CVE Vulnerability Catalog

Apache Airflow 3.3.0 has a vulnerability in the human-in-the-loop task handling, where deserialization of next_kwargs without an allow-list allows a DAG author to import arbitrary modules and instantiate objects in the scheduler process or terminate the scheduler job. Upgrade to 3.3.1 or later is required.

WhatsUp Gold before version 2026.0.2 has a vulnerability allowing an unauthenticated remote attacker to execute arbitrary code in the context of the IIS application service account.

WhatsUp Gold before version 2026.0.2 has a vulnerability allowing an authenticated attacker to bypass frontend controls and inject persistent script content.

Apache Airflow's serialization layer reconstructs exception nodes by calling `import_string()` on a class name from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what can be imported. A Dag author can place a value in `executor_config` that causes an arbitrary callable to be imported and invoked, e.g., `subprocess.check_output` or `builtins.eval`. The code runs in the Scheduler and API server, which per Airflow's security model must never execute Dag-author code.

Eclipse RDF4J has insufficient restriction of XML External Entity (XXE) processing in several XML parser entry points, allowing DOCTYPE declarations, external entity references, and external DTD loading. The issue is fixed in version 5.3.2.

Vulnerability-Lookup has an authentication weakness in account activation and password recovery, where tokens are reusable and not purpose-bound. An attacker who obtains a valid link can repeatedly change the password and take control of the account.

Seerr before version 3.4.0 has a vulnerability in ImageProxy where ETag and Content-Type headers are used to build cache filenames, allowing path traversal and file overwrite, including /app/dist/index.js, leading to code execution after container restart.

RustFS before version 1.0.0-beta.12 has incorrect evaluation of ForAllValues: and ForAnyValue: qualifiers with negated string operators, potentially granting access to excluded principals or making Deny rules ineffective.

RustFS before version 1.0.0-beta.12 has a vulnerability where get_condition_values folds attacker-controlled request headers into identity-based condition keys such as userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap:. This allows authenticated callers to satisfy identity-based policy conditions.

RustFS from version 1.0.0-alpha.64 until 1.0.0-rc.1, when external OPA authorization is enabled via RUSTFS_POLICY_PLUGIN_URL, sets PreparedIamAuth.needs_existing_object_tag incorrectly for PreparedIamMode::Opa, causing maybe_merge_object_tag_conditions to omit s3:ExistingObjectTag/* values. This allows authenticated users to bypass tag-based policy restrictions.

RustFS AddServiceAccount in rustfs/src/admin/handlers/service_account.rs accepts an attacker-controlled target_user after only checking CreateServiceAccountAdminAction, passes it to new_service_account, and prepare_service_account_auth sets is_owner for the resulting root-parent service account. This allows privilege escalation.

Prowler before version 5.33.1 allows an authenticated user with Lighthouse provider configuration access to supply an unvalidated base_url for the openai_compatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/{id}/connection, causing api/src/backend/tasks/jobs/lighthouse_providers.py to send outbound requests, including the API key in the Authorization header, to attacker-controlled or internal endpoints when client.models.list was called.

A user with access to a valid SAML response may impersonate another user under specific conditions.

A Project Resource Manager may gain broader administrative privileges under specific conditions.

A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.

A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or ownership, and potentially impact confidentiality, integrity, and availability.

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to validate the integrity of the DataStore, a non-partitioned filesystem, responsible for storing configuration and cryptographic details. Crafted DataStore contents can impact service availability and/or allow for code execution in the context of high privilege.

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be mounted as plaintext.

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intended boot partition and selects the first partition index matching a hardcoded type value. A crafted Linux partition could be inserted ahead of this intended target, allowing for code execution in the context of high privilege.

Admidio before version 5.0.10 has a vulnerability in modules/documents-files.php where state-changing modes are gated by checking hasUploadRight() on the URL parameter folder_uuid, but the move_save handler operates on a separate URL parameter file_uuid and calls File::moveToFolder($destFolderUUID). File::moveToFolder() checks the upload right on the destination folder but never on the source folder. As a result, any user who can upload to any single folder can move any file from any other folder, including private folders, into a folder they control, and then download it.