Archive
12 August 2026
Vulnerabilities first published on this day (UTC), newest first.
436 results · Feed
-
High 8.3CVE-2026-73292 Public exploit
Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, a…
-
Medium 4.3
Apache Airflow: Airflow Variables were not masked in the UI for authenticated users
Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holdi…
-
High 7.3
Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization
Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who controls that value throu…
-
High 8.8
Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget
Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserializat…
-
Critical 9.3
Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (c…
-
Medium 6.5
Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)
Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with …
-
High 7.5
Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id
Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic's `NonNegativ…
-
Medium 6.5
Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext
Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level…
-
Medium 6.5
Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI
Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a strin…
-
Medium 6.5
Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints
Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team, unlike every other authorization site. A team-aware auth mana…
-
Critical 9.8
WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.
In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.
-
Medium 6.8
WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.
-
Medium 5.4
Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection
Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing a…
-
Medium 6.8
WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.
-
Medium 4.3
WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.
In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions.
-
High 8.0
WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI
In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content.
-
High 8.1
Potential package cache integrity issue in JFrog Artifactory
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.
-
Medium 4.3
Potential unauthorized metadata exposure in JFrog Artifactory
An authenticated user without repository read permission may access package metadata under specific conditions.
-
Medium 6.7
Rendered Artifactory Helm manifests may contain generated TLS private keys
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
-
High 7.2
Integration credential holders may impersonate users in JFrog Access
A holder of a valid integration credential may impersonate other users under specific conditions.
-
Low 3.1
Private Release Bundle versions may be disclosed under specific configurations
An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.
-
Medium 5.3
Authenticated users may write data outside the intended Docker cache path
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
KEV Aug 27, 2026 -
Medium 6.5
Authenticated users may access restricted Artifactory support information
A low-privileged authenticated user may access restricted support information under specific conditions.
-
High 8.1
Low-privilege users may remove protected Artifactory metadata
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
-
High 7.5
Potential improper SAML signature verification in JFrog Artifactory
A user with access to a valid SAML response may impersonate another user under specific conditions.
-
Medium 6.6
Potential insecure deserialization in JFrog Artifactory
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
-
Medium 4.3
Authenticated users may write files outside the intended Artifactory work directory
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
-
Medium 5.3
Repository readers may access content outside configured upstream paths
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
-
Medium 5.3
Potential remember-me authentication bypass in JFrog Artifactory
An unauthenticated user may bypass authentication under specific cache conditions.
-
Medium 4.3
Authenticated users may view private Puppet module metadata
An authenticated user may view private Puppet module metadata without repository read access.
-
Medium 4.3
Authenticated users may access private NuGet metadata
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
-
Medium 5.3
Anonymous users may access restricted Artifactory repository information
An unauthenticated user may access restricted repository information under specific conditions.
-
Medium 4.3
Bundle writers may alter trusted release information in JFrog Artifactory
A bundle writer may create misleading release promotion information under specific conditions.
-
Medium 4.3
Authenticated users may access private OCI referrer metadata
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
-
Medium 6.5
Publishers without delete permission can overwrite docker layer information
A repository publisher without delete permission may modify protected package content under specific conditions.
-
Medium 5.3
Anonymous users may access restricted Artifactory content under specific configurations
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
-
Medium 4.2
Deleted users may temporarily retain access to JFrog Artifactory
Credentials for a deleted user may remain valid for a short period under specific conditions.
-
High 7.2
Project Resource Managers may escalate privileges in JFrog Artifactory
A Project Resource Manager may gain broader administrative privileges under specific conditions.
-
Medium 5.5
Denial of Service in Autodesk Installer IPC Channel
A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerabili…
-
High 7.8
Incorrect Permission Assignment in Autodesk Installer Named Pipes
A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or ownership, and potentially impact confidentiality, integrity…