You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@security.apache.org by pk...@apache.org on 2026/08/24 10:51:30 UTC
(security-site) branch cve-updates-2026-08-24 created (now 88998fcb)
This is an automated email from the ASF dual-hosted git repository.
ppkarwasz pushed a change to branch cve-updates-2026-08-24
in repository https://gitbox.apache.org/repos/asf/security-site.git
at 88998fcb CVE updates from 2026-08-11 through 2026-08-24
This branch includes the following new commits:
new 88998fcb CVE updates from 2026-08-11 through 2026-08-24
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(security-site) 01/01: CVE updates from 2026-08-11 through 2026-08-24
Posted by pk...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
ppkarwasz pushed a commit to branch cve-updates-2026-08-24
in repository https://gitbox.apache.org/repos/asf/security-site.git
commit 88998fcb6bab9b4e00d4c5d70e141c85a630cb4e
Author: Piotr P. Karwasz <pi...@github.copernik.eu>
AuthorDate: Mon Aug 24 12:51:07 2026 +0200
CVE updates from 2026-08-11 through 2026-08-24
Regenerate project pages with the latest public CVE data: 58 new
advisories, one retitled advisory (CVE-2025-59060) and a new page for
Apache Shindig (retired, but subject of a fresh advisory).
Assisted-By: Claude Fable 5 <no...@anthropic.com>
Claude-Session: https://claude.ai/code/session_015BUUiNdfJGyVxnkNJyCZJt
---
content/projects/airflow/_index.md | 443 +++++++++++++++++
content/projects/allura/_index.md | 110 +++++
content/projects/cloudstack/_index.md | 536 +++++++++++++++++++++
content/projects/dolphinscheduler/_index.md | 2 +-
content/projects/httpcomponents/_index.md | 27 +-
content/projects/inlong/_index.md | 259 ++++++++++
content/projects/nifi/_index.md | 2 +-
content/projects/ranger/_index.md | 4 +-
content/projects/shindig/_index.md | 40 ++
content/projects/shiro/_index.md | 2 +-
content/projects/skywalking/_index.md | 25 +
content/projects/struts/_index.md | 132 +++++
static/projects/airflow/CVE-2026-54183.cve.json | 108 +++++
static/projects/airflow/CVE-2026-54183.osv.json | 1 +
static/projects/airflow/CVE-2026-58076.cve.json | 108 +++++
static/projects/airflow/CVE-2026-58076.osv.json | 1 +
static/projects/airflow/CVE-2026-59242.cve.json | 102 ++++
static/projects/airflow/CVE-2026-59242.osv.json | 1 +
static/projects/airflow/CVE-2026-59244.cve.json | 102 ++++
static/projects/airflow/CVE-2026-59244.osv.json | 1 +
static/projects/airflow/CVE-2026-65017.cve.json | 114 +++++
static/projects/airflow/CVE-2026-65017.osv.json | 1 +
static/projects/airflow/CVE-2026-67260.cve.json | 108 +++++
static/projects/airflow/CVE-2026-67260.osv.json | 1 +
static/projects/airflow/CVE-2026-67587.cve.json | 114 +++++
static/projects/airflow/CVE-2026-67587.osv.json | 1 +
static/projects/airflow/CVE-2026-68076.cve.json | 108 +++++
static/projects/airflow/CVE-2026-68076.osv.json | 1 +
static/projects/airflow/CVE-2026-68868.cve.json | 102 ++++
static/projects/airflow/CVE-2026-68868.osv.json | 1 +
static/projects/airflow/CVE-2026-68870.cve.json | 108 +++++
static/projects/airflow/CVE-2026-68870.osv.json | 1 +
static/projects/airflow/CVE-2026-68871.cve.json | 102 ++++
static/projects/airflow/CVE-2026-68871.osv.json | 1 +
static/projects/airflow/CVE-2026-68872.cve.json | 102 ++++
static/projects/airflow/CVE-2026-68872.osv.json | 1 +
static/projects/airflow/CVE-2026-68968.cve.json | 102 ++++
static/projects/airflow/CVE-2026-68968.osv.json | 1 +
static/projects/airflow/CVE-2026-68969.cve.json | 108 +++++
static/projects/airflow/CVE-2026-68969.osv.json | 1 +
static/projects/airflow/CVE-2026-68970.cve.json | 108 +++++
static/projects/airflow/CVE-2026-68970.osv.json | 1 +
static/projects/airflow/CVE-2026-68971.cve.json | 102 ++++
static/projects/airflow/CVE-2026-68971.osv.json | 1 +
static/projects/allura/CVE-2026-69223.cve.json | 85 ++++
static/projects/allura/CVE-2026-69223.osv.json | 1 +
static/projects/allura/CVE-2026-73237.cve.json | 85 ++++
static/projects/allura/CVE-2026-73237.osv.json | 1 +
static/projects/allura/CVE-2026-73238.cve.json | 85 ++++
static/projects/allura/CVE-2026-73238.osv.json | 1 +
static/projects/allura/CVE-2026-73239.cve.json | 95 ++++
static/projects/allura/CVE-2026-73239.osv.json | 1 +
static/projects/allura/CVE-2026-73240.cve.json | 85 ++++
static/projects/allura/CVE-2026-73240.osv.json | 1 +
static/projects/cloudstack/CVE-2026-47359.cve.json | 100 ++++
static/projects/cloudstack/CVE-2026-47359.osv.json | 1 +
static/projects/cloudstack/CVE-2026-50112.cve.json | 125 +++++
static/projects/cloudstack/CVE-2026-50112.osv.json | 1 +
static/projects/cloudstack/CVE-2026-50222.cve.json | 125 +++++
static/projects/cloudstack/CVE-2026-50222.osv.json | 1 +
static/projects/cloudstack/CVE-2026-59085.cve.json | 105 ++++
static/projects/cloudstack/CVE-2026-59085.osv.json | 1 +
static/projects/cloudstack/CVE-2026-59654.cve.json | 119 +++++
static/projects/cloudstack/CVE-2026-59654.osv.json | 1 +
static/projects/cloudstack/CVE-2026-59655.cve.json | 100 ++++
static/projects/cloudstack/CVE-2026-59655.osv.json | 1 +
static/projects/cloudstack/CVE-2026-59657.cve.json | 95 ++++
static/projects/cloudstack/CVE-2026-59657.osv.json | 1 +
static/projects/cloudstack/CVE-2026-59780.cve.json | 95 ++++
static/projects/cloudstack/CVE-2026-59780.osv.json | 1 +
static/projects/cloudstack/CVE-2026-59799.cve.json | 95 ++++
static/projects/cloudstack/CVE-2026-59799.osv.json | 1 +
static/projects/cloudstack/CVE-2026-61397.cve.json | 115 +++++
static/projects/cloudstack/CVE-2026-61397.osv.json | 1 +
static/projects/cloudstack/CVE-2026-61398.cve.json | 95 ++++
static/projects/cloudstack/CVE-2026-61398.osv.json | 1 +
static/projects/cloudstack/CVE-2026-61399.cve.json | 95 ++++
static/projects/cloudstack/CVE-2026-61399.osv.json | 1 +
static/projects/cloudstack/CVE-2026-61400.cve.json | 95 ++++
static/projects/cloudstack/CVE-2026-61400.osv.json | 1 +
static/projects/cloudstack/CVE-2026-61422.cve.json | 94 ++++
static/projects/cloudstack/CVE-2026-61422.osv.json | 1 +
static/projects/cloudstack/CVE-2026-62440.cve.json | 94 ++++
static/projects/cloudstack/CVE-2026-62440.osv.json | 1 +
static/projects/cloudstack/CVE-2026-65613.cve.json | 105 ++++
static/projects/cloudstack/CVE-2026-65613.osv.json | 1 +
static/projects/cloudstack/CVE-2026-66721.cve.json | 95 ++++
static/projects/cloudstack/CVE-2026-66721.osv.json | 1 +
static/projects/cloudstack/CVE-2026-66722.cve.json | 95 ++++
static/projects/cloudstack/CVE-2026-66722.osv.json | 1 +
static/projects/cloudstack/CVE-2026-66797.cve.json | 95 ++++
static/projects/cloudstack/CVE-2026-66797.osv.json | 1 +
static/projects/cloudstack/CVE-2026-68745.cve.json | 95 ++++
static/projects/cloudstack/CVE-2026-68745.osv.json | 1 +
.../httpcomponents/CVE-2026-71290.cve.json | 91 ++++
.../httpcomponents/CVE-2026-71290.osv.json | 1 +
static/projects/inlong/CVE-2026-63015.cve.json | 89 ++++
static/projects/inlong/CVE-2026-63015.osv.json | 1 +
static/projects/inlong/CVE-2026-63016.cve.json | 89 ++++
static/projects/inlong/CVE-2026-63016.osv.json | 1 +
static/projects/inlong/CVE-2026-63037.cve.json | 89 ++++
static/projects/inlong/CVE-2026-63037.osv.json | 1 +
static/projects/inlong/CVE-2026-63038.cve.json | 89 ++++
static/projects/inlong/CVE-2026-63038.osv.json | 1 +
static/projects/inlong/CVE-2026-63039.cve.json | 89 ++++
static/projects/inlong/CVE-2026-63039.osv.json | 1 +
static/projects/inlong/CVE-2026-63040.cve.json | 89 ++++
static/projects/inlong/CVE-2026-63040.osv.json | 1 +
static/projects/inlong/CVE-2026-63042.cve.json | 89 ++++
static/projects/inlong/CVE-2026-63042.osv.json | 1 +
static/projects/inlong/CVE-2026-63043.cve.json | 89 ++++
static/projects/inlong/CVE-2026-63043.osv.json | 1 +
static/projects/inlong/CVE-2026-63044.cve.json | 89 ++++
static/projects/inlong/CVE-2026-63044.osv.json | 1 +
static/projects/inlong/CVE-2026-63046.cve.json | 89 ++++
static/projects/inlong/CVE-2026-63046.osv.json | 1 +
static/projects/shindig/CVE-2026-66256.cve.json | 114 +++++
static/projects/shindig/CVE-2026-66256.osv.json | 1 +
static/projects/skywalking/CVE-2026-34884.cve.json | 88 ++++
static/projects/skywalking/CVE-2026-34884.osv.json | 1 +
static/projects/struts/CVE-2026-73631.cve.json | 89 ++++
static/projects/struts/CVE-2026-73631.osv.json | 1 +
static/projects/struts/CVE-2026-73632.cve.json | 89 ++++
static/projects/struts/CVE-2026-73632.osv.json | 1 +
static/projects/struts/CVE-2026-73633.cve.json | 109 +++++
static/projects/struts/CVE-2026-73633.osv.json | 1 +
static/projects/struts/CVE-2026-73634.cve.json | 96 ++++
static/projects/struts/CVE-2026-73634.osv.json | 1 +
static/projects/struts/CVE-2026-73635.cve.json | 108 +++++
static/projects/struts/CVE-2026-73635.osv.json | 1 +
130 files changed, 7474 insertions(+), 6 deletions(-)
diff --git a/content/projects/airflow/_index.md b/content/projects/airflow/_index.md
index bc9db93b..296bde38 100644
--- a/content/projects/airflow/_index.md
+++ b/content/projects/airflow/_index.md
@@ -18,6 +18,339 @@ You can read more about the security policy on:
This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
{.bg-warning}
+## Cross-team authorization bypass in the asset materialization and dag-run result endpoints ## { #CVE-2026-68971 }
+
+CVE-2026-68971 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-68971) [\[CVE json\]](./CVE-2026-68971.cve.json) [\[OSV json\]](./CVE-2026-68971.osv.json)
+
+
+
+_Last updated: 2026-08-12T15:24:09.501Z_
+
+### Affected
+
+* Apache Airflow before 3.3.1
+
+
+### Description
+
+Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that field -- the Keycloak auth manager, for example, checks the `DAG` resource instead of `DAG:<team>` -- so the team-scoped permission that should gate the request [...]
