Medium
CVE-2026-74880
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,801
Reset filters
Medium
CVE-2026-74877
openssl-encrypt has no owner verification on key revocation — any client can revoke any key
Critical
CVE-2026-74882
openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private netw
Medium
CVE-2026-74871
openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no
Unrated
CVE-2026-74870
openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardw
Medium
CVE-2026-74874
openssl-encrypt has non-cryptographic PRNG used for steganography pixel selection
Medium
CVE-2026-74875
openssl-encrypt silently skips schema validation when jsonschema library is not installed
Medium
CVE-2026-74873
openssl-encrypt has visible password in process list via --password CLI argument
Medium
CVE-2026-74872
openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification
High
CVE-2026-12243
NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.py` checks for literal `../` sequences but
High
CVE-2026-91989
atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read
Medium
CVE-2026-54249
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
High
CVE-2026-73624
GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
High
CVE-2026-73623
GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
Medium
CVE-2026-73621
GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count
High
CVE-2026-73620
GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
High
CVE-2026-73622
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
High
CVE-2026-73625
GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
Medium
CVE-2026-73619
GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()
Medium
CVE-2026-68969
Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/con
Medium
CVE-2026-68970
Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Maski
Medium
CVE-2026-68971
Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team, un
Medium
CVE-2026-54183
Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tu
High
CVE-2026-67260
Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.