CVE Vulnerability Database
Search and browse 397,836 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-9024 | HIGH | 8.7 | 0.2% | Jun 1, 2026 | A Stored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Engineer... |
| CVE-2026-8474 | MEDIUM | 5.3 | 0.2% | Jun 1, 2026 | A vulnerability was discovered on Stormshield Network Security * 4.3.0 to 4.3.41, * 4.8.0 to 4.8.15, * ... |
| CVE-2026-7858 | CRITICAL | 9.8 | 0.5% | Jun 1, 2026 | A Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic ... |
| CVE-2026-49361 | HIGH | 7.5 | 0.6% | Jun 1, 2026 | Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maxi... |
| CVE-2026-49298 | HIGH | 8.8 | 0.5% | Jun 1, 2026 | A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution... |
| CVE-2026-49270 | MEDIUM | 5.9 | 0.3% | Jun 1, 2026 | Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache Acti... |
| CVE-2026-49267 | MEDIUM | 5.9 | 0.2% | Jun 1, 2026 | Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections wi... |
| CVE-2026-49157 | HIGH | 8.8 | 0.4% | Jun 1, 2026 | Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from... |
| CVE-2026-48827 | HIGH | 7.1 | 0.5% | Jun 1, 2026 | Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receiv... |
| CVE-2026-48726 | MEDIUM | 6.5 | 0.4% | Jun 1, 2026 | A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked lo... |
| CVE-2026-46764 | MEDIUM | 4.3 | 0.4% | Jun 1, 2026 | The Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` in Apache Airflow fetched audit-log rows directly b... |
| CVE-2026-46605 | MEDIUM | 4.3 | 0.3% | Jun 1, 2026 | Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections t... |
| CVE-2026-45505 | HIGH | 8.8 | 0.6% | Jun 1, 2026 | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Br... |
| CVE-2026-45426 | LOW | 3.1 | 0.3% | Jun 1, 2026 | Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued f... |
| CVE-2026-45360 | HIGH | 7.3 | 0.7% | Jun 1, 2026 | Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported ... |
| CVE-2026-44825 | CRITICAL | 9.8 | 0.5% | Jun 1, 2026 | Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 throug... |
| CVE-2026-42588 | HIGH | 8.1 | 0.5% | Jun 1, 2026 | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Br... |
| CVE-2026-42360 | MEDIUM | 6.5 | 0.3% | Jun 1, 2026 | A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` /... |
| CVE-2026-42359 | HIGH | 8.8 | 0.5% | Jun 1, 2026 | A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user wit... |
| CVE-2026-42358 | MEDIUM | 6.5 | 0.3% | Jun 1, 2026 | A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names l... |
| CVE-2026-42253 | MEDIUM | 6.1 | 1.1% | Jun 1, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, A... |
| CVE-2026-42252 | CRITICAL | 9.1 | 0.4% | Jun 1, 2026 | Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") show... |
| CVE-2026-41084 | HIGH | 7.5 | 0.5% | Jun 1, 2026 | A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstance... |
| CVE-2026-41017 | MEDIUM | 5.9 | 0.3% | Jun 1, 2026 | Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Ai... |
| CVE-2026-41014 | MEDIUM | 4.3 | 0.4% | Jun 1, 2026 | The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization... |