Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Polaris
MEDIUM 6.5
Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permissi…
Answer
MEDIUM 6.5
Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary…
Nifi
CRITICAL 9.1
Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framewor…
Traffic Server
HIGH 8.2
Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from…
Nifi
MEDIUM 6.3
Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submi…
Apisix
HIGH 8.1
Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authentica…
Dolphinscheduler
MEDIUM 6.5
Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to acces…
Dolphinscheduler
CRITICAL 9.8
DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache …
Dolphinscheduler
CRITICAL 9.1
Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before…
Apache Airflow Providers Amazon
MEDIUM 5.3
In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic coul…
Cloudstack
MEDIUM 6.5
The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in …
Polaris
CRITICAL 9.9
In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to re…
Dolphinscheduler
HIGH 8.1
Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not…
Airflow
HIGH 7.5
UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that …
Superset
MEDIUM 6.5
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only ver…
Superset
MEDIUM 6.5
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a d…
Superset
HIGH 8.8
Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read…
Cassandra
MEDIUM 5.4
Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when usi…
Superset
MEDIUM 6.5
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed…
Superset
MEDIUM 6.5
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users …
Ozone
HIGH 8.1
Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate t…
Solr
CRITICAL 9.8
Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authen…
Cloudstack
HIGH 7.2
CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register ran…
Ofbiz
CRITICAL 9.8
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to versi…
Submarine
CRITICAL 9.8
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Co…
Kafka
HIGH 7.4
While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditi…
Pulsar
MEDIUM 6.4
This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as u…
Pulsar
MEDIUM 5.4
The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and off…
Archiva
HIGH 7.5
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated…
Archiva
HIGH 7.5
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, …