+
+### References
+* https://github.com/apache/airflow/pull/70893
+* https://lists.apache.org/thread/kfxqqwgojdjdnt6bxg3ord4y41y334fo
+
+
+### Credits
+* @haoxucu (finder)
+* Jarek Potiuk (remediation developer)
+
+
+## Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI ## { #CVE-2026-68970 }
+
+CVE-2026-68970 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-68970) [\[CVE json\]](./CVE-2026-68970.cve.json) [\[OSV json\]](./CVE-2026-68970.osv.json)
+
+
+
+_Last updated: 2026-08-12T15:24:51.786Z_
+
+### Affected
+
+* Apache Airflow before 3.3.1
+
+
+### Description
+
+Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no speci [...]
+
+### References
+* https://github.com/apache/airflow/pull/70891
+* https://www.cve.org/CVERecord?id=CVE-2026-59244
+* https://lists.apache.org/thread/kkrlnbsk47oght4h38mcd3h2kcb8dt28
+
+
+### Credits
+* Raphael Zanarelli (@zanarellidev) (finder)
+* Jarek Potiuk (remediation developer)
+
+
+## Bulk Variable and Connection endpoints record secret values in the audit log in cleartext ## { #CVE-2026-68969 }
+
+CVE-2026-68969 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-68969) [\[CVE json\]](./CVE-2026-68969.cve.json) [\[OSV json\]](./CVE-2026-68969.osv.json)
+
+
+
+_Last updated: 2026-08-18T16:43:40.170Z_
+
+### Affected
+
+* Apache Airflow before 3.3.1
+
+
+### Description
+
+Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at all -- could recover [...]
+
+### References
+* https://github.com/apache/airflow/pull/70890
+* https://www.cve.org/CVERecord?id=CVE-2026-50204
+* https://lists.apache.org/thread/p3jr90jgp2brto4vwcrx680f3x11y70c
+
+
+### Credits
+* Jarek Potiuk (remediation developer)
+* Harish Kolla (@Har1sh-k) (finder)
+
+
+## Authorization bypass in the Backfill API through conflicting interpretations of the backfill id ## { #CVE-2026-68968 }
+
+CVE-2026-68968 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-68968) [\[CVE json\]](./CVE-2026-68968.cve.json) [\[OSV json\]](./CVE-2026-68968.osv.json)
+
+
+
+_Last updated: 2026-08-18T16:43:04.336Z_
+
+### Affected
+
+* Apache Airflow before 3.3.1
+
+
+### Description
+
+Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic's `NonNegativeInt`, which accepts values `int()` rejects (`1.0` coerces to `1`); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An authenticated user holding edit permission on any single D [...]
+
+### References
+* https://github.com/apache/airflow/pull/70889
+* https://lists.apache.org/thread/f9zmw6xs5b4syhwzbl6fsxm4kf2632ol
+
+
+### Credits
+* Jarek Potiuk (remediation developer)
+* Harish Kolla (@Har1sh-k) (finder)
+
+
+## amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable ## { #CVE-2026-68872 }
+
+CVE-2026-68872 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-68872) [\[CVE json\]](./CVE-2026-68872.cve.json) [\[OSV json\]](./CVE-2026-68872.osv.json)
+
+
+
+_Last updated: 2026-08-10T18:21:17.038Z_
+
+### Affected
+
+* Apache Airflow Amazon provider before 9.34.0
+
+
+### Description
+
+The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is require [...]
+
+### References
+* https://github.com/apache/airflow/pull/70878
+* https://lists.apache.org/thread/9nd31g40rd2zpgwwymskvjpfq1xnmllg
+
+
+### Credits
+* Apache Airflow security team (finder)
+* Jarek Potiuk (remediation developer)
+
+
+## yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable ## { #CVE-2026-68871 }
+
+CVE-2026-68871 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-68871) [\[CVE json\]](./CVE-2026-68871.cve.json) [\[OSV json\]](./CVE-2026-68871.osv.json)
+
+
+
+_Last updated: 2026-08-10T18:18:18.472Z_
+
+### Affected
+
+* Apache Airflow Yandex provider before 4.5.1
+
+
+### Description
+
+The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode an [...]
+
+### References
+* https://github.com/apache/airflow/pull/70877
+* https://lists.apache.org/thread/jlj9tv085txk4t0j029mvh43mz89o63c
+
+
+### Credits
+* Apache Airflow security team (finder)
+* Jarek Potiuk (remediation developer)
+
+
+## microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable ## { #CVE-2026-68870 }
+
+CVE-2026-68870 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-68870) [\[CVE json\]](./CVE-2026-68870.cve.json) [\[OSV json\]](./CVE-2026-68870.osv.json)
+
+
+
+_Last updated: 2026-08-10T18:10:29.342Z_
+
+### Affected
+
+* Apache Airflow Microsoft Azure provider before 14.1.0
+
+
+### Description
+
+The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-te [...]
+
+### References
+* https://github.com/apache/airflow/pull/70876
+* https://github.com/apache/airflow/pull/70899
+* https://lists.apache.org/thread/dtkk6vtfoj1y4zjyd6s3mzg0v5g9yg0p
+
+
+### Credits
+* Apache Airflow security team (finder)
+* Jarek Potiuk (remediation developer)
+
+
+## google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables ## { #CVE-2026-68868 }
+
+CVE-2026-68868 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-68868) [\[CVE json\]](./CVE-2026-68868.cve.json) [\[OSV json\]](./CVE-2026-68868.osv.json)
+
+
+
+_Last updated: 2026-08-12T10:33:13.058Z_
+
+### Affected
+
+* Apache Airflow Google provider before 22.3.0
+
+
+### Description
+
+The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its crede [...]
+
+### References
+* https://github.com/apache/airflow/pull/70869
+* https://lists.apache.org/thread/03h5y0fmqlh0yf055zlocxh591ozx69x
+
+
+### Credits
+* Apache Airflow security team (finder)
+* Jarek Potiuk (remediation developer)
+
+
+## Connections test API: team-scope guard bypass resolves another team's environment Connection ## { #CVE-2026-68076 }
+
+CVE-2026-68076 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-68076) [\[CVE json\]](./CVE-2026-68076.cve.json) [\[OSV json\]](./CVE-2026-68076.osv.json)
+
+
+
+_Last updated: 2026-08-12T15:23:21.465Z_
+
+### Affected
+
+* Apache Airflow before 3.3.1
+
+
+### Description
+
+Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored `AIRFLOW_CONN__<TEAM>___<ID>` variable regard [...]
+
+### References
+* https://github.com/apache/airflow/pull/70736
+* https://github.com/apache/airflow/pull/70902
+* https://lists.apache.org/thread/v4mc51dgmrc1t82mhzsngsgzo2gxsf2l
+
+
+### Credits
+* Andrew Rukin (Arenadata) (finder)
+* Jarek Potiuk (remediation developer)
+
+
+## DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget ## { #CVE-2026-67587 }
+
+CVE-2026-67587 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-67587) [\[CVE json\]](./CVE-2026-67587.cve.json) [\[OSV json\]](./CVE-2026-67587.osv.json)
+
+
+
+_Last updated: 2026-08-12T15:32:09.019Z_
+
+### Affected
+
+* Apache Airflow from 3.3.0 before 3.3.1
+
+
+### Description
+
+Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does not help. A Dag author — who controls a task instance's `next_kwargs` through the task execution API — can therefore cause an arbitrary module to be imported inside t [...]
+
+### References
+* https://github.com/apache/airflow/pull/70704
+* https://www.cve.org/CVERecord?id=CVE-2026-58076
+* https://www.cve.org/CVERecord?id=CVE-2026-67260
+* https://lists.apache.org/thread/o00ww4n69qojvsckb464dtwd2nhzy6t0
+
+
+### Credits
+* Nguyen Van Hiep (@hypnguyen1209), MBBank (finder)
+* Jarek Potiuk (remediation developer)
+
+
+## DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization ## { #CVE-2026-67260 }
+
+CVE-2026-67260 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-67260) [\[CVE json\]](./CVE-2026-67260.cve.json) [\[OSV json\]](./CVE-2026-67260.osv.json)
+
+
+
+_Last updated: 2026-08-12T15:33:01.084Z_
+
+### Affected
+
+* Apache Airflow from 3.3.0 before 3.3.1
+
+
+### Description
+
+Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally eve [...]
+
+### References
+* https://github.com/apache/airflow/pull/70685
+* https://www.cve.org/CVERecord?id=CVE-2026-58076
+* https://lists.apache.org/thread/vygr0fh82cjzjp5k4vtfmboxryvm3lyn
+
+
+### Credits
+* Erik Villegas (GitHub: @erik-451) (finder)
+* Jarek Potiuk (remediation developer)
+
+
+## Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass) ## { #CVE-2026-65017 }
+
+CVE-2026-65017 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-65017) [\[CVE json\]](./CVE-2026-65017.cve.json) [\[OSV json\]](./CVE-2026-65017.osv.json)
+
+
+
+_Last updated: 2026-08-12T15:31:24.771Z_
+
+### Affected
+
+* Apache Airflow from 3.3.0 before 3.3.1
+
+
+### Description
+
+Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section [...]
+
+### References
+* https://github.com/apache/airflow/pull/70755
+* https://www.cve.org/CVERecord?id=CVE-2026-48828
+* https://www.cve.org/CVERecord?id=CVE-2026-48892
+* https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38
+
+
+### Credits
+* Andrew Rukin (Arenadata) (finder)
+* Jarek Potiuk (remediation developer)
+
+
## FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision) ## { #CVE-2026-59245 }
CVE-2026-59245 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-59245) [\[CVE json\]](./CVE-2026-59245.cve.json) [\[OSV json\]](./CVE-2026-59245.osv.json)
@@ -45,6 +378,33 @@ In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided
* Jarek Potiuk (remediation developer)
+## Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI ## { #CVE-2026-59244 }
+
+CVE-2026-59244 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-59244) [\[CVE json\]](./CVE-2026-59244.cve.json) [\[OSV json\]](./CVE-2026-59244.osv.json)
+
+
+
+_Last updated: 2026-08-12T15:43:15.962Z_
+
+### Affected
+
+* Apache Airflow before 3.3.1
+
+
+### Description
+
+Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
+
+### References
+* https://github.com/apache/airflow/pull/68975
+* https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6
+
+
+### Credits
+* Juan Pablo Guereca (@jpgerek) (finder)
+* Juan Pablo Guereca (@jpgerek) (remediation developer)
+
+
## FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`) ## { #CVE-2026-59243 }
CVE-2026-59243 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-59243) [\[CVE json\]](./CVE-2026-59243.cve.json) [\[OSV json\]](./CVE-2026-59243.osv.json)
@@ -72,6 +432,61 @@ The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=Fal
* Jarek Potiuk (remediation developer)
+## Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint ## { #CVE-2026-59242 }
+
+CVE-2026-59242 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-59242) [\[CVE json\]](./CVE-2026-59242.cve.json) [\[OSV json\]](./CVE-2026-59242.osv.json)
+
+
+
+_Last updated: 2026-08-12T15:34:59.496Z_
+
+### Affected
+
+* Apache Airflow before 3.3.1
+
+
+### Description
+
+Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with `deserialize=true` triggers the unsafe instantiation. Users are ad [...]
+
+### References
+* https://github.com/apache/airflow/pull/69378
+* https://lists.apache.org/thread/dm0520yhh4mn7qknyoh45r2w6c5qg2mg
+
+
+### Credits
+* localhost-detect (@localhost-detect) (finder)
+* Jarek Potiuk (remediation developer)
+
+
+## Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server ## { #CVE-2026-58076 }
+
+CVE-2026-58076 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-58076) [\[CVE json\]](./CVE-2026-58076.cve.json) [\[OSV json\]](./CVE-2026-58076.osv.json)
+
+
+
+_Last updated: 2026-08-12T15:40:58.403Z_
+
+### Affected
+
+* Apache Airflow from 3.0.0 before 3.3.1
+
+
+### Description
+
+Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example `subprocess.check_output`, or `builtins.eval` on the `builtins`-p [...]
