CVE Vulnerability Catalog

SSRF vulnerability in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to send network requests to internal or restricted resources.

The PDBM application uses a static, hard-coded secret in the PDBM.exe executable. This secret is used for encryption, including decrypting credentials stored in the configuration file. Since the secret is constant across installations, an attacker with local privileges can extract it and decrypt the password, gaining administrative access to the PDBM management interface.

In Orca heat pumps, missing authentication and clear-text transmission to the server, combined with lack of input validation, can lead to stored XSS enabling cookie theft from the web interface.

A CSV injection vulnerability was found in Pharmacy Sales and Inventory System up to version 1.0. The issue occurs in the supplier creation interface where the Address/Company Name arguments are improperly handled. Remote exploitation is possible and the exploit is publicly available.

Stormshield Network Security versions 4.3.0-4.3.41, 4.8.0-4.8.15, and 5.0.0-5.0.5 have a Reflected XSS vulnerability in the login API. An attacker can execute a script on the victim's machine, potentially leading to cookie theft or redirection to malicious sites.

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Brokers configured with a network connector with syncDurableSubs set to true are vulnerable to an unauthenticated attacker who can receive a list of all durable topic subscriptions in the broker, including client identifiers, subscription names, topic destinations, and JMS selector expressions, by sending a BrokerInfo command. The broker incorrectly responds without first ensuring the connection is authenticated.

In Apache Airflow, the EmailOperator and `airflow.utils.email` helpers establish SMTP STARTTLS connections without verifying the remote certificate when `smtp_starttls=True` and `smtp_ssl=False` are used. An attacker in a MITM position can present a self-signed certificate and capture SMTP credentials and message contents.

A bug in Apache Airflow's logout handling (FabAuthManager and KeycloakAuthManager) leaves previously-issued JWT tokens valid after logout, allowing an attacker to continue making authenticated API calls.

Apache Airflow before version 3.2.2 has a vulnerability in the GET /api/v2/eventLogs/{event_log_id} endpoint, which fetches audit log rows directly by numeric ID without per-Dag scoping. An authenticated user with audit log read permission for one Dag can read entries for other Dags by guessing or enumerating IDs.

Incomplete authorization in Apache ActiveMQ server before versions 6.2.6 and 5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

In Apache Airflow, rendered template field handling caused bypass of nested sensitive key masking (e.g., password, token) when the field length exceeded the limit. An authenticated user with read permission could obtain plaintext secret values.

In Apache Airflow, the Variable response masker bypassed masking of nested sensitive keys (e.g., password, token) when the nesting depth exceeded the recursion limit. An authenticated user with read permission could obtain plaintext secret values.

A Cross-site Scripting vulnerability was found in Apache ActiveMQ and Apache ActiveMQ Web in the MessageServlet component. JMS message properties are copied into HTTP response headers without validation, allowing security header injection.

Apache Airflow before version 3.2.2 has a vulnerability in `JWTRefreshMiddleware` where the JWT cookie lacks the `Secure` flag. In deployments behind an HTTPS-terminating proxy, an attacker on the network (Wi-Fi MITM) can capture the cookie and replay it against the authenticated API.

Apache Airflow before version 3.2.2 has a vulnerability in the partitioned_dag_runs endpoints in the UI, which enforce only asset-level access control, not per-Dag authorization. An authenticated user with global Asset:read permission can enumerate partition run state, schedule configuration, and asset wiring for Dags they are not authorized to read.

A DAG author can use symlinks or `..` sequences in task IDs to read or overwrite arbitrary files outside the configured log folder if the worker log folder is shared with the API server.

SOPlanning version 1.55 and below is vulnerable to CSRF in the groupe_save endpoints (create, modify, delete). An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged request.

SOPlanning version 1.55 and below does not verify uploaded file extensions, allowing an authenticated attacker to upload a crafted ZIP archive containing a malicious file.

SOPlanning version 1.55 and below is vulnerable to Path Traversal in backup endpoints. An authenticated remote attacker can exploit a vulnerable endpoint to read and execute files previously added via the backup functionality. Additionally, due to CVE-2026-40543, any backup file can be read by an unauthorized user.

A Reflected XSS vulnerability in SOPlanning (versions 1.55 and below) via the taches parameter. An attacker can craft a malicious URL which, when opened by an authenticated victim, results in arbitrary JavaScript execution in the victim's browser.