slack integration leaks sensitive information in logs
Medium
CVE-2024-35228
Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`
Medium
CVE-2024-1727
Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading files
Medium
CVE-2024-35180
OMERO.web must check that the JSONP callback is a valid function
Medium
CVE-2024-35189
Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints
Low
CVE-2024-34715
Fides Webserver Logs Hosted Database Password Partial Exposure Vulnerability
Medium
CVE-2024-36105
dbt allows Binding to an Unrestricted IP Address via socketsocket
Medium
CVE-2024-28188
jupyter-scheduler's endpoint is missing authentication
High
CVE-2024-35061
NASA AIT-Core uses unencrypted channels to exchange data over the network
High
CVE-2024-34707
Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.