Threat Intelligence Database
Comprehensive database of the latest cyber threats affecting organizations worldwide. Filter and search to find specific threat intelligence relevant to your organization.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threat Intelligence
Click on any threat for detailed analysis and mitigation recommendations
0 CVE-2026-40690 is a medium severity vulnerability in Apache Airflow where the asset dependency graph does not properly restrict visibility based on a user's DAG read permissions. This allows a user with read access to at least one DAG to view the existence and names of other DAGs and assets outside their authorized scope. The issue does not allow modification or denial of service, only limited information disclosure. Users are recommended to upgrade to Apache Airflow version 3.2.1, which addresses this issue. Join the discussion | CVE Database V5 | 04/24/2026, 12:35:33 UTC Added: 04/24/2026, 13:06:17 UTC |
0 Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented Join the discussion | CVE Database V5 | 04/18/2026, 06:22:26 UTC Added: 04/18/2026, 06:53:06 UTC |
0 Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue. Join the discussion | CVE Database V5 | 03/17/2026, 10:15:59 UTC Added: 03/17/2026, 10:28:25 UTC |
Showing 1 to 3 of 3 results