Search vulnerabilities

Expected end of text, found '–' (at char 60), (line:1, col:61)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,120

CVE-2026-113508

Apache Airflow: Logout token revocation fails open; errors silently swallowed

Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via `[api_auth] trusted_jwks_url` whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Airflow
CVE-2026-113504

Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Airflow
CVE-2026-107474

Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext

The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Airflow
CVE-2026-101031

Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier

The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded (`load_examples` enabled), a user who can trigger that Dag with a custom `url` parameter could point it at a server whose response injects shell commands run on the worker. This is an incomplete fix for CVE-2025-54941; users who upgraded for CVE-2025-54941 should upgrade again. Users are advised to upgrade to apache-airflow 3.4.0 or later, or to disable example Dags (`load_examples = False`), which is recommended for production.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Airflow
CVE-2026-126724

CVE-2026-126724

Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default password (ivanlee) and interactive shell (/bin/ash), allowing authentication as root via SSH or local console without device-specific secrets. Firmware 20260813_c2169ea5 removes the account from the shipped root filesystem and disables root password authentication in SSH. Users can update their router can be through the local web interface.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126723

CVE-2026-126723

Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler (/usr/lib/lua/luci/data/white_list_plt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813_c2169ea5 fixes the vulnerability, and users can update their router through the local web interface.

CVSS n/a EPSS 1.6% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126166

FortiMail Command Injection Allows Remote Execution and Tenant User Deletion

A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Fortinet
Products
Fortimail
CVE-2026-118119

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 6 more
CVE-2026-120976

Security Advisory 0216

On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication information may be recorded in diagnostic data during a Smart Switch Upgrade (SSU). An attacker with administrative access on the device who obtains the affected diagnostic data could recover sensitive authentication information. This could potentially compromise the confidentiality and integrity of traffic protected by MACsec on the affected link. The vulnerability is only exposed during and after an SSU reload where an active 802.1X session used for MACsec is present.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Arista
Products
Eos
CVE-2026-120978

Security Advisory 0211

On affected Arista EOS platforms running Border Gateway Protocol with Link State ( BGP-LS) and configured with the Dynamic Path Selection (DPS) consumer role, an attacker who has established an authenticated BGP-LS session with the device can send a crafted message to cause the BGP agent to restart unexpectedly. An Arista Pathfinder deployment is not required.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Arista
Products
Eos
CVE-2026-121369

Security Advisory 0225

On affected platforms running Arista EOS under specific link configurations an attacker with direct connectivity to the system may cause system CPU and memory utilization to increase considerably leading to slow responsiveness and eventually may cause the system to reboot.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Arista
Products
Eos
CVE-2026-126835

[Node.js Driver] OIDC ENVIRONMENT confusion bypasses ALLOWED_HOSTS and leaks human-callback bearer tokens

The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of permitted hosts, which may result in unintended disclosure of that credential. No database account is required; the party supplying the connection configuration needs only to influence the settings the application passes to the driver.

CVSS 4.0 · 5.9 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-125847

WordPress vdperanto theme <= 2.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in webriti vdperanto vdperanto allows Cross Site Request Forgery.This issue affects vdperanto: from n/a through 2.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125846

WordPress Mazino theme <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in webriti Mazino mazino allows Cross Site Request Forgery.This issue affects Mazino: from n/a through 1.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125844

WordPress vice theme <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in webriti vice vice allows Cross Site Request Forgery.This issue affects vice: from n/a through 1.4.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125843

WordPress Spasalon theme <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in webriti Spasalon spasalon allows Cross Site Request Forgery.This issue affects Spasalon: from n/a through 3.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—