| CVE-2026-76185 | NA | N/A | Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` deli… | 2026-11-09 |
| CVE-2026-82337 | NA | N/A | Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates t… | 2026-11-09 |
| CVE-2026-82436 | NA | N/A | Description
`DefaultStateSerializer`, used to persist and restore stateful bolt checkpoints, configured Kryo … | 2026-11-09 |
| CVE-2026-82440 | NA | N/A | Description
Nimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling… | 2026-11-09 |
| CVE-2026-86468 | NA | N/A | Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some su… | 2026-11-09 |
| CVE-2026-86829 | NA | N/A | Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependenc… | 2026-11-09 |
| CVE-2026-92683 | NA | N/A | Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql v… | 2026-11-09 |
| CVE-2026-96285 | NA | N/A | Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value … | 2026-11-09 |
| CVE-2026-106008 | MEDIUM | 5.3 | The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or va… | 2026-11-09 |
| CVE-2026-106466 | HIGH | 7.5 | The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh tokens when a user c… | 2026-11-09 |
| CVE-2026-113702 | MEDIUM | 4.3 | A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability i… | 2026-11-09 |
| CVE-2026-115252 | CRITICAL | 10.0 | The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce c… | 2026-11-09 |
| CVE-2026-118196 | NA | N/A | OAuth 1 rebinding vulnerability in Apache Allura.
This issue affects Apache Allura: through 1.22.0.
User… | 2026-11-09 |
| CVE-2026-119515 | MEDIUM | 6.5 | Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments &… | 2026-11-09 |
| CVE-2026-119524 | MEDIUM | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila T… | 2026-11-09 |
| CVE-2026-120367 | NA | N/A | Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message buil… | 2026-11-09 |
| CVE-2026-120761 | NA | N/A | Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built … | 2026-11-09 |
| CVE-2026-120832 | NA | N/A | Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description … | 2026-11-09 |
| CVE-2026-120838 | MEDIUM | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins3… | 2026-11-09 |
| CVE-2026-120855 | MEDIUM | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Template… | 2026-11-09 |
| CVE-2026-121570 | HIGH | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill… | 2026-11-09 |
| CVE-2026-121722 | HIGH | 7.5 | Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation fo… | 2026-11-09 |
| CVE-2026-121782 | HIGH | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dy… | 2026-11-09 |
| CVE-2026-122661 | MEDIUM | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Di… | 2026-11-09 |
| CVE-2026-122665 | MEDIUM | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Pa… | 2026-11-09 |
| CVE-2026-122666 | HIGH | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Pa… | 2026-11-09 |
| CVE-2026-123460 | HIGH | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss… | 2026-11-09 |
| CVE-2026-123475 | HIGH | 7.5 | Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps… | 2026-11-09 |
| CVE-2026-123476 | HIGH | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifu.app… | 2026-11-09 |
| CVE-2026-123753 | NA | N/A | Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply … | 2026-11-09 |
| CVE-2026-123766 | NA | N/A | Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAP… | 2026-11-09 |
| CVE-2026-123770 | NA | N/A | Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-da… | 2026-11-09 |
| CVE-2026-123779 | NA | N/A | Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service param… | 2026-11-09 |
| CVE-2026-124590 | HIGH | 7.3 | A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d… | 2026-11-09 |
| CVE-2026-124591 | MEDIUM | 5.5 | A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporter… | 2026-11-09 |
| CVE-2026-124621 | HIGH | 7.4 | A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1… | 2026-11-09 |
| CVE-2026-112172 | NA | N/A | CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate… | 2026-11-09 |
| CVE-2026-118450 | NA | N/A | Venere is installed outside Program Files and loads/registers unsigned components from locations where an unpr… | 2026-11-09 |
| CVE-2026-118458 | NA | N/A | The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V ap… | 2026-11-09 |
| CVE-2026-118459 | NA | N/A | A time-derived emergency password can be derived from publicly available application code, enabling authentica… | 2026-11-09 |
| CVE-2026-118460 | NA | N/A | Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary… | 2026-11-09 |
| CVE-2026-118461 | NA | N/A | The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring… | 2026-11-09 |
| CVE-2026-118462 | NA | N/A | Update components download and execute code without proper authenticity verification, relying on ignored hashe… | 2026-11-09 |
| CVE-2026-118464 | NA | N/A | Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible tra… | 2026-11-09 |
| CVE-2026-118465 | NA | N/A | Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that … | 2026-11-09 |
| CVE-2026-118467 | NA | N/A | Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information… | 2026-11-09 |
| CVE-2026-118468 | NA | N/A | XML parsers process attacker-influenced update manifests or network responses with external entity resolution … | 2026-11-09 |
| CVE-2026-121629 | HIGH | 7.5 | A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist… | 2026-11-09 |
| CVE-2026-124684 | MEDIUM | 5.1 | Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.
This issue affects … | 2026-11-09 |
| CVE-2026-110468 | NA | N/A | WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due … | 2026-11-09 |