+
+### References
+* https://github.com/apache/airflow/pull/68511
+* https://www.cve.org/CVERecord?id=CVE-2026-33264
+* https://lists.apache.org/thread/t81p688t15jozxsng8521o60nh2kfsos
+
+
+### Credits
+* Jan Kahmen (turingpoint), GitHub: @kah-ja (finder)
+* Jarek Potiuk (remediation developer)
+
+
## Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification ## { #CVE-2026-58065 }
CVE-2026-58065 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-58065) [\[CVE json\]](./CVE-2026-58065.cve.json) [\[OSV json\]](./CVE-2026-58065.osv.json)
@@ -99,6 +514,34 @@ The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHos
* Ephraim Anierobi (remediation developer)
+## Airflow Variables were not masked in the UI for authenticated users ## { #CVE-2026-54183 }
+
+CVE-2026-54183 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-54183) [\[CVE json\]](./CVE-2026-54183.cve.json) [\[OSV json\]](./CVE-2026-54183.osv.json)
+
+
+
+_Last updated: 2026-08-12T15:34:17.762Z_
+
+### Affected
+
+* Apache Airflow before 3.3.1
+
+
+### Description
+
+Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST A [...]
+
+### References
+* https://github.com/apache/airflow/pull/68422
+* https://www.cve.org/CVERecord?id=CVE-2026-42358
+* https://lists.apache.org/thread/z5mrdq6c60f2wyx4cc64cj8nv0dxd9lo
+
+
+### Credits
+* Omkhar Arasaratnam (@omkhar) (finder)
+* Jarek Potiuk (remediation developer)
+
+
## Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names ## { #CVE-2026-50203 }
CVE-2026-50203 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-50203) [\[CVE json\]](./CVE-2026-50203.cve.json) [\[OSV json\]](./CVE-2026-50203.osv.json)
diff --git a/content/projects/allura/_index.md b/content/projects/allura/_index.md
index c40b81af..cd4a20ec 100644
--- a/content/projects/allura/_index.md
+++ b/content/projects/allura/_index.md
@@ -13,6 +13,116 @@ Do you want disclose a potential security issue for Apache Allura? Send your rep
This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
{.bg-warning}
+## Git command injection ## { #CVE-2026-73240 }
+
+CVE-2026-73240 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-73240) [\[CVE json\]](./CVE-2026-73240.cve.json) [\[OSV json\]](./CVE-2026-73240.osv.json)
+
+
+
+_Last updated: 2026-08-12T16:41:16.893Z_
+
+### Affected
+
+* Apache Allura before 1.19.1
+
+
+### Description
+
+<p>Specifically crafted inputs may lead to git argument injection in Apache Allura.</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>
+
+### References
+* https://allura.apache.org/posts/2026-allura-1.19.1.html
+* https://lists.apache.org/thread/10gnxblhomk2z4gxcyyb4t3p4zxsdddv
+
+
+## Missing permission checks IDOR ## { #CVE-2026-73239 }
+
+CVE-2026-73239 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-73239) [\[CVE json\]](./CVE-2026-73239.cve.json) [\[OSV json\]](./CVE-2026-73239.osv.json)
+
+
+
+_Last updated: 2026-08-12T16:41:39.780Z_
+
+### Affected
+
+* Apache Allura before 1.19.1
+
+
+### Description
+
+<p>Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>
+
+### References
+* https://allura.apache.org/posts/2026-allura-1.19.1.html
+* https://lists.apache.org/thread/ryn6yomo897d43ovrd47g02t8ycmbxb3
+
+
+## XSS in code display ## { #CVE-2026-73238 }
+
+CVE-2026-73238 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-73238) [\[CVE json\]](./CVE-2026-73238.cve.json) [\[OSV json\]](./CVE-2026-73238.osv.json)
+
+
+
+_Last updated: 2026-08-12T16:41:57.464Z_
+
+### Affected
+
+* Apache Allura before 1.19.1
+
+
+### Description
+
+<p>XSS vulnerability in code display in Apache Allura.</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>
+
+### References
+* https://allura.apache.org/posts/2026-allura-1.19.1.html
+* https://lists.apache.org/thread/bbzhnvqlwvwbprnfg4g41s8wkc5bdfmk
+
+
+## XSS in markdown pipeline ## { #CVE-2026-73237 }
+
+CVE-2026-73237 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-73237) [\[CVE json\]](./CVE-2026-73237.cve.json) [\[OSV json\]](./CVE-2026-73237.osv.json)
+
+
+
+_Last updated: 2026-08-12T16:42:26.194Z_
+
+### Affected
+
+* Apache Allura from 1.10.0 before 1.19.1
+
+
+### Description
+
+<p>XSS vulnerability in Markdown handling in Apache Allura.</p><p>This issue affects Apache Allura: from 1.10.0 before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>
+
+### References
+* https://allura.apache.org/posts/2026-allura-1.19.1.html
+* https://lists.apache.org/thread/p7bd1yz9v9wbsbc6hz3tjxozxnwyzqz0
+
+
+## Server-side request forgery ## { #CVE-2026-69223 }
+
+CVE-2026-69223 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-69223) [\[CVE json\]](./CVE-2026-69223.cve.json) [\[OSV json\]](./CVE-2026-69223.osv.json)
+
+
+
+_Last updated: 2026-08-11T17:03:03.256Z_
+
+### Affected
+
+* Apache Allura before 1.19.1
+
+
+### Description
+
+<p>Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>
+
+### References
+* https://allura.apache.org/posts/2026-allura-1.19.1.html
+* https://lists.apache.org/thread/9xpltfm6nombd7rdrx5o0hh8kxmm82pb
+
+
## Stored authenticated XSS ## { #CVE-2024-38379 }
CVE-2024-38379 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2024-38379) [\[CVE json\]](./CVE-2024-38379.cve.json) [\[OSV json\]](./CVE-2024-38379.osv.json)
diff --git a/content/projects/cloudstack/_index.md b/content/projects/cloudstack/_index.md
index 2def22f3..014c8714 100644
--- a/content/projects/cloudstack/_index.md
+++ b/content/projects/cloudstack/_index.md
@@ -18,6 +18,542 @@ You can read more about the security policy on:
This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
{.bg-warning}
+## SAML2 Signature Validation Silently Skipped for Cert-less IdP ## { #CVE-2026-68745 }
+
+CVE-2026-68745 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-68745) [\[CVE json\]](./CVE-2026-68745.cve.json) [\[OSV json\]](./CVE-2026-68745.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:21:27.609Z_
+
+### Affected
+
+* Apache CloudStack from 4.5.2 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures.<br><br>Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 and above, which fix this issue.
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* Katriel Moses <ka...@gmail.com> (reporter)
+
+
+## Unauthorised comment creation and disclosure ## { #CVE-2026-66797 }
+
+CVE-2026-66797 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-66797) [\[CVE json\]](./CVE-2026-66797.cve.json) [\[OSV json\]](./CVE-2026-66797.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:21:57.156Z_
+
+### Affected
+
+* Apache CloudStack from 4.16.0.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<div>Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.</div><div><br></div><div>The <code>addAnnotation</code> and <code>listAnnotation</code> APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID.</div><div>< [...]
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* Łukasz Bawolski <lu...@exea.pl> (finder)
+
+
+## ProjectRole & ProjectRolePermission authorization issue ## { #CVE-2026-66722 }
+
+CVE-2026-66722 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-66722) [\[CVE json\]](./CVE-2026-66722.cve.json) [\[OSV json\]](./CVE-2026-66722.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:22:35.208Z_
+
+### Affected
+
+* Apache CloudStack from 4.15.0.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<div>Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack.</div><div><br></div><div>A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the caller is a Domain Admin, without verifying whether the target project belongs to their domain or subdomain. This allows a malicious Domain Admin to tamper with project [...]
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* KQ Wu <kq...@163.com> (finder)
+
+
+## Authorization issue with listHostTags for domain admins ## { #CVE-2026-66721 }
+
+CVE-2026-66721 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-66721) [\[CVE json\]](./CVE-2026-66721.cve.json) [\[OSV json\]](./CVE-2026-66721.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:22:59.422Z_
+
+### Affected
+
+* Apache CloudStack from 4.12.0.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<div>Missing authorization issue for domain admins in CloudStack's host tags listing functionality.</div><div><br></div><div>Domain Admins, by default, have permission to call the <code>listHostTags</code> API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain.</div><div><br></div><div>This issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0 [...]
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* KQ Wu <kq...@163.com> (finder)
+
+
+## Webhook Deliveries Incorrect Access ## { #CVE-2026-65613 }
+
+CVE-2026-65613 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-65613) [\[CVE json\]](./CVE-2026-65613.cve.json) [\[OSV json\]](./CVE-2026-65613.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:23:29.878Z_
+
+### Affected
+
+* Apache CloudStack from 4.20.0.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries.</p><p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* Łukasz Bawolski <Lu...@exea.pl> (reporter)
+
+
+## Improper access control in Kubernetes Service (CKS) cluster manipulation ## { #CVE-2026-62440 }
+
+CVE-2026-62440 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-62440) [\[CVE json\]](./CVE-2026-62440.cve.json) [\[OSV json\]](./CVE-2026-62440.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:23:54.134Z_
+
+### Affected
+
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<p>Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes.</p><p>This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.22.1.1 or later, which fixes the issue.</p>
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* George Chen (GitHub: geo-chen) (reporter)
+* D0HY30N (GitHub: D0HY30N) (reporter)
+
+
+## Authenticated pre-validation SSRF in registerTemplate ## { #CVE-2026-61422 }
+
+CVE-2026-61422 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-61422) [\[CVE json\]](./CVE-2026-61422.cve.json) [\[OSV json\]](./CVE-2026-61422.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:24:36.997Z_
+
+### Affected
+
+* Apache CloudStack at 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality.<br><br>When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious template or ISO registration risk, as URL validation still occurs prior to the actual download by the Secondary Storage VM.<p>This i [...]
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* Yuliang Xiao <xy...@outlook.com> (reporter)
+
+
+## Get and Run Diagnostics Command Injection ## { #CVE-2026-61400 }
+
+CVE-2026-61400 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-61400) [\[CVE json\]](./CVE-2026-61400.cve.json) [\[OSV json\]](./CVE-2026-61400.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:25:01.740Z_
+
+### Affected
+
+* Apache CloudStack from 4.14.0.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<p>Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers.<br><br>An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). [...]
