2026

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections t

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Br

Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued f

Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported

Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 throug

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Br

A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` /

A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user wit

A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names l

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, A

Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") show

A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstance

Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Ai

The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization

The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking

A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe

A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable b

SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints. An att

SOPlanning does not verify uploaded file extension. An authenticated attacker with access to the backup functionality ca

SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vuln

SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inj

SOPlanning is vulnerable to Reflected XSS via the taches parameter. An attacker can craft a malicious URL which, when op

SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint. An authenticated atta

SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query bac

Privilege chaining issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerability is exploit

Incorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11.60.04 and earlie

A security vulnerability has been detected in code-projects Smart Parking System 1.0. Affected is an unknown function of

A weakness has been identified in itsourcecode Content Management System 1.0. This impacts an unknown function of the fi

A security flaw has been discovered in jeecgboot The server processes these URLs up to 3.9.1. This affects the function

A vulnerability was identified in JeecgBoot up to 3.9.2. The impacted element is an unknown function of the file /airag/

A vulnerability was determined in JeecgBoot up to 3.9.2. The affected element is the function WordUtil.addImage of the f

A vulnerability was found in SourceCodester Water Billing Management System 1.0. Impacted is an unknown function of the

A vulnerability has been found in SourceCodester Water Billing Management System 1.0. This issue affects some unknown pr

A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/A

It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches

A flaw has been found in CodeAstro Ingredients Stock Management System 1.0. This vulnerability affects unknown code of t

A vulnerability was detected in Mettle sendportal up to 3.0.1. This affects an unknown part of the file /webview/ of the

A security vulnerability has been detected in Assimp up to 6.0.4. Affected by this issue is the function HL1MDLLoader::r

A weakness has been identified in Assimp up to 6.0.4. Affected by this vulnerability is the function aiNode::~aiNode of

A security flaw has been discovered in Assimp up to 6.0.4. Affected is the function HL1MDLLoader::extract_anim_value of

A vulnerability was identified in Assimp up to 6.0.4. This impacts the function Assimp::MDL::HalfLife::HL1MDLLoader::rea

A vulnerability was determined in Assimp up to 6.0.4. This affects the function HL1MDLLoader::read_meshes of the file HL

A vulnerability was found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16

A vulnerability has been found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff94443

A flaw has been found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1.

A vulnerability was detected in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the

A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. This affects the function _scan_memory_cont

A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.30. Affected by this issue is the function

An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authe