Browse CVEs

HIGH 7.5 CVE-2026-34356 Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache … HTTP Server 2.4.68+ Fix from $1,9502026-06-08 MEDIUM 6.1 CVE-2026-29170 A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing F… HTTP Server 2.4.68+ Fix from $1,6002026-06-08 CRITICAL 9.8 CVE-2026-29167 Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 th… HTTP Server 2.4.68+ Fix from $2,3002026-06-08 HIGH 7.5 CVE-2026-47430 ## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPlugi… Cordova Inappbrowser 6.0.1+ Fix from $1,9502026-06-08 CRITICAL 9.1 CVE-2026-50076 Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remo… Fory 1.1.0+ Fix from $2,3002026-06-04 CRITICAL 9.8 CVE-2026-47065 ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the seri… Mina Mitigation only Fix from $2,3002026-06-03 MEDIUM 6.5 CVE-2026-46718 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite. This issue affects Apache Calcit… Calcite 1.42.0+ Fix from $1,6002026-06-02 MEDIUM 5.3 CVE-2026-49328 Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attacke… Fesod 2.0.2+ Fix from $1,6002026-06-01 HIGH 8.8 CVE-2026-49157 Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The def… Activemq 5.19.7 / 6.2.6+ Fix from $1,9502026-06-01 HIGH 8.8 CVE-2026-49298 A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed to the work… Airflow 3.2.2+ Fix from $1,9502026-06-01 HIGH 7.5 CVE-2026-49361 Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, allowing un… Fluss 0.9.1+ Fix from $1,9502026-06-01 HIGH 7.1 CVE-2026-48827 Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operati… Mina Sshd 2.18.0+ Fix from $1,9502026-06-01 MEDIUM 6.5 CVE-2026-48726 A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout fl… Airflow 3.2.2+ Fix from $1,6002026-06-01 MEDIUM 5.9 CVE-2026-49267 Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections without verifying the remote ce… Airflow 3.2.2+ Fix from $1,6002026-06-01 MEDIUM 5.9 CVE-2026-49270 Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Brokers that are c… Activemq 5.19.7 / 6.2.6+ Fix from $1,6002026-06-01 CRITICAL 9.8 CVE-2026-44825 Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a … Solr after 9.10.1 Fix from $2,3002026-06-01 HIGH 8.8 CVE-2026-45505 Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Ap… Activemq 5.19.7 / 6.2.6+ Fix from $1,9502026-06-01 HIGH 8.1 CVE-2026-42588 Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Ap… Activemq 5.19.7 / 6.2.6+ Fix from $1,9502026-06-01 HIGH 7.3 CVE-2026-45360 Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary clas… Airflow 3.2.2+ Fix from $1,9502026-06-01 MEDIUM 6.5 CVE-2026-42360 A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` / `token` / `secret` / `api_ke… Airflow 3.2.2+ Fix from $1,6002026-06-01 CRITICAL 9.1 CVE-2026-42252 Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashOperator(b… Airflow 3.2.2+ Fix from $2,3002026-06-01 HIGH 8.8 CVE-2026-42359 A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user with XCom write permission on a … Airflow 3.2.2+ Fix from $1,9502026-06-01 HIGH 7.5 CVE-2026-41084 A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`) evaluated authorization a… Airflow 3.2.2+ Fix from $1,9502026-06-01 HIGH 7.2 CVE-2026-40961 A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url` check, enabling redirec… Airflow 3.2.2+ Fix from $1,9502026-06-01 MEDIUM 6.5 CVE-2026-42358 A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names like `password`, `token`, `sec… Airflow 3.2.2+ Fix from $1,6002026-06-01 MEDIUM 6.1 CVE-2026-42253 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The Mess… Activemq 5.19.7 / 6.2.6+ Fix from $1,6002026-06-01 MEDIUM 5.9 CVE-2026-41017 Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API server behind an HT… Airflow 3.2.2+ Fix from $1,6002026-06-01 MEDIUM 6.5 CVE-2026-40861 A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process (rea… Airflow 3.2.2+ Fix from $1,6002026-06-01 HIGH 8.5 CVE-2026-35563 It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname.… Directory Ldap Api 2.1.7+ Fix from $1,9502026-06-01 MEDIUM 6.5 CVE-2026-45192 A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read … Airflow 3.2.2+ Fix from $1,6002026-06-01