Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.1A possible security vulnerability has been identified in Apache Kafka.Check if you run itEPSS 0.93%Apr 20, 2026
- Medium5.3Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQ…Check if you run itEPSS 0.66%Apr 20, 2026
- Medium5.4The Keycloak authentication manager in did not generate or validate the OAuth 2.0 parameter on the login / login-callback flow, and did not use PKCE.Check if you run itEPSS 0.36%Apr 18, 2026
- Low3.7Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked.Check if you run itEPSS 0.66%Apr 18, 2026
- High7.5UI / API User with asset materialize permission could trigger dags they had no access to.Check if you run itEPSS 0.72%Apr 18, 2026
- High7.5In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false.Check if you run itEPSS 0.76%Apr 18, 2026
- High8.8An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate p…Check if you run itEPSS 1.05%Apr 18, 2026
- High7.2Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code.Check if you run itEPSS 1.12%Apr 18, 2026
- High7.5JWT Tokens used by tasks were exposed in logs.Check if you run itEPSS 0.83%Apr 16, 2026
- Medium6.5The and connection properties were not marked as sensitive names in secrets masker.Check if you run itEPSS 0.55%Apr 15, 2026
- High7.5The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.Check if you run itEPSS 0.59%Apr 15, 2026
- High7.5Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts.Check if you run itEPSS 0.58%Apr 15, 2026
- High8.1The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow U…Check if you run itEPSS 0.58%Apr 15, 2026
- Medium4.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.Check if you run itEPSS 0.96%Apr 14, 2026
- Medium5.3Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.Check if you run itEPSS 0.36%Apr 14, 2026
- High7.5Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.Check if you run itEPSS 0.37%Apr 14, 2026
- Critical9.1Header injection vulnerability in Apache APISIX.Check if you run itEPSS 0.60%Apr 14, 2026
- High8.8Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code.Check if you run itEPSS 1.06%Apr 13, 2026
- High7.5Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details a…Check if you run itEPSS 0.44%Apr 13, 2026
- High7.1Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP.Check if you run itEPSS 0.54%Apr 13, 2026
- Medium5.4Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI Versions Affected: before 2.8.6 Description: The Storm UI visualization componen…Check if you run itEPSS 0.59%Apr 13, 2026
- High8.8Deserialization of Untrusted Data vulnerability in Apache Storm.Check if you run itEPSS 1.05%Apr 13, 2026
- High8.8Chamilo LMS is a learning management system.Check if you run itEPSS 0.76%Apr 10, 2026
- Medium6.3Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forb…Check if you run itEPSS 0.98%Apr 10, 2026
- Medium6.3Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net…Check if you run itEPSS 0.98%Apr 10, 2026