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* Łukasz Bawolski <Lu...@exea.pl> (reporter)
+
+
+## Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI ## { #CVE-2026-61399 }
+
+CVE-2026-61399 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-61399) [\[CVE json\]](./CVE-2026-61399.cve.json) [\[OSV json\]](./CVE-2026-61399.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:25:22.261Z_
+
+### Affected
+
+* Apache CloudStack from 4.20.0.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<p>Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality.</p><p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* Łukasz Bawolski <Lu...@exea.pl> (reporter)
+
+
+## Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI ## { #CVE-2026-61398 }
+
+CVE-2026-61398 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-61398) [\[CVE json\]](./CVE-2026-61398.cve.json) [\[OSV json\]](./CVE-2026-61398.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:25:46.538Z_
+
+### Affected
+
+* Apache CloudStack from 4.15.1.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<p>Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality.</p><p>This issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* Łukasz Bawolski <Lu...@exea.pl> (reporter)
+
+
+## OAuth2 Token Cross-Request Leak ## { #CVE-2026-61397 }
+
+CVE-2026-61397 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-61397) [\[CVE json\]](./CVE-2026-61397.cve.json) [\[OSV json\]](./CVE-2026-61397.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:26:22.132Z_
+
+### Affected
+
+* Apache CloudStack from 4.19.0.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration.</p><p>This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue.</p>
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* Katriel Moses <ka...@gmail.com> (reporter)
+* "Network and Cloud Laboratory (NaCl) KMITL" <na...@kmitl.ac.th> (reporter)
+* Paratpanu Pechsaman <66...@kmitl.ac.th> (analyst)
+* Nutthawat Charoensiriphong <68...@kmitl.ac.th> (analyst)
+* Panabordee Panitchakit <68...@kmitl.ac.th> (analyst)
+
+
+## Missing Privilege Check in Two-Factor Authentication Disable Flow ## { #CVE-2026-59799 }
+
+CVE-2026-59799 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-59799) [\[CVE json\]](./CVE-2026-59799.cve.json) [\[OSV json\]](./CVE-2026-59799.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:26:50.990Z_
+
+### Affected
+
+* Apache CloudStack from 4.18.0.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<p>Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow.</p><p>This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* Erichen <ch...@ict.ac.cn> (reporter)
+
+
+## LDAP provider configuration disclosure ## { #CVE-2026-59780 }
+
+CVE-2026-59780 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-59780) [\[CVE json\]](./CVE-2026-59780.cve.json) [\[OSV json\]](./CVE-2026-59780.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:27:15.624Z_
+
+### Affected
+
+* Apache CloudStack from 4.2.0.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.</p><p></p><div><div><div><div></div></div></div></div><div><div><div><div><div><div><div><p>LDAP configurations can be listed by any authenticated user with access to the <em>listLdapConfigurations</em> API. By default, this API is available to all default roles.</p></div></div></div></div></div></div></div><p></p><p>This issue affect [...]
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* Łukasz Bawolski <Lu...@exea.pl> (reporter)
+
+
+## Sensitive Information Disclosure via Cleartext Storage in AsyncJob ## { #CVE-2026-59657 }
+
+CVE-2026-59657 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-59657) [\[CVE json\]](./CVE-2026-59657.cve.json) [\[OSV json\]](./CVE-2026-59657.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:27:52.170Z_
+
+### Affected
+
+* Apache CloudStack from 4.0.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<p>Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database.</p><p>This issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* Davi Torres <da...@gmail.com> (reporter)
+
+
+## Unauthenticated OAuth provider client-secret disclosure ## { #CVE-2026-59655 }
+
+CVE-2026-59655 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-59655) [\[CVE json\]](./CVE-2026-59655.cve.json) [\[OSV json\]](./CVE-2026-59655.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:28:13.175Z_
+
+### Affected
+
+* Apache CloudStack from 4.19.0.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers.</p><p>This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* Yuliang Xiao <xy...@outlook.com> (reporter)
+* Stijn Simons <st...@portofantwerpbruges.com> (reporter)
+
+
+## DoS caused by database connections leak ## { #CVE-2026-59654 }
+
+CVE-2026-59654 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-59654) [\[CVE json\]](./CVE-2026-59654.cve.json) [\[OSV json\]](./CVE-2026-59654.osv.json)
+
+
+
+_Last updated: 2026-08-21T12:32:59.667Z_
+
+### Affected
+
+* Apache CloudStack from 4.7.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<p>Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server.</p><p>This issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.2 [...]
+
+### References
+* https://lists.apache.org/thread/7cgf37clcpjj4g2hl7rnyoq1th3ht9r4
+
+
+### Credits
+* Henrique Sato <he...@gmail.com> (reporter)
+
+
+## Server-Side Request Forgery (SSRF) vulnerability in webhook module ## { #CVE-2026-59085 }
+
+CVE-2026-59085 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-59085) [\[CVE json\]](./CVE-2026-59085.cve.json) [\[OSV json\]](./CVE-2026-59085.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:28:50.341Z_
+
+### Affected
+
+* Apache CloudStack from 4.20.0.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<p></p><p>Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests.</p><p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p><p></p>
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* Jonathan Leitschuh <jo...@gmail.com> (finder)
+* Łukasz Bawolski <Lu...@exea.pl> (finder)
+* George Chen (GitHub: geo-chen) (finder)
+
+
+## Improper access control in Userdata reference APIs ## { #CVE-2026-50222 }
+
+CVE-2026-50222 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-50222) [\[CVE json\]](./CVE-2026-50222.cve.json) [\[OSV json\]](./CVE-2026-50222.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:29:16.822Z_
+
+### Affected
+
+* Apache CloudStack from 4.18.0.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<p>Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.</p><p>Several userdata-related APIs in Apache CloudStack, including <code>deleteUserData</code>, <code>linkUserDataToTemplate</code>, <code>resetUserDataForVirtualMachine</code>, <code>deployVirtualMachine</code>, and <code>updateVirtualMachine</code>, exhibit missing or insufficient access control validation, potentially allowing cross-tenant [...]
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* Bernardo De Marco Gonçalves <be...@gmail.com> (reporter)
+* Yuliang Xiao <xy...@outlook.com> (reporter)
+* Łukasz Bawolski <Lu...@exea.pl> (reporter)
+* George Chen (GitHub: geo-chen) (reporter)
+* KQ Wu <kq...@163.com> (reporter)
+
+
+## RCE and SSRF in direct download, metalink and NFS templates ## { #CVE-2026-50112 }
+
+CVE-2026-50112 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-50112) [\[CVE json\]](./CVE-2026-50112.cve.json) [\[OSV json\]](./CVE-2026-50112.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:29:39.850Z_
+
+### Affected
+
+* Apache CloudStack from 4.14.0.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<p><b>SSRF via Metalink Mirror URL Resolution:</b></p><p>An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.</p><p><b>RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads:</b></p><p>An authenticated CloudStack tenant holding the default User role can execute ar [...]
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* K (reporter)
+* Samy Ghannad <sa...@samyghannad.com> (reporter)
+* Katriel Moses <ka...@gmail.com> (reporter)
+* Venkatraman Kumar <ve...@securin.io> (reporter)
+* Łukasz Bawolski <Lu...@exea.pl> (reporter)
+
+
+## OS Command Injection due to unsanitized mount command ## { #CVE-2026-47359 }
+
+CVE-2026-47359 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-47359) [\[CVE json\]](./CVE-2026-47359.cve.json) [\[OSV json\]](./CVE-2026-47359.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:30:06.507Z_
+
+### Affected
+
+* Apache CloudStack from 4.20.0.0 through 4.20.3.0
+* Apache CloudStack from 4.21.0.0 through 4.22.1.0
+
+
+### Description
+
+<p>Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API (available since 4.20.0.0) and updateBackupRepository API (introduced in 4.22.0.0) accept unsanitized command options for the backup repository. A malicious operator account can exploit this to inject arbitrary commands that execute on the KVM hypervisor host when any account subsequently performs a [...]
+
+### References
+* https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
+
+
+### Credits
+* 김우석 <wo...@gmail.com> (reporter)
+* Łukasz Bawolski <Lu...@exea.pl> (reporter)
+
+
## Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access ## { #CVE-2026-25199 }
CVE-2026-25199 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-25199) [\[CVE json\]](./CVE-2026-25199.cve.json) [\[OSV json\]](./CVE-2026-25199.osv.json)
diff --git a/content/projects/dolphinscheduler/_index.md b/content/projects/dolphinscheduler/_index.md
index 812135c1..fd62cca3 100644
--- a/content/projects/dolphinscheduler/_index.md
+++ b/content/projects/dolphinscheduler/_index.md
@@ -125,7 +125,7 @@ CVE-2026-32967 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-32967) [\[CVE jso
-_Last updated: 2026-06-17T01:41:50.516Z_
+_Last updated: 2026-08-21T08:22:51.583Z_
### Affected
diff --git a/content/projects/httpcomponents/_index.md b/content/projects/httpcomponents/_index.md
index 8d2a3cfd..430f47bf 100644
--- a/content/projects/httpcomponents/_index.md
+++ b/content/projects/httpcomponents/_index.md
@@ -18,13 +18,38 @@ You can read more about the security policy on:
This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
{.bg-warning}
+## TLS hostname verification silently disabled on the async transport (default config, MITM) ## { #CVE-2026-71290 }
+
+CVE-2026-71290 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-71290) [\[CVE json\]](./CVE-2026-71290.cve.json) [\[OSV json\]](./CVE-2026-71290.osv.json)
+
+
+
+_Last updated: 2026-08-13T08:56:10.759Z_
+
+### Affected
+
+* Apache HttpComponents Client from 5.4-alpha through 5.6.3
+
+
+### Description
+
+<p>Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. <br></p><p>Please note the classic version of HttpClient is not affected by this vulnerability. </p><p>Af [...]
+
+### References
+* https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq
+
+
+### Credits
+* n0mi1k (finder)
+
+
## Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS ## { #CVE-2026-64607 }
CVE-2026-64607 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-64607) [\[CVE json\]](./CVE-2026-64607.cve.json) [\[OSV json\]](./CVE-2026-64607.osv.json)
-_Last updated: 2026-07-31T10:12:13.331Z_
+_Last updated: 2026-08-13T08:52:34.618Z_
### Affected
diff --git a/content/projects/inlong/_index.md b/content/projects/inlong/_index.md
index 48d0e1f9..4b7c9baa 100644
--- a/content/projects/inlong/_index.md
+++ b/content/projects/inlong/_index.md
@@ -18,6 +18,265 @@ You can read more about the security policy on:
This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
{.bg-warning}
+## Agent Installer — Command Injection to RCE via Default Credentials ## { #CVE-2026-63046 }
+
+CVE-2026-63046 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-63046) [\[CVE json\]](./CVE-2026-63046.cve.json) [\[OSV json\]](./CVE-2026-63046.osv.json)
+
+
+
+_Last updated: 2026-08-21T08:37:55.621Z_
+
+### Affected
+
+* Apache InLong from 2.0.0 before 2.4.0
+
+
+### Description
+
+<p>Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. <span style="background-color: rgb(255, 255, 255);">Agent Installer's ModuleManager executes arbitrary shell
+commands via ExcuteLinux.exeCmd() with no filtering or whitelist
+validation. </span></p><p>This issue affects Apache InLong: from 2.0.0 before 2.4.0.</p><p></p><p><span style="background-color: var(--wht);">Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve it.</span></p><p><span style="background-color: rgb(255, 255, 255);">[1] <a target="_blank" rel="nofollow" href="https://github.com/apache/inlong/pull/12151">https://github.com/apache/inlong/pull/12151</a>.</span></p><p><span style="background-color: rgb(255 [...]
+
+### References
+* https://lists.apache.org/thread/2pgz70rz9ozfm7vm5c33po3yyspq846y
+
+
+### Credits
+* IcySun (finder)
+
+
+## Authenticated SSRF via POST /api/node/testConnection ## { #CVE-2026-63044 }
+
+CVE-2026-63044 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-63044) [\[CVE json\]](./CVE-2026-63044.cve.json) [\[OSV json\]](./CVE-2026-63044.osv.json)
+
+
+
+_Last updated: 2026-08-20T15:56:57.925Z_
+
+### Affected
+
+* Apache InLong from 2.0.0 before 2.4.0
+
+
+### Description
+
+<p>Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. <span style="background-color: rgb(255, 255, 255);"> Any </span><span style="background-color: rgb(255, 255, 255);">authenticated</span><span style="background-color: rgb(255, 255, 255);"> user (no admin role required) can cause the </span><span style="background-color: rgb(255, 255, 255);">InLong Manager server to make outbound HTTP requests or TCP connections to</span><br><span style="background-c [...]
