Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low3.1The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags.Check if you run itEPSS 0.52%Jun 1, 2026
- High7.2A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the check, enabling redirection from a trusted Airflow doma…Check if you run itEPSS 0.76%Jun 1, 2026
- Medium6.5A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process (read-path attack — e.g.Check if you run itEPSS 0.76%Jun 1, 2026
- Medium6.5A bug in the GET REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's…Check if you run itEPSS 0.66%Jun 1, 2026
- High8.8It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname.Check if you run itEPSS 0.26%Jun 1, 2026
- High8.7Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer().Check if you run itEPSS 0.75%May 29, 2026
- Medium4.3A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on…Check if you run itEPSS 0.56%May 28, 2026
- High8.5Relative Path Traversal vulnerability in Apache Ignite REST API.Check if you run itEPSS 0.53%May 28, 2026
- Critical9.8Velocity.js is a JavaScript implementation of the Apache Velocity template engine.Check if you run itEPSS 0.61%May 26, 2026
- Medium6.5Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator.Check if you run itEPSS 0.49%May 26, 2026
- None0.0Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login.Check if you run itEPSS 0.45%May 25, 2026
- Medium5.1With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro.Check if you run itEPSS 0.49%May 25, 2026
- Medium5.9Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.Check if you run itEPSS 0.33%May 25, 2026
- Medium5.9Default configurations of Apache Shiro have a session fixation vulnerability.Check if you run itEPSS 0.53%May 25, 2026
- Medium4.9Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope.Check if you run itEPSS 0.56%May 25, 2026
- High7.2Improper Isolation or Compartmentalization vulnerability in Apache Syncope.Check if you run itEPSS 0.86%May 25, 2026
- Medium5.3Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass a…Check if you run itEPSS 0.76%May 25, 2026
- High8.1Apache Airflow providers-google's disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path netw…Check if you run itEPSS 0.80%May 25, 2026
- Medium6.1A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic.Check if you run itEPSS 0.93%May 25, 2026
- Critical9.8An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository.Check if you run itEPSS 0.51%May 22, 2026
- Medium5.3Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks.Check if you run itEPSS 0.54%May 22, 2026
- High7.5The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code executio…Check if you run itEPSS 0.90%May 22, 2026
- Critical9.8Deserialization of untrusted data in Apache Fory PyFory.Check if you run itEPSS 0.82%May 21, 2026
- High8.1(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K.Check if you run itEPSS 0.39%May 21, 2026
- Medium5.3In the AWS Secrets Manager and SSM Parameter Store secrets backends of prior to 9.28.0, the team-scoping logic could resolve a containing a (e.g.Check if you run itEPSS 0.54%May 19, 2026