NVD Vulnerabilities

Severity Distribution

Publication Trend

Vulnerability Database

CVE ID Description Published Base Score Attack Vector Severity Actions
CVE-2026-123766 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagg... 2026-11-09 6.1 NETWORK MEDIUM NVD
CVE-2026-123753 Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyT... 2026-11-09 9.1 NETWORK CRITICAL NVD
CVE-2026-120832 Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, Axis... 2026-11-09 6.5 NETWORK MEDIUM NVD
CVE-2026-120761 Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ... 2026-11-09 9.1 NETWORK CRITICAL NVD
CVE-2026-120367 Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP... 2026-11-09 7.5 NETWORK HIGH NVD
CVE-2026-118196 OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: through 1.22.0. Users are recommended to upgrade to version ... 2026-11-09 9.1 NETWORK CRITICAL NVD
CVE-2026-96285 Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check... 2026-11-09 8.8 NETWORK HIGH NVD
CVE-2026-92683 Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an att... 2026-11-09 8.6 NETWORK HIGH NVD
CVE-2026-86829 Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a t... 2026-11-09 8.8 NETWORK HIGH NVD
CVE-2026-86468 Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in ... 2026-11-09 6.5 NETWORK MEDIUM NVD
CVE-2026-82436 Description `DefaultStateSerializer`, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an ... 2026-11-09 8.8 NETWORK HIGH NVD
CVE-2026-82337 Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in... 2026-11-09 7.3 NETWORK HIGH NVD
CVE-2026-76185 Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, secret id) p... 2026-11-09 6.5 NETWORK MEDIUM NVD
CVE-2026-68982 Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authen... 2026-11-09 7.3 NETWORK HIGH NVD
CVE-2026-50204 Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.extra` column because the secrets masker matched only... 2026-11-09 6.5 NETWORK MEDIUM NVD