2026

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this issue is the function

A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability i

A Stored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Engineer

A vulnerability was discovered on Stormshield Network Security  * 4.3.0 to 4.3.41,  * 4.8.0 to 4.8.15,  *

A Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic

Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maxi

A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache Acti

Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections wi

Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from

Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receiv

A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked lo

The Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` in Apache Airflow fetched audit-log rows directly b

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections t

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Br

Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued f

Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported

Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 throug

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Br

A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` /

A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user wit

A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names l

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, A

Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") show

A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstance

Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Ai

The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization

The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking

A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe

A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable b

SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints. An att

SOPlanning does not verify uploaded file extension. An authenticated attacker with access to the backup functionality ca

SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vuln

SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inj

SOPlanning is vulnerable to Reflected XSS via the taches parameter. An attacker can craft a malicious URL which, when op

SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint. An authenticated atta

SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query bac

Privilege chaining issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerability is exploit

Incorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11.60.04 and earlie

A security vulnerability has been detected in code-projects Smart Parking System 1.0. Affected is an unknown function of

A weakness has been identified in itsourcecode Content Management System 1.0. This impacts an unknown function of the fi

A security flaw has been discovered in jeecgboot The server processes these URLs up to 3.9.1. This affects the function

A vulnerability was identified in JeecgBoot up to 3.9.2. The impacted element is an unknown function of the file /airag/

A vulnerability was determined in JeecgBoot up to 3.9.2. The affected element is the function WordUtil.addImage of the f

A vulnerability was found in SourceCodester Water Billing Management System 1.0. Impacted is an unknown function of the

A vulnerability has been found in SourceCodester Water Billing Management System 1.0. This issue affects some unknown pr

A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/A

It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches

A flaw has been found in CodeAstro Ingredients Stock Management System 1.0. This vulnerability affects unknown code of t

A vulnerability was detected in Mettle sendportal up to 3.0.1. This affects an unknown part of the file /webview/ of the