+
+### References
+* https://lists.apache.org/thread/b3rtzssd8hdk0dyq4y6mpdx6jj5ro4g6
+
+
+### Credits
+* Geo (finder)
+
+
+## Agent path traversal via unvalidated file source path ## { #CVE-2026-63043 }
+
+CVE-2026-63043 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-63043) [\[CVE json\]](./CVE-2026-63043.cve.json) [\[OSV json\]](./CVE-2026-63043.osv.json)
+
+
+
+_Last updated: 2026-08-20T15:53:04.708Z_
+
+### Affected
+
+* Apache InLong from 2.0.0 before 2.4.0
+
+
+### Description
+
+<p>Relative Path Traversal vulnerability in Apache InLong. <span style="background-color: rgb(255, 255, 255);">Arbitrary file read from the Agent host filesystem.</span></p><p>This issue affects Apache InLong: from 2.0.0 before 2.4.0.</p><p></p><p><span style="background-color: var(--wht);">Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.</span></p><p><span style="background-color: rgb(255, 255, 255);">[1] <a target="_blank" rel="nofollow" [...]
+
+### References
+* https://lists.apache.org/thread/0ohn861tzd9g7nsosd6oz3of6dvhvqnk
+
+
+### Credits
+* dyingman1 (finder)
+
+
+## Missing authorization on DataNode management endpoints ## { #CVE-2026-63042 }
+
+CVE-2026-63042 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-63042) [\[CVE json\]](./CVE-2026-63042.cve.json) [\[OSV json\]](./CVE-2026-63042.osv.json)
+
+
+
+_Last updated: 2026-08-20T15:50:01.022Z_
+
+### Affected
+
+* Apache InLong from 2.0.0 before 2.4.0
+
+
+### Description
+
+<p>Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions.</p><p>This issue affects Apache InLong: from 2.0.0 before 2.4.0.</p><p></p><p><span style="background-color: var(--wht);">Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.</span></p><p><span style="background-color: rgb(255, 255, 255);">[1] <a target="_blank" rel=" [...]
+
+### References
+* https://lists.apache.org/thread/wxs4jfjkoo6rlyovhrx8bo74rfmzwbk7
+
+
+### Credits
+* tonghuaroot (finder)
+
+
+## Missing authorization in StreamSource forceDelete ## { #CVE-2026-63040 }
+
+CVE-2026-63040 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-63040) [\[CVE json\]](./CVE-2026-63040.cve.json) [\[OSV json\]](./CVE-2026-63040.osv.json)
+
+
+
+_Last updated: 2026-08-20T15:48:42.564Z_
+
+### Affected
+
+* Apache InLong from 2.0.0 before 2.4.0
+
+
+### Description
+
+<p>Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource <span style="background-color: rgb(255, 255, 255);">performs no </span><span style="background-color: rgb(255, 255, 255);">authorization</span><span style="background-color: rgb(255, 255, 255);"> check, a</span><span style="background-color: rgb(255, 255, 255);">ny </span><span style="background-color: rgb(255, 255, 255);">authenticated user can logically delete ALL str [...]
+
+### References
+* https://lists.apache.org/thread/sbqrk88cjv3r9rnqfqgn31ox4711offy
+
+
+### Credits
+* Mingrui Liu (finder)
+
+
+## SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService ## { #CVE-2026-63039 }
+
+CVE-2026-63039 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-63039) [\[CVE json\]](./CVE-2026-63039.cve.json) [\[OSV json\]](./CVE-2026-63039.osv.json)
+
+
+
+_Last updated: 2026-08-20T15:43:51.402Z_
+
+### Affected
+
+* Apache InLong from 2.0.0 before 2.4.0
+
+
+### Description
+
+<p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. <span style="background-color: rgb(255, 255, 255);">This allows an attacker to inject<span style="background-color: rgb(255, 255, 255);"> the string value into
+the SQL statement, enabling SQL injection.</span></span><span style="background-color: rgb(255, 255, 255);"><span style="background-color: rgb(255, 255, 255);"><br></span></span></p><p>This issue affects Apache InLong: from 2.0.0 before 2.4.0.</p><p></p><p><span style="background-color: var(--wht);">Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.</span></p><p><span style="background-color: rgb(255, 255, 255);">[1] <a target="_blank" rel="nofollow" h [...]
+
+### References
+* https://lists.apache.org/thread/wzpsgwcx2hxj025pcml0loxr16kl93qt
+
+
+### Credits
+* Andrea Cosentino (finder)
+
+
+## SQL Injection via String Concatenation Vulnerability Report ## { #CVE-2026-63038 }
+
+CVE-2026-63038 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-63038) [\[CVE json\]](./CVE-2026-63038.cve.json) [\[OSV json\]](./CVE-2026-63038.osv.json)
+
+
+
+_Last updated: 2026-08-20T15:42:40.312Z_
+
+### Affected
+
+* Apache InLong from 2.0.0 before 2.4.0
+
+
+### Description
+
+<p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. <span style="background-color: rgb(255, 255, 255);">This allows an attacker to inject arbitrary SQL code through the
+dbName, tableName, schemaName, and username parameters. </span></p><p>This issue affects Apache InLong: from 2.0.0 before 2.4.0.</p><p></p><p><span style="background-color: var(--wht);">Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.</span></p><p><span style="background-color: rgb(255, 255, 255);">[1] <a target="_blank" rel="nofollow" href="https://github.com/apache/inlong/issues/12135">https://github.com/apache/inlong/issues/12135</a>.</s [...]
+
+### References
+* https://lists.apache.org/thread/79w0cfnkhs3hctv8yn861qx3qwlc3p37
+
+
+### Credits
+* zhaokaifei (finder)
+
+
+## Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint ## { #CVE-2026-63037 }
+
+CVE-2026-63037 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-63037) [\[CVE json\]](./CVE-2026-63037.cve.json) [\[OSV json\]](./CVE-2026-63037.osv.json)
+
+
+
+_Last updated: 2026-08-20T15:37:30.661Z_
+
+### Affected
+
+* Apache InLong from 2.0.0 before 2.4.0
+
+
+### Description
+
+<p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. <span style="background-color: rgb(255, 255, 255);">This appears to allow SQL injection in the ORDER BY clause against the
+Manager backend database.</span></p><p>This issue affects Apache InLong: from 2.0.0 before 2.4.0.</p><p></p><p><span style="background-color: var(--wht);">Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.</span></p><p><span style="background-color: rgb(255, 255, 255);">[1] <a target="_blank" rel="nofollow" href="https://github.com/apache/inlong/issues/12079">https://github.com/apache/inlong/issues/12079</a>.</span></p><p></p>
+
+### References
+* https://lists.apache.org/thread/po2gvsl30mfjk9cy415hsbzrmqkqpd5r
+
+
+### Credits
+* cat dg (finder)
+
+
+## Ordinary users can create new packages ## { #CVE-2026-63016 }
+
+CVE-2026-63016 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-63016) [\[CVE json\]](./CVE-2026-63016.cve.json) [\[OSV json\]](./CVE-2026-63016.osv.json)
+
+
+
+_Last updated: 2026-08-20T15:32:39.423Z_
+
+### Affected
+
+* Apache InLong from 2.0.0 before 2.4.0
+
+
+### Description
+
+<p>Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages.</p><p>This issue affects Apache InLong: from 2.0.0 before 2.4.0.</p><p></p><p><span style="background-color: var(--wht);">Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.</span></p><p><span style="background-color: rgb(255, 255, 255);">[1] <a target="_blank" rel="nofollow" href="https://githu [...]
+
+</a><a target="_blank" rel="nofollow" href="https://github.com/apache/inlong/pull/11732">https://github.com/apache/inlong/pull/12095</a></span></p><p></p>
+
+### References
+* https://lists.apache.org/thread/jmsn2slhqmmw7kt24zqcnw6tyjnrcykp
+
+
+### Credits
+* Tycho Knight (finder)
+
+
+## Non-template responsible persons can view template information ## { #CVE-2026-63015 }
+
+CVE-2026-63015 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-63015) [\[CVE json\]](./CVE-2026-63015.cve.json) [\[OSV json\]](./CVE-2026-63015.osv.json)
+
+
+
+_Last updated: 2026-08-20T15:29:24.817Z_
+
+### Affected
+
+* Apache InLong from 2.0.0 before 2.4.0
+
+
+### Description
+
+<p>Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information.</p><p>This issue affects Apache InLong: from 2.0.0 before 2.4.0.</p><p></p><p><span style="background-color: var(--wht);">Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.</span></p><p><span style="background-color: rgb(255, 255, 255);">[1] <a target="_blank" rel="nofollow" href="https://github.com/apache/inlon [...]
+
+</a><a target="_blank" rel="nofollow" href="https://github.com/apache/inlong/pull/11732">https://github.com/apache/inlong/pull/12093</a></span></p><p></p>
+
+### References
+* https://lists.apache.org/thread/b7bvsg59bo619rywwpd7tj66rkzz62k4
+
+
+### Credits
+* Tycho Knight (finder)
+
+
## An arbitrary file read vulnerability for JDBC ## { #CVE-2025-27531 }
CVE-2025-27531 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2025-27531) [\[CVE json\]](./CVE-2025-27531.cve.json) [\[OSV json\]](./CVE-2025-27531.osv.json)
diff --git a/content/projects/nifi/_index.md b/content/projects/nifi/_index.md
index fdfd13e4..e01d6314 100644
--- a/content/projects/nifi/_index.md
+++ b/content/projects/nifi/_index.md
@@ -24,7 +24,7 @@ CVE-2026-68981 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-68981) [\[CVE jso
-_Last updated: 2026-08-03T19:59:53.029Z_
+_Last updated: 2026-08-19T04:13:13.429Z_
### Affected
diff --git a/content/projects/ranger/_index.md b/content/projects/ranger/_index.md
index d2a2ac86..5e747ed6 100644
--- a/content/projects/ranger/_index.md
+++ b/content/projects/ranger/_index.md
@@ -266,13 +266,13 @@ _Last updated: 2026-08-10T10:26:31.190Z_
* Andrea Cosentino (finder)
-## Hostname verification bypass in NiFiRegistryClient and NifiClient ## { #CVE-2025-59060 }
+## Hostname verification bypass in NiFiRegistryClient ## { #CVE-2025-59060 }
CVE-2025-59060 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2025-59060) [\[CVE json\]](./CVE-2025-59060.cve.json) [\[OSV json\]](./CVE-2025-59060.osv.json)
-_Last updated: 2026-03-03T10:46:51.061Z_
+_Last updated: 2026-08-21T20:11:10.266Z_
### Affected
diff --git a/content/projects/shindig/_index.md b/content/projects/shindig/_index.md
new file mode 100644
index 00000000..b99a3793
--- /dev/null
+++ b/content/projects/shindig/_index.md
@@ -0,0 +1,40 @@
+---
+title: Apache Shindig security advisories
+description: Security information for Apache Shindig
+layout: single
+---
+
+# Reporting
+
+Do you want disclose a potential security issue for Apache Shindig? Send your report to the [Apache Security Team](mailto:security@apache.org?subject=Shindig).
+
+# Advisories
+
+This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
+{.bg-warning}
+
+## Remote Code Execution via XStream deserialization (OpenSocial REST API) ## { #CVE-2026-66256 }
+
+CVE-2026-66256 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-66256) [\[CVE json\]](./CVE-2026-66256.cve.json) [\[OSV json\]](./CVE-2026-66256.osv.json)
+
+
+
+_Last updated: 2026-08-13T13:53:33.194Z_
+
+### Affected
+
+* Apache Shindig Common through *
+* Apache Shindig Social-Api through *
+
+
+### Description
+
+<p>** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig.</p><p>This issue affects Apache Shindig: all versions.</p><p>Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server.</p><p>As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.</p><p>NOT [...]
