A stored cross-site scripting (XSS) vulnerability exists in DynamiApps Frontend Admin (acf-frontend-form-element) up to version 3.30.1. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute arbitrary scripts in the context of the affected application.
Apache Airflow's API endpoint for deleting an asset's queued events improperly checked permissions, allowing an authenticated user with edit permission on one DAG and read access to others to delete queued events for DAGs they can only read. This flaw enables suppression of asset-triggered runs for DAGs without proper edit rights. The issue was incompletely fixed in version 3.3.2, and users should upgrade to version 3.4.0 or later to fully resolve it.
Apache Airflow's secrets masker failed to mask secrets nested deeper than five levels in data structures, causing sensitive information such as Connection passwords or Variable values to be exposed in task logs and rendered templates. This exposure allows users who can read these logs or templates but should not have access to the secrets to view them in cleartext. The issue is resolved in Apache Airflow version 3.4.0 and later.
Apache Airflow's asset API endpoints exposed the IDs of DAGs related to assets without verifying if the caller had permission to view those DAGs. This allowed authenticated users with asset read access to infer the existence of DAGs they were not authorized to see. Users should upgrade to Apache Airflow version 3.4.0 or later to address this issue.
Apache Airflow versions with the non-default [core] test_connection setting enabled have a vulnerability where asynchronous connection tests improperly handle permissions. Specifically, users with create permission but without edit permission can overwrite existing connections if the test completes and commits the connection under an existing ID. This issue is fixed in Apache Airflow 3.4.0 and later.
Apache Airflow versions prior to 3.4.0 did not reject reserved serialization keys inside a Dag run's configuration. This flaw allowed users authorized to trigger a Dag with a deadline alert and asynchronous callback to pass a crafted configuration that could cause the scheduler to crash repeatedly or cause improper object reconstruction inside the Triggerer after a missed deadline. Upgrading to Apache Airflow 3.4.0 or later resolves this issue.
Apache Airflow versions prior to 3.4.0 had a flaw in their secrets masker where sensitive keys were only matched in snake_case form. As a result, sensitive values stored under camelCase keys such as privateKey, connectionString, webhookUrl, or accessKey were not redacted in task logs, rendered templates, or API responses. This could allow unauthorized users with access to task logs or rendered templates to view sensitive credentials in cleartext. Upgrading to Apache Airflow 3.4.0 or later addresses this issue.
A Reflected Cross-site Scripting (XSS) vulnerability exists in WP Inventory Manager versions up to 2.5.9. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected web application.
The Apache Airflow connections API failed to mask the apprise provider's config connection extra, which may contain notification-service credentials. This flaw allows users with permission to read connections to retrieve these credentials in cleartext. The issue is addressed in Apache Airflow version 3.4.0 and later, where connection credentials are treated as write-only.
The example_dag_decorator example DAG in Apache Airflow improperly validates an IP address fetched over HTTP, allowing shell command injection via crafted IPv6 zone identifiers. This vulnerability is an incomplete fix of CVE-2025-54941. Users should upgrade to Apache Airflow 3.4.0 or later or disable example DAGs in production.
Apache Airflow's Task Execution API allowed tasks to store XCom values without enforcing the reserved-key check, enabling a DAG author to write XComs that could cause the API server to instantiate classes from the airflow namespace with attacker-controlled arguments when deserialized. This vulnerability is a partial bypass of the fix for CVE-2026-59242, affecting users who applied the fix in version 3.3.1. Users should upgrade to version 3.4.0 or later to fully remediate the issue.
CVE-2026-95648 is a high-severity vulnerability in C-Prot AppDefense before version 1.0.2729. It involves improperly controlled modification of dynamically-determined object attributes, which can lead to privilege escalation. The vulnerability is fixed in version 1.0.2729.
Italian Foreign Minister Antonio Tajani's personal data was leaked on the dark web, exposing him and his family to threats and intimidation. The Italian Prime Minister Giorgia Meloni attributed the leak to pro-Russian hackers. The leak is part of a broader pattern of cyber threats and attacks in Europe, including hoax bomb threats and attacks on critical infrastructure. Tajani has not specified the exact nature of the leaked data but indicated the threat is ongoing.
rConfig Core versions 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 have a critical deserialization of untrusted data vulnerability. This flaw allows unauthenticated network attackers to execute arbitrary code by pushing crafted serialized jobs onto the Redis-backed Laravel Horizon queue, which lacks authentication in affected deployments. Exploitation enables attackers to run arbitrary PHP and OS commands, write persistent web shells, and access sensitive credentials. The vulnerability is fixed in versions 8.2.19 and 8.4.1.
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.
This issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9.
CVE-2026-123158, known as 'SSHole,' is a high-severity authentication bypass vulnerability in OpenSSH that affects certain Linux distributions using musl libc with PAM disabled, such as Alpine Linux. The flaw arises from a misinterpretation of password hashes, allowing attackers to authenticate with any password between 257 and 1024 characters for accounts that should not accept passwords, including root. Exploitation attempts have been observed in the wild, primarily by botnets and crypto miners. OpenSSH has released patches, and users are advised to update to version 10.6p2 and consider disabling password authentication as a mitigation.
Red Hat has issued a security advisory for nodejs-nodemon addressing two denial of service vulnerabilities in the brace-expansion package. These vulnerabilities involve uncontrolled recursion and stack exhaustion caused by crafted nested brace patterns. The flaws can cause the nodemon tool, used to monitor and restart node.js applications during development, to crash or become unresponsive. The advisory rates the impact as Important and provides updated packages for Red Hat Enterprise Linux 10 and its variants.
A critical security vulnerability (CVE-2026-97631) exists in the edk2 package used by Red Hat Enterprise Linux 10 and related products. The flaw is a pre-boot remote code execution (RCE) vulnerability in the EDK II PXE driver, which is part of the UEFI firmware sample for QEMU and KVM virtual machines. Red Hat has issued a security advisory and released updates to address this issue.
Allocation of Resources Without Limits or Throttling vulnerability in iubenda iubenda iubenda-cookie-law-solution allows HTTP DoS.This issue affects iubenda: from n/a through 3.13.6.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway invoice-gateway-for-woocommerce allows Reflected XSS.This issue affects Invoice Gateway for WooCommerce – Invoice Payment Gateway: from n/a through 1.1.6.