Export limit exceeded: 411782 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 411782 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 411782 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (411782 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96285 | 1 Apache | 1 Airflow | 2026-11-09 | N/A |
| Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's `next_kwargs` through the task execution API, can therefore still trigger constructor execution in the scheduler when the `awaiting_input` timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later. | ||||
| CVE-2026-82337 | 1 Apache | 1 Airflow | 2026-11-09 | N/A |
| Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes with arguments they control. Deployments whose Dags use deadline alerts are affected. This is an incomplete fix of CVE-2026-45360, which only hardened the `reference` field; deployments that applied that fix remain affected through the `callback` and `interval` fields. Users of apache-airflow are recommended to upgrade to 3.4.0 or later. | ||||
| CVE-2026-86829 | 1 Apache | 1 Airflow | 2026-11-09 | N/A |
| Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for code installed by the Deployment Manager, above the worker-scoped execution capability a Dag author is documented to have. Deployments that treat Dag authors as less trusted than Deployment Managers are affected, and the scheduler must be evaluating a task dependency that reads a task-written XCom value. Users of apache-airflow are recommended to upgrade to version 3.4.0 or later, which restricts dependency evaluation to primitive XCom values. | ||||
| CVE-2026-118468 | 2026-11-09 | N/A | ||
| XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks. | ||||
| CVE-2026-118467 | 2026-11-09 | N/A | ||
| Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection. | ||||
| CVE-2026-118465 | 2026-11-09 | N/A | ||
| Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations. | ||||
| CVE-2026-118464 | 2026-11-09 | N/A | ||
| Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields. | ||||
| CVE-2026-118462 | 2026-11-09 | N/A | ||
| Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution. | ||||
| CVE-2026-118461 | 2026-11-09 | N/A | ||
| The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials. | ||||
| CVE-2026-118460 | 2026-11-09 | N/A | ||
| Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests. | ||||
| CVE-2026-118459 | 2026-11-09 | N/A | ||
| A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials. | ||||
| CVE-2026-118458 | 2026-11-09 | N/A | ||
| The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts. | ||||
| CVE-2026-118450 | 2026-11-09 | N/A | ||
| Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files. | ||||
| CVE-2026-112172 | 2026-11-09 | N/A | ||
| CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases. | ||||
| CVE-2026-119497 | 2 Wordpress-extensions, Wpwax | 2 Directorist, Directorist | 2026-11-09 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.6. | ||||
| CVE-2026-120832 | 1 Apache | 1 Apache Axis2/java | 2026-11-09 | N/A |
| Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import locations and in xsd:import and xsd:include schemaLocations with no scheme or host restriction; the AAR and WAR deployment resolvers also passed absolute schema locations on to the network. An attacker who controls a WSDL or schema processed by an Axis2 application could therefore make the JVM send requests to arbitrary internal or external hosts. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue. | ||||
| CVE-2026-120761 | 1 Apache | 1 Apache Axis2/java | 2026-11-09 | N/A |
| Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:import were parsed by wsdl4j's own XML parser, which processes DOCTYPE declarations and external entities. An attacker who controls a WSDL, or a document it imports, could therefore read local files or make the JVM issue network requests. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue. | ||||
| CVE-2026-123770 | 1 Apache | 1 Apache Axis2/java | 2026-11-09 | N/A |
| Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not apply, and multipart temporary files were not deleted. An unauthenticated caller could exhaust memory or disk. Version 2.0.2 bounds these bodies with configurable limits and deletes temporary files. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue. | ||||
| CVE-2026-123766 | 1 Apache | 1 Apache Axis2/java | 2026-11-09 | N/A |
| Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injection in the context of the Axis2 origin. This issue affects Apache Axis2/Java: 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue. | ||||
| CVE-2026-123753 | 1 Apache | 1 Apache Axis2/java | 2026-11-09 | N/A |
| Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue. | ||||