+
+### References
+* https://lists.apache.org/thread/opgpnhk149614gx6vcy3lvyjnycw8mkh
+
+
+### Credits
+* Daryle Bourque, Horizon3.ai (finder)
+* Noah King, Horizon3.ai (finder)
diff --git a/content/projects/shiro/_index.md b/content/projects/shiro/_index.md
index ef5f7914..e8ad6453 100644
--- a/content/projects/shiro/_index.md
+++ b/content/projects/shiro/_index.md
@@ -213,7 +213,7 @@ CVE-2026-23903 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-23903) [\[CVE jso
-_Last updated: 2026-02-09T09:26:19.996Z_
+_Last updated: 2026-08-20T03:10:19.598Z_
### Affected
diff --git a/content/projects/skywalking/_index.md b/content/projects/skywalking/_index.md
index 9932271b..72b379d7 100644
--- a/content/projects/skywalking/_index.md
+++ b/content/projects/skywalking/_index.md
@@ -18,6 +18,31 @@ You can read more about the security policy on:
This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
{.bg-warning}
+## SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server ## { #CVE-2026-34884 }
+
+CVE-2026-34884 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-34884) [\[CVE json\]](./CVE-2026-34884.cve.json) [\[OSV json\]](./CVE-2026-34884.osv.json)
+
+
+
+_Last updated: 2026-08-18T03:21:11.514Z_
+
+### Affected
+
+* Apache SkyWalking MCP at 0.1.0
+
+
+### Description
+
+<p></p><div><div>SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP.</div></div><p></p><p>This issue affects Apache SkyWalking MCP: 0.1.0.</p>Users are recommended to upgrade to version 0.2.0, which fixes this issue.
+
+### References
+* https://lists.apache.org/thread/s447p6h5dfr02lx17v27phoksgb8mkkp
+
+
+### Credits
+* Andrea Cosentino <an...@gmail.com> (reporter)
+
+
## Server-Side Request Forgery via SW-URL Header in MCP Server ## { #CVE-2026-34476 }
CVE-2026-34476 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-34476) [\[CVE json\]](./CVE-2026-34476.cve.json) [\[OSV json\]](./CVE-2026-34476.osv.json)
diff --git a/content/projects/struts/_index.md b/content/projects/struts/_index.md
index 58f4bd77..d5ed5b5d 100644
--- a/content/projects/struts/_index.md
+++ b/content/projects/struts/_index.md
@@ -18,6 +18,138 @@ You can read more about the security policy on:
This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
{.bg-warning}
+## Unbounded growth of localized-text caches driven by the request locale ## { #CVE-2026-73635 }
+
+CVE-2026-73635 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-73635) [\[CVE json\]](./CVE-2026-73635.cve.json) [\[OSV json\]](./CVE-2026-73635.osv.json)
+
+
+
+_Last updated: 2026-08-15T10:38:06.706Z_
+
+### Affected
+
+* Apache Struts from 2.0.0 through 2.3.37
+* Apache Struts from 2.5.0 through 2.5.33
+* Apache Struts from 6.0.0 through 6.10.0
+* Apache Struts from 7.0.0 through 7.2.1
+
+
+### Description
+
+Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.<br><br>This issue affects Apache Struts: from 2.0.0 [...]
+
+### References
+* https://cwiki.apache.org/confluence/display/WW/S2-074
+
+
+### Credits
+* Kuniyoshi Noguchi (野口 晋義), (@KuniNogu) (finder)
+
+
+## Unbounded read of a Content Security Policy violation report ## { #CVE-2026-73634 }
+
+CVE-2026-73634 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-73634) [\[CVE json\]](./CVE-2026-73634.cve.json) [\[OSV json\]](./CVE-2026-73634.osv.json)
+
+
+
+_Last updated: 2026-08-15T10:37:36.431Z_
+
+### Affected
+
+* Apache Struts from 6.0.0 through 6.10.0
+* Apache Struts from 7.0.0 through 7.2.1
+
+
+### Description
+
+Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. The core distribution maps no such endpoint by default; applications that do not collect violation reports are not [...]
+
+### References
+* https://cwiki.apache.org/confluence/display/WW/S2-073
+
+
+### Credits
+* Michael Mullins (finder)
+
+
+## Unbounded read of a JSON request body ## { #CVE-2026-73633 }
+
+CVE-2026-73633 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-73633) [\[CVE json\]](./CVE-2026-73633.cve.json) [\[OSV json\]](./CVE-2026-73633.osv.json)
+
+
+
+_Last updated: 2026-08-14T13:48:43.280Z_
+
+### Affected
+
+* Apache Struts from 2.1.8 through 2.3.37
+* Apache Struts from 2.5.0 through 2.5.33
+* Apache Struts from 6.0.0 through 6.10.0
+* Apache Struts from 7.0.0 through 7.2.1
+
+
+### Description
+
+Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. The JSON plugin is an optional component; applications that do not use it, or use it without ena [...]
+
+### References
+* https://cwiki.apache.org/confluence/display/WW/S2-072
+
+
+### Credits
+* Michael Mullins (finder)
+
+
+## Shared serialization state in the JSON plugin ## { #CVE-2026-73632 }
+
+CVE-2026-73632 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-73632) [\[CVE json\]](./CVE-2026-73632.cve.json) [\[OSV json\]](./CVE-2026-73632.osv.json)
+
+
+
+_Last updated: 2026-08-15T10:38:52.132Z_
+
+### Affected
+
+* Apache Struts at 7.2.1
+
+
+### Description
+
+Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.<br><br>This issue affects Apache Struts: 7.2.1.<br><br>Users are recommend [...]
+
+### References
+* https://cwiki.apache.org/confluence/display/WW/S2-071
+
+
+### Credits
+* g0w6y (https://github.com/g0w6y) (finder)
+
+
+## Shared parsing state in the JSON plugin ## { #CVE-2026-73631 }
+
+CVE-2026-73631 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-73631) [\[CVE json\]](./CVE-2026-73631.cve.json) [\[OSV json\]](./CVE-2026-73631.osv.json)
+
+
+
+_Last updated: 2026-08-15T10:38:27.083Z_
+
+### Affected
+
+* Apache Struts at 7.2.1
+
+
+### Description
+
+Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intended. Populating actions from a JSON request body is not enabled by default; applications that do not use the JSON plugin are not affected.<br><br>This issue affects Apache Struts: 7.2.1.<br><br>Use [...]
+
+### References
+* https://cwiki.apache.org/confluence/display/WW/S2-070
+
+
+### Credits
+* g0w6y (https://github.com/g0w6y) (finder)
+
+
## XXE vulnerability in outdated XWork component ## { #CVE-2025-68493 }
CVE-2025-68493 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2025-68493) [\[CVE json\]](./CVE-2025-68493.cve.json) [\[OSV json\]](./CVE-2025-68493.osv.json)
diff --git a/static/projects/airflow/CVE-2026-54183.cve.json b/static/projects/airflow/CVE-2026-54183.cve.json
new file mode 100644
index 00000000..4857baa9
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-54183.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Airflow Variables were not masked in the UI for authenticated users",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
+ "lang": "en",
+ "cweId": "CWE-200",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variab [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value thro [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/68422",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-42358",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/z5mrdq6c60f2wyx4cc64cj8nv0dxd9lo",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Omkhar Arasaratnam (@omkhar)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-54183",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-54183.osv.json b/static/projects/airflow/CVE-2026-54183.osv.json
new file mode 100644
index 00000000..4050ecd8
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-54183.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-54183", "summary": "Airflow Variables were not masked in the UI for authenticated users", "details": "Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is l [...]
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-58076.cve.json b/static/projects/airflow/CVE-2026-58076.cve.json
new file mode 100644
index 00000000..5590c589
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-58076.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-502: Deserialization of Untrusted Data",
+ "lang": "en",
+ "cweId": "CWE-502",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "3.0.0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example `subprocess.check_output`, or `builtins.eval` on the `b [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example `subprocess.check_output`, or `builtins.e [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/68511",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-33264",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/t81p688t15jozxsng8521o60nh2kfsos",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Jan Kahmen (turingpoint), GitHub: @kah-ja",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-58076",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-58076.osv.json b/static/projects/airflow/CVE-2026-58076.osv.json
new file mode 100644
index 00000000..8783fe42
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-58076.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-58076", "summary": "Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server", "details": "Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operato [...]
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-59242.cve.json b/static/projects/airflow/CVE-2026-59242.cve.json
new file mode 100644
index 00000000..19194b55
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-59242.cve.json
@@ -0,0 +1,102 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-502: Deserialization of Untrusted Data",
+ "lang": "en",
+ "cweId": "CWE-502",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with `deserialize=true` triggers the unsafe instantiatio [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with `deserialize=true` triggers the unsafe ins [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/69378",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/dm0520yhh4mn7qknyoh45r2w6c5qg2mg",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "localhost-detect (@localhost-detect)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59242",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-59242.osv.json b/static/projects/airflow/CVE-2026-59242.osv.json
new file mode 100644
index 00000000..b73970a5
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-59242.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59242", "summary": "Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint", "details": "Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the [...]
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-59244.cve.json b/static/projects/airflow/CVE-2026-59244.cve.json
new file mode 100644
index 00000000..e98edb16
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-59244.cve.json
@@ -0,0 +1,102 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-312: Cleartext Storage of Sensitive Information",
+ "lang": "en",
+ "cweId": "CWE-312",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI \u2014 the dict value failed an `isinstance(str)` guard \u2014 so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI \u2014 the dict value failed an `isinstance(str)` guard \u2014 so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values r [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/68975",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Juan Pablo Guereca (@jpgerek)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Juan Pablo Guereca (@jpgerek)",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59244",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-59244.osv.json b/static/projects/airflow/CVE-2026-59244.osv.json
new file mode 100644
index 00000000..00d52f53
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-59244.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59244", "summary": "Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI", "details": "Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendere [...]
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-65017.cve.json b/static/projects/airflow/CVE-2026-65017.cve.json
new file mode 100644
index 00000000..61ca3061
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-65017.cve.json
@@ -0,0 +1,114 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
+ "lang": "en",
+ "cweId": "CWE-200",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "3.3.0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access \u2014 with no prior access to the secret \u2014 could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker m [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access \u2014 with no prior access to the secret \u2014 could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70755",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-48828",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-48892",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Andrew Rukin (Arenadata)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-65017",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-65017.osv.json b/static/projects/airflow/CVE-2026-65017.osv.json
new file mode 100644
index 00000000..f0642313
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-65017.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-65017", "summary": "Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)", "details": "Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Cel [...]
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-67260.cve.json b/static/projects/airflow/CVE-2026-67260.cve.json
new file mode 100644
index 00000000..5f71fa48
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-67260.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-502: Deserialization of Untrusted Data",
+ "lang": "en",
+ "cweId": "CWE-502",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "3.3.0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author \u2014 who controls that value through the task execution API \u2014 can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author \u2014 who controls that value through the task execution API \u2014 can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70685",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-58076",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/vygr0fh82cjzjp5k4vtfmboxryvm3lyn",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Erik Villegas (GitHub: @erik-451)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-67260",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-67260.osv.json b/static/projects/airflow/CVE-2026-67260.osv.json
new file mode 100644
index 00000000..418cd9f2
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-67260.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-67260", "summary": "DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization", "details": "Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module [...]
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-67587.cve.json b/static/projects/airflow/CVE-2026-67587.cve.json
new file mode 100644
index 00000000..fb7092a2
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-67587.cve.json
@@ -0,0 +1,114 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-502: Deserialization of Untrusted Data",
+ "lang": "en",
+ "cweId": "CWE-502",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "3.3.0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does not help. A Dag author \u2014 who controls a task instance's `next_kwargs` through the task execution API \u2014 can therefore cause an arbitrary module to [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does not help. A Dag author \u2014 who controls a task instance's `next_kwargs` through the task execution API \u2014 can therefore cause an arbitr [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70704",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-58076",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-67260",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/o00ww4n69qojvsckb464dtwd2nhzy6t0",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Nguyen Van Hiep (@hypnguyen1209), MBBank",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-67587",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-67587.osv.json b/static/projects/airflow/CVE-2026-67587.osv.json
new file mode 100644
index 00000000..b114e5b1
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-67587.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-67587", "summary": "DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget", "details": "Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does no [...]
