CVEs
Browse the synced catalog, newest first.
- CVE-2026-119514WordPress RepairBuddy plugin <= 4.1234 - Privilege Escalation vulnerabilityWebful Creations RepairBuddy
- CVE-2026-123484WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetFormBuilder
- CVE-2026-121764WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - Cross Site Scripting (XSS) vulnerabilityFolioVision FV Flowplayer Video Player
- CVE-2026-119504WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Cross Site Scripting (XSS) vulnerabilityFrontend Admin by DynamiApps
- CVE-2026-119503WordPress Welcart e-Commerce plugin <= 2.12.6 - Content Injection vulnerabilityWelcart e-Commerce
- CVE-2026-54863WordPress Review Schema plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerabilityMamunur Rashid Review Schema
- CVE-2026-123465WordPress myCred plugin <= 4.0.2 - Sensitive Data Exposure vulnerabilitymyCred
- CVE-2026-121780WordPress Flying Images plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerabilityGijo Varghese Flying Images
- CVE-2026-111403WordPress WP Inventory Manager plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerabilityWP Inventory Manager
- CVE-2026-121760WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerabilityweDevs weDocs
- CVE-2026-40913Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC EnforcementApache Software Foundation apache-airflow-core
- CVE-2026-50204Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartextApache Software Foundation apache-airflow · Apache Software…
- CVE-2026-68982Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validationApache Software Foundation apache-airflow-core
- CVE-2026-76185Apache Airflow Task SDK: SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team modeApache Software Foundation apache-airflow-task-sdk
- CVE-2026-86829Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluationApache Software Foundation apache-airflow-core
- CVE-2026-82337Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserializationApache Software Foundation apache-airflow-core
- CVE-2026-86468Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logsApache Software Foundation apache-airflow · Apache Software…
- CVE-2026-96285Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructorsApache Software Foundation apache-airflow-core
- CVE-2026-113508Apache Airflow: Logout token revocation fails open; errors silently swallowedApache Software Foundation apache-airflow-core
- CVE-2026-124588huggingface finetrainers Model Index model.py resolve_component_cls code injectionhuggingface finetrainers
- CVE-2026-101031Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifierApache Software Foundation apache-airflow-core
- CVE-2026-92683Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphql@neo4j/graphql
- CVE-2026-124587elizaOS eliza HTTP Server api-base-owner.ts information disclosureelizaOS eliza
- CVE-2026-113504Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartextApache Software Foundation apache-airflow · Apache Software…
- CVE-2026-107474Apache Airflow: Connections API: apprise connection "config" extra returned in cleartextApache Software Foundation apache-airflow · Apache Software…
- CVE-2026-111395Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline…Apache Software Foundation apache-airflow-core
- CVE-2026-124637Stored Cross-Site Scripting (XSS) in Tankuam PlacesKompini Tankuam Places
- CVE-2026-111421Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow. classes on the API serverApache Software Foundation apache-airflow-core
- CVE-2026-124586Tencent RapidJSON diyfp.h GetCachedPowerByIndex out-of-boundsTencent RapidJSON
- CVE-2026-111452Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field listApache Software Foundation apache-airflow · Apache Software…