Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3The Event Log detail endpoint in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection e…Check if you run itEPSS 0.37%Jun 1, 2026
- Medium4.3Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.Check if you run itEPSS 0.35%Jun 1, 2026
- High8.8Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.Check if you run itEPSS 0.60%Jun 1, 2026
- Low3.1Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag.Check if you run itEPSS 0.36%Jun 1, 2026
- High7.3Apache Airflow's scheduler-side deadline-reference decoder ( ) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without…Check if you run itEPSS 0.68%Jun 1, 2026
- Critical9.8Apache Solr Use of Hard-coded CredentialsPatch nowKEVEPSS 3.92%Jun 1, 2026
- High8.1Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.Check if you run itEPSS 0.74%Jun 1, 2026
- Medium6.5A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g.Check if you run itEPSS 0.35%Jun 1, 2026
- High8.8A bug in Apache Airflow's XCom PATCH endpoint allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e.g.Check if you run itEPSS 0.57%Jun 1, 2026
- Medium6.5A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names like , , , ) to be bypassed when the JSON value'…Check if you run itEPSS 0.34%Jun 1, 2026
- Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.Check if you run itEPSS 1.02%Jun 1, 2026
- Critical9.1Apache Airflow's official documentation at ("Passing Parameters when triggering Dags") showed a verbatim example without any quoting / sanitization warning.Check if you run itEPSS 0.38%Jun 1, 2026
- High7.5A bug in Apache Airflow's bulk Task Instances API ( ) evaluated authorization against the resolved from the URL path while operating on the / extracted from request-bo…Check if you run itEPSS 0.48%Jun 1, 2026
- Medium5.9Apache Airflow's set the JWT auth cookie without the flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g.Check if you run itEPSS 0.35%Jun 1, 2026
- Medium4.3The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization.Check if you run itEPSS 0.37%Jun 1, 2026
- Low3.1The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags.Check if you run itEPSS 0.48%Jun 1, 2026
- High7.2A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the check, enabling redirection from a trusted Airflow doma…Check if you run itEPSS 0.65%Jun 1, 2026
- Medium6.5A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process (read-path attack — e.g.Check if you run itEPSS 0.69%Jun 1, 2026
- Medium5.1SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints.Check if you run itEPSS 0.18%Jun 1, 2026
- Medium6.4SOPlanning does not verify uploaded file extension.Check if you run itEPSS 0.31%Jun 1, 2026
- Medium6.4SOPlanning is vulnerable to Path Traversal in backup endpoints.Check if you run itEPSS 0.45%Jun 1, 2026
- High8.7SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters.Check if you run itEPSS 0.21%Jun 1, 2026
- Medium5.1SOPlanning is vulnerable to Reflected XSS via the taches parameter.Check if you run itEPSS 0.40%Jun 1, 2026
- Medium5.1SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint.Check if you run itEPSS 0.29%Jun 1, 2026
- High8.8SOPlanning does not enforce authorization for backup functionalities.Check if you run itEPSS 0.27%Jun 1, 2026
Sort