Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls.Check if you run itEPSS 0.45%Feb 24, 2026
- Medium5.3Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to c…Check if you run itEPSS 0.65%Feb 24, 2026
- Medium5.3Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts.Check if you run itEPSS 0.62%Feb 24, 2026
- Medium6.5Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see.Check if you run itEPSS 0.37%Feb 24, 2026
- High8.4DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which th…Check if you run itEPSS 1.06%Feb 24, 2026
- High8.8Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component.Check if you run itEPSS 0.89%Feb 23, 2026
- Critical9.1Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.Check if you run itEPSS 0.59%Feb 23, 2026
- Medium6.5When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators.Check if you run itEPSS 0.81%Feb 21, 2026
- High8.7GetSimple CMS is a content management system.Check if you run itEPSS 0.48%Feb 21, 2026
- High8.1Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations.Check if you run itEPSS 0.42%Feb 21, 2026
- Medium5.9Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations.Check if you run itEPSS 0.23%Feb 20, 2026
- UnknownApache Spark Improper AuthenticationPatch nowKEVEPSS 65.83%Jan 31, 2026
- UnknownApache continuum Improper Neutralization of Special Elements used in a Command ('Command Injection')Patch nowKEVEPSS 4.13%Jan 26, 2026
- Critical10.0Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control VulnerabilityPatch nowKEVEPSS 73.19%Jan 20, 2026
- Critical9.6A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.Check if you run itEPSS 1.33%Jan 7, 2026
- High8.2Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.Check if you run itEPSS 0.59%Dec 10, 2025
- UnknownApache log4j Deserialization of Untrusted DataPatch nowKEVEPSS 1.91%Dec 8, 2025
- Medium5.4mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server.Open the advisoryDec 5, 2025
- High7.5An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0.Open the advisoryDec 5, 2025
- High8.1The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0.Open the advisoryDec 2, 2025
- Medium5.3Apache OpenOffice documents can contain links.Open the advisoryNov 12, 2025
- Medium6.5Reflected cross-site scripting vulnerability in Apache OFBiz.Open the advisoryNov 12, 2025
- High7.3Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz.Open the advisoryNov 12, 2025
- Medium4.3An out-of-bounds Write vulnerability in Apache OpenOffice could allow an attacker to craft a document that would crash the program, or otherwise corrupt other memory areas.Open the advisoryNov 12, 2025
- High7.5Apache OpenOffice documents can contain links.Open the advisoryNov 12, 2025