Medium
CVE-2026-49270
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-48726
A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `FabAuthManager` and `KeycloakAuthManager` d
High
CVE-2026-48827
Apache MINA SSHD bundle sshd-git has a path traversal vulnerability
Medium
CVE-2026-46605
Apache ActiveMQ server has an incomplete authorization workflow
High
CVE-2026-49157
Apache ActiveMQ has an Incorrect Default Permissions vulnerability
High
CVE-2026-49361
Apache Fluss: Unauthenticated remote attackers can exhaust JVM heap memory using crafted frame headers via TabletServer/CoordinatorServer
Medium
CVE-2026-42358
Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
High
CVE-2026-45505
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue
High
CVE-2026-42588
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue
Low
CVE-2026-45426
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against D
High
CVE-2026-42359
A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e
Medium
CVE-2026-42360
A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` / `token` / `secret` / `api_key` keys inside a JSON template structure) to be byp
High
CVE-2026-41084
A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`) evaluated authorization against the `dag_id` resolved from the URL path whil
Critical
CVE-2026-42252
Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashOperator(bash_command="echo value: {{ dag_run.conf['conf1'] }
High
CVE-2026-44825
Apache Solr has hardcoded credentials in the Basic Authentication setup tool
Medium
CVE-2026-42253
Apache ActiveMQ, Apache ActiveMQ Web have a Cross-site Scripting issue
Low
CVE-2026-40963
Apache Airflow has an Improper Authorization issue
High
CVE-2026-40961
Apache Airflow: Authenticated users can bypass the `is_safe_url` check
Medium
CVE-2026-41014
The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate
Medium
CVE-2026-41017
Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g. nginx / Envoy /
Medium
CVE-2026-40861
A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process (read-path attack — e.g. `/etc/passwd` or `airflow.cfg`
Medium
CVE-2026-45192
A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connecti
High
CVE-2026-35563
Apache Directory LDAP API lacks server certificate verification for LDAP hostnames
High
CVE-2026-45360
Apache Airflow Vulnerable to Deserialization of Untrusted Data
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.