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68076.cve.json b/static/projects/airflow/CVE-2026-68076.cve.json
new file mode 100644
index 00000000..f1118a2c
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68076.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Connections test API: team-scope guard bypass resolves another team's environment Connection",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
+ "lang": "en",
+ "cweId": "CWE-639",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored `AIRFLOW_CONN__<TEAM>___<ID>` variable regardle [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored `AIRFLOW_CONN__<TEAM>___< [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70736",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://github.com/apache/airflow/pull/70902",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/v4mc51dgmrc1t82mhzsngsgzo2gxsf2l",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Andrew Rukin (Arenadata)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68076",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68076.osv.json b/static/projects/airflow/CVE-2026-68076.osv.json
new file mode 100644
index 00000000..366148a1
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68076.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68076", "summary": "Connections test API: team-scope guard bypass resolves another team's environment Connection", "details": "Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When th [...]
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68868.cve.json b/static/projects/airflow/CVE-2026-68868.cve.json
new file mode 100644
index 00000000..0d76a4e1
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68868.cve.json
@@ -0,0 +1,102 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-1220: Insufficient Granularity of Access Control",
+ "lang": "en",
+ "cweId": "CWE-1220",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow Google provider",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow-providers-google",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "22.3.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Varia [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70869",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/03h5y0fmqlh0yf055zlocxh591ozx69x",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Apache Airflow security team",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68868",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68868.osv.json b/static/projects/airflow/CVE-2026-68868.osv.json
new file mode 100644
index 00000000..1e3c2c36
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68868.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68868", "summary": "google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables", "details": "The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secr [...]
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68870.cve.json b/static/projects/airflow/CVE-2026-68870.cve.json
new file mode 100644
index 00000000..3f5e3120
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68870.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
+ "lang": "en",
+ "cweId": "CWE-639",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow Microsoft Azure provider",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow-providers-microsoft-azure",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "14.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enablin [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70876",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://github.com/apache/airflow/pull/70899",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/dtkk6vtfoj1y4zjyd6s3mzg0v5g9yg0p",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Apache Airflow security team",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68870",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68870.osv.json b/static/projects/airflow/CVE-2026-68870.osv.json
new file mode 100644
index 00000000..46f2a4fe
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68870.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68870", "summary": "microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable", "details": "The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belong [...]
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68871.cve.json b/static/projects/airflow/CVE-2026-68871.cve.json
new file mode 100644
index 00000000..6387c56a
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68871.cve.json
@@ -0,0 +1,102 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
+ "lang": "en",
+ "cweId": "CWE-639",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow Yandex provider",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow-providers-yandex",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "4.5.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-te [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond ena [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70877",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/jlj9tv085txk4t0j029mvh43mz89o63c",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Apache Airflow security team",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68871",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68871.osv.json b/static/projects/airflow/CVE-2026-68871.osv.json
new file mode 100644
index 00000000..9fad10d4
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68871.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68871", "summary": "yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable", "details": "The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team b [...]
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68872.cve.json b/static/projects/airflow/CVE-2026-68872.cve.json
new file mode 100644
index 00000000..bb44af2c
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68872.cve.json
@@ -0,0 +1,102 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
+ "lang": "en",
+ "cweId": "CWE-639",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow Amazon provider",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow-providers-amazon",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "9.34.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70878",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/9nd31g40rd2zpgwwymskvjpfq1xnmllg",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Apache Airflow security team",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68872",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68872.osv.json b/static/projects/airflow/CVE-2026-68872.osv.json
new file mode 100644
index 00000000..9bb63648
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68872.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68872", "summary": "amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable", "details": "The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team [...]
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68968.cve.json b/static/projects/airflow/CVE-2026-68968.cve.json
new file mode 100644
index 00000000..2745748d
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68968.cve.json
@@ -0,0 +1,102 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Authorization bypass in the Backfill API through conflicting interpretations of the backfill id",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-436: Interpretation Conflict",
+ "lang": "en",
+ "cweId": "CWE-436",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic's `NonNegativeInt`, which accepts values `int()` rejects (`1.0` coerces to `1`); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An authenticated user holding edit permission on an [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic's `NonNegativeInt`, which accepts values `int()` rejects (`1.0` coerces to `1`); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An authenticated user holding edit pe [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70889",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/f9zmw6xs5b4syhwzbl6fsxm4kf2632ol",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ },
+ {
+ "lang": "en",
+ "value": "Harish Kolla (@Har1sh-k)",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68968",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68968.osv.json b/static/projects/airflow/CVE-2026-68968.osv.json
new file mode 100644
index 00000000..dfcf637d
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68968.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68968", "summary": "Authorization bypass in the Backfill API through conflicting interpretations of the backfill id", "details": "Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic's `NonNegativeInt`, which accepts values `int()` rejects (`1.0` coerces [...]
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68969.cve.json b/static/projects/airflow/CVE-2026-68969.cve.json
new file mode 100644
index 00000000..49aed1b3
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68969.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Bulk Variable and Connection endpoints record secret values in the audit log in cleartext",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-532: Insertion of Sensitive Information into Log File",
+ "lang": "en",
+ "cweId": "CWE-532",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at a [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70890",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-50204",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/p3jr90jgp2brto4vwcrx680f3x11y70c",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ },
+ {
+ "lang": "en",
+ "value": "Harish Kolla (@Har1sh-k)",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68969",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68969.osv.json b/static/projects/airflow/CVE-2026-68969.osv.json
new file mode 100644
index 00000000..f1b30c2e
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68969.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68969", "summary": "Bulk Variable and Connection endpoints record secret values in the audit log in cleartext", "details": "Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels [...]
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68970.cve.json b/static/projects/airflow/CVE-2026-68970.cve.json
new file mode 100644
index 00000000..b7d8587f
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68970.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-312: Cleartext Storage of Sensitive Information",
+ "lang": "en",
+ "cweId": "CWE-312",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover t [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70891",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-59244",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/kkrlnbsk47oght4h38mcd3h2kcb8dt28",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Raphael Zanarelli (@zanarellidev)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68970",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68970.osv.json b/static/projects/airflow/CVE-2026-68970.osv.json
new file mode 100644
index 00000000..3861f64e
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68970.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68970", "summary": "Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI", "details": "Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was ret [...]
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68971.cve.json b/static/projects/airflow/CVE-2026-68971.cve.json
new file mode 100644
index 00000000..ef68c887
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68971.cve.json
@@ -0,0 +1,102 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Cross-team authorization bypass in the asset materialization and dag-run result endpoints",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-862: Missing Authorization",
+ "lang": "en",
+ "cweId": "CWE-862",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that field -- the Keycloak auth manager, for example, checks the `DAG` resource instead of `DAG:<team>` -- so the team-scoped permission that should gate th [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that field -- the Keycloak auth manager, for example, checks the `DAG` resource instead of `DAG:<team>` -- so the team-scoped permission that [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70893",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/kfxqqwgojdjdnt6bxg3ord4y41y334fo",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "@haoxucu",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68971",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/airflow/CVE-2026-68971.osv.json b/static/projects/airflow/CVE-2026-68971.osv.json
new file mode 100644
index 00000000..192660ca
--- /dev/null
+++ b/static/projects/airflow/CVE-2026-68971.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68971", "summary": "Cross-team authorization bypass in the asset materialization and dag-run result endpoints", "details": "Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that fie [...]
\ No newline at end of file
diff --git a/static/projects/allura/CVE-2026-69223.cve.json b/static/projects/allura/CVE-2026-69223.cve.json
new file mode 100644
index 00000000..51c3b509
--- /dev/null
+++ b/static/projects/allura/CVE-2026-69223.cve.json
@@ -0,0 +1,85 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Server-side request forgery",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-918 Server-Side Request Forgery (SSRF)",
+ "lang": "en",
+ "cweId": "CWE-918",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "INTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Allura",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "1.19.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Allura's webhooks are vulnerable to\u00a0Server-Side Request Forgery (SSRF).\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://allura.apache.org/posts/2026-allura-1.19.1.html"
+ },
+ {
+ "url": "https://lists.apache.org/thread/9xpltfm6nombd7rdrx5o0hh8kxmm82pb",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-69223",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/allura/CVE-2026-69223.osv.json b/static/projects/allura/CVE-2026-69223.osv.json
new file mode 100644
index 00000000..5271e165
--- /dev/null
+++ b/static/projects/allura/CVE-2026-69223.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-69223", "summary": "Server-side request forgery", "details": "Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "1.19.1"}]}]}], "references": [{"type": "WEB", "url": "https://allura.apache.org/posts/20 [...]
\ No newline at end of file
diff --git a/static/projects/allura/CVE-2026-73237.cve.json b/static/projects/allura/CVE-2026-73237.cve.json
new file mode 100644
index 00000000..9cf7b382
--- /dev/null
+++ b/static/projects/allura/CVE-2026-73237.cve.json
@@ -0,0 +1,85 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "XSS in markdown pipeline",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
+ "lang": "en",
+ "cweId": "CWE-80",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Allura",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "1.10.0",
+ "lessThan": "1.19.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "XSS vulnerability in Markdown handling in Apache Allura.\n\nThis issue affects Apache Allura: from 1.10.0 before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>XSS vulnerability in Markdown handling in Apache Allura.</p><p>This issue affects Apache Allura: from 1.10.0 before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://allura.apache.org/posts/2026-allura-1.19.1.html"
+ },
+ {
+ "url": "https://lists.apache.org/thread/p7bd1yz9v9wbsbc6hz3tjxozxnwyzqz0",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "critical"
+ }
+ }
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-73237",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/allura/CVE-2026-73237.osv.json b/static/projects/allura/CVE-2026-73237.osv.json
new file mode 100644
index 00000000..17c4974d
--- /dev/null
+++ b/static/projects/allura/CVE-2026-73237.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-73237", "summary": "XSS in markdown pipeline", "details": "XSS vulnerability in Markdown handling in Apache Allura.\n\nThis issue affects Apache Allura: from 1.10.0 before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "1.10.0"}, {"fixed": "1.19.1"}]}]}], "references": [{"type": "WEB", "url": "https://allura.apache.org/posts/2026-allur [...]
\ No newline at end of file
diff --git a/static/projects/allura/CVE-2026-73238.cve.json b/static/projects/allura/CVE-2026-73238.cve.json
new file mode 100644
index 00000000..cb533cd0
--- /dev/null
+++ b/static/projects/allura/CVE-2026-73238.cve.json
@@ -0,0 +1,85 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "XSS in code display",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
+ "lang": "en",
+ "cweId": "CWE-80",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Allura",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "1.19.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "XSS vulnerability in code display in Apache Allura.\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>XSS vulnerability in code display in Apache Allura.</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://allura.apache.org/posts/2026-allura-1.19.1.html"
+ },
+ {
+ "url": "https://lists.apache.org/thread/bbzhnvqlwvwbprnfg4g41s8wkc5bdfmk",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "critical"
+ }
+ }
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-73238",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/allura/CVE-2026-73238.osv.json b/static/projects/allura/CVE-2026-73238.osv.json
new file mode 100644
index 00000000..0550c455
--- /dev/null
+++ b/static/projects/allura/CVE-2026-73238.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-73238", "summary": "XSS in code display", "details": "XSS vulnerability in code display in Apache Allura.\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "1.19.1"}]}]}], "references": [{"type": "WEB", "url": "https://allura.apache.org/posts/2026-allura-1.19.1.html"}, {"type": " [...]
\ No newline at end of file
diff --git a/static/projects/allura/CVE-2026-73239.cve.json b/static/projects/allura/CVE-2026-73239.cve.json
new file mode 100644
index 00000000..df1e5d50
--- /dev/null
+++ b/static/projects/allura/CVE-2026-73239.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Missing permission checks IDOR",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-280 Improper Handling of Insufficient Permissions or Privileges",
+ "lang": "en",
+ "cweId": "CWE-280",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
+ "lang": "en",
+ "cweId": "CWE-639",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Allura",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "1.19.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types\u00a0in Apache Allura.\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://allura.apache.org/posts/2026-allura-1.19.1.html"
+ },
+ {
+ "url": "https://lists.apache.org/thread/ryn6yomo897d43ovrd47g02t8ycmbxb3",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-73239",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/allura/CVE-2026-73239.osv.json b/static/projects/allura/CVE-2026-73239.osv.json
new file mode 100644
index 00000000..68e82c96
--- /dev/null
+++ b/static/projects/allura/CVE-2026-73239.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-73239", "summary": "Missing permission checks IDOR", "details": "Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "1.19.1"}]}]}], "references": [{"type": "WEB", [...]
\ No newline at end of file
diff --git a/static/projects/allura/CVE-2026-73240.cve.json b/static/projects/allura/CVE-2026-73240.cve.json
new file mode 100644
index 00000000..30eab643
--- /dev/null
+++ b/static/projects/allura/CVE-2026-73240.cve.json
@@ -0,0 +1,85 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Git command injection",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')",
+ "lang": "en",
+ "cweId": "CWE-88",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Allura",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "1.19.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Specifically crafted inputs may lead to git argument injection in Apache Allura.\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Specifically crafted inputs may lead to git argument injection in Apache Allura.</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://allura.apache.org/posts/2026-allura-1.19.1.html"
+ },
+ {
+ "url": "https://lists.apache.org/thread/10gnxblhomk2z4gxcyyb4t3p4zxsdddv",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-73240",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/allura/CVE-2026-73240.osv.json b/static/projects/allura/CVE-2026-73240.osv.json
new file mode 100644
index 00000000..9e681a45
--- /dev/null
+++ b/static/projects/allura/CVE-2026-73240.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-73240", "summary": "Git command injection", "details": "Specifically crafted inputs may lead to git argument injection in Apache Allura.\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "1.19.1"}]}]}], "references": [{"type": "WEB", "url": "https://allura.apache.org/posts/2026-a [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-47359.cve.json b/static/projects/cloudstack/CVE-2026-47359.cve.json
new file mode 100644
index 00000000..13a70929
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-47359.cve.json
@@ -0,0 +1,100 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "OS Command Injection due to unsanitized mount command",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+ "lang": "en",
+ "cweId": "CWE-78",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.20.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin.\u00a0The addBackupRepository API (available since 4.20.0.0) and updateBackupRepository API (introduced in 4.22.0.0) accept unsanitized command options for the backup repository. A malicious operator account can exploit this to inject arbitrary commands that execute on the KVM hypervisor host when any account subseq [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API (available since 4.20.0.0) and updateBackupRepository API (introduced in 4.22.0.0) accept unsanitized command options for the backup repository. A malicious operator account can exploit this to inject arbitrary commands that execute on the KVM hypervisor host when any account [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "\uae40\uc6b0\uc11d <wo...@gmail.com>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-47359",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-47359.osv.json b/static/projects/cloudstack/CVE-2026-47359.osv.json
new file mode 100644
index 00000000..10fa960a
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-47359.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-47359", "summary": "OS Command Injection due to unsanitized mount command", "details": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API (available since 4.20.0.0) and updateBackupRepository API (introduced in 4.22.0.0) accept unsanitized command options for the backup repository. A malicious operator account ca [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-50112.cve.json b/static/projects/cloudstack/CVE-2026-50112.cve.json
new file mode 100644
index 00000000..b04aa588
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-50112.cve.json
@@ -0,0 +1,125 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "RCE and SSRF in direct download, metalink and NFS templates",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+ "lang": "en",
+ "cweId": "CWE-78",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "description": "CWE-918 Server-Side Request Forgery (SSRF)",
+ "lang": "en",
+ "cweId": "CWE-918",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.14.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "SSRF via Metalink Mirror URL Resolution:\n\nAn authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.\n\nRCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads:\n\nAn authenticated CloudStack tenant holding the default User role can execute arbitrar [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p><b>SSRF via Metalink Mirror URL Resolution:</b></p><p>An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.</p><p><b>RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads:</b></p><p>An authenticated CloudStack tenant holding the default [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "critical"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "K",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Samy Ghannad <sa...@samyghannad.com>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Katriel Moses <ka...@gmail.com>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Venkatraman Kumar <ve...@securin.io>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-50112",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-50112.osv.json b/static/projects/cloudstack/CVE-2026-50112.osv.json
new file mode 100644
index 00000000..d0ed079b
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-50112.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-50112", "summary": "RCE and SSRF in direct download, metalink and NFS templates", "details": "SSRF via Metalink Mirror URL Resolution:\n\nAn authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.\n\nRCE on KVM hypervisor via NFS, Metalink files w [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-50222.cve.json b/static/projects/cloudstack/CVE-2026-50222.cve.json
new file mode 100644
index 00000000..a0e6dda9
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-50222.cve.json
@@ -0,0 +1,125 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Improper access control in Userdata reference APIs",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-862 Missing Authorization",
+ "lang": "en",
+ "cweId": "CWE-862",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
+ "lang": "en",
+ "cweId": "CWE-200",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.18.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.\n\nSeveral userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that be [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.</p><p>Several userdata-related APIs in Apache CloudStack, including <code>deleteUserData</code>, <code>linkUserDataToTemplate</code>, <code>resetUserDataForVirtualMachine</code>, <code>deployVirtualMachine</code>, and <code>updateVirtualMachine</code>, exhibit missing or insufficient access control validation, potential [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Bernardo De Marco Gon\u00e7alves <be...@gmail.com>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Yuliang Xiao <xy...@outlook.com>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "George Chen (GitHub: geo-chen)",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "KQ Wu <kq...@163.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-50222",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-50222.osv.json b/static/projects/cloudstack/CVE-2026-50222.osv.json
new file mode 100644
index 00000000..21accc1c
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-50222.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-50222", "summary": "Improper access control in Userdata reference APIs", "details": "Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.\n\nSeveral userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient ac [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-59085.cve.json b/static/projects/cloudstack/CVE-2026-59085.cve.json
new file mode 100644
index 00000000..ae751385
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-59085.cve.json
@@ -0,0 +1,105 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Server-Side Request Forgery (SSRF) vulnerability in webhook module",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-918 Server-Side Request Forgery (SSRF)",
+ "lang": "en",
+ "cweId": "CWE-918",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.20.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests.\n\nThis issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p></p><p>Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests.</p><p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p><p></p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Jonathan Leitschuh <jo...@gmail.com>",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "George Chen (GitHub: geo-chen)",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59085",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-59085.osv.json b/static/projects/cloudstack/CVE-2026-59085.osv.json
new file mode 100644
index 00000000..e8affda5
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-59085.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59085", "summary": "Server-Side Request Forgery (SSRF) vulnerability in webhook module", "details": "Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests.\n\nThis issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.", "affe [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-59654.cve.json b/static/projects/cloudstack/CVE-2026-59654.cve.json
new file mode 100644
index 00000000..fbf958b1
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-59654.cve.json
@@ -0,0 +1,119 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "DoS caused by database connections leak",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-772 Missing Release of Resource after Effective Lifetime",
+ "lang": "en",
+ "cweId": "CWE-772",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.7.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server.\n\nThis issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server.</p><p>This issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended t [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/7cgf37clcpjj4g2hl7rnyoq1th3ht9r4",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV4_0": {
+ "version": "4.0",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "PRESENT",
+ "privilegesRequired": "LOW",
+ "userInteraction": "ACTIVE",
+ "vulnConfidentialityImpact": "NONE",
+ "subConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "vulnAvailabilityImpact": "HIGH",
+ "subAvailabilityImpact": "HIGH",
+ "Safety": "NOT_DEFINED",
+ "Automatable": "NOT_DEFINED",
+ "Recovery": "NOT_DEFINED",
+ "valueDensity": "NOT_DEFINED",
+ "vulnerabilityResponseEffort": "NOT_DEFINED",
+ "providerUrgency": "NOT_DEFINED",
+ "baseSeverity": "MEDIUM",
+ "baseScore": 6.8,
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Henrique Sato <he...@gmail.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59654",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-59654.osv.json b/static/projects/cloudstack/CVE-2026-59654.osv.json
new file mode 100644
index 00000000..7f583427
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-59654.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59654", "summary": "DoS caused by database connections leak", "details": "Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server.\n\nThis issue affects Apache CloudStack: from [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-59655.cve.json b/static/projects/cloudstack/CVE-2026-59655.cve.json
new file mode 100644
index 00000000..24946a2c
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-59655.cve.json
@@ -0,0 +1,100 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Unauthenticated OAuth provider client-secret disclosure",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
+ "lang": "en",
+ "cweId": "CWE-200",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.19.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers.\n\nThis issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers.</p><p>This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Yuliang Xiao <xy...@outlook.com>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Stijn Simons <st...@portofantwerpbruges.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59655",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-59655.osv.json b/static/projects/cloudstack/CVE-2026-59655.osv.json
new file mode 100644
index 00000000..3e319587
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-59655.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59655", "summary": "Unauthenticated OAuth provider client-secret disclosure", "details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers.\n\nThis issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the i [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-59657.cve.json b/static/projects/cloudstack/CVE-2026-59657.cve.json
new file mode 100644
index 00000000..6e239672
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-59657.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Sensitive Information Disclosure via Cleartext Storage in AsyncJob",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-312 Cleartext Storage of Sensitive Information",
+ "lang": "en",
+ "cweId": "CWE-312",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database.\n\nThis issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database.</p><p>This issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Davi Torres <da...@gmail.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59657",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-59657.osv.json b/static/projects/cloudstack/CVE-2026-59657.osv.json
new file mode 100644
index 00000000..faccd8c9
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-59657.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59657", "summary": "Sensitive Information Disclosure via Cleartext Storage in AsyncJob", "details": "Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database.\n\nThis issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.", "affected": [{"ranges" [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-59780.cve.json b/static/projects/cloudstack/CVE-2026-59780.cve.json
new file mode 100644
index 00000000..c0112296
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-59780.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "LDAP provider configuration disclosure",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
+ "lang": "en",
+ "cweId": "CWE-200",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.2.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.\n\n\n\n\n\n\n\n\n\n\n\nLDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to all default roles.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nThis issue affects Apache CloudStack: from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22 [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.</p><p></p><div><div><div><div></div></div></div></div><div><div><div><div><div><div><div><p>LDAP configurations can be listed by any authenticated user with access to the <em>listLdapConfigurations</em> API. By default, this API is available to all default roles.</p></div></div></div></div></div></div></div><p> [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59780",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-59780.osv.json b/static/projects/cloudstack/CVE-2026-59780.osv.json
new file mode 100644
index 00000000..46561e97
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-59780.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59780", "summary": "LDAP provider configuration disclosure", "details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.\n\n\n\n\n\n\n\n\n\n\n\nLDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to all default roles.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nT [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-59799.cve.json b/static/projects/cloudstack/CVE-2026-59799.cve.json
new file mode 100644
index 00000000..01536950
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-59799.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Missing Privilege Check in Two-Factor Authentication Disable Flow",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-269 Improper Privilege Management",
+ "lang": "en",
+ "cweId": "CWE-269",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.18.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow.\n\nThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow.</p><p>This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Erichen <ch...@ict.ac.cn>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59799",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-59799.osv.json b/static/projects/cloudstack/CVE-2026-59799.osv.json
new file mode 100644
index 00000000..88caa685
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-59799.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59799", "summary": "Missing Privilege Check in Two-Factor Authentication Disable Flow", "