Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.Check if you run itEPSS 0.78%Mar 17, 2026
- Medium4.3Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs.Check if you run itEPSS 0.70%Mar 17, 2026
- Medium6.5Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "…Check if you run itEPSS 0.64%Mar 17, 2026
- High8.8This issue affects Apache Spark: before 3.5.7 and 4.0.1.Check if you run itEPSS 5.42%Mar 16, 2026
- Critical9.3ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application.Check if you run itEPSS 0.79%Mar 16, 2026
- High7.0Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.Check if you run itEPSS 0.47%Mar 13, 2026
- Medium6.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy.Check if you run itEPSS 0.61%Mar 13, 2026
- Medium6.3Malicious configuration can lead to unauthorized file access in Apache Livy.Check if you run itEPSS 0.50%Mar 13, 2026
- Low2.9A security flaw has been discovered in perfree go-fastdfs-web up to 1.3.7.Check if you run itEPSS 0.47%Mar 11, 2026
- Medium5.3This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.Check if you run itEPSS 0.90%Mar 10, 2026
- Medium5.4In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.Check if you run itEPSS 0.53%Mar 9, 2026
- High8.8A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissi…Check if you run itEPSS 0.71%Mar 9, 2026
- Critical9.8Improper Input Validation vulnerability in Apache IoTDB.Check if you run itEPSS 0.67%Mar 9, 2026
- Critical9.8A vulnerability in Apache IoTDB.Check if you run itEPSS 0.59%Mar 9, 2026
- High7.5Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in…Check if you run itEPSS 1.20%Mar 7, 2026
- High7.4Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR reco…Check if you run itEPSS 0.65%Mar 7, 2026
- Critical9.1Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id.Check if you run itEPSS 0.59%Mar 5, 2026
- Critical9.3Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis.Check if you run itEPSS 1.18%Mar 4, 2026
- High8.8WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases.Check if you run itEPSS 0.79%Mar 4, 2026
- Medium5.3Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0.Check if you run itEPSS 0.34%Mar 3, 2026
- Critical9.8Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0.Check if you run itEPSS 1.27%Mar 3, 2026
- High8.2Apache::SessionX versions through 2.01 for Perl create insecure session id.Check if you run itEPSS 0.21%Feb 27, 2026
- High8.8FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.Check if you run itEPSS 2.16%Feb 25, 2026
- High7.1An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check wh…Check if you run itEPSS 0.36%Feb 24, 2026
- Low2.3A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information.Check if you run itEPSS 0.42%Feb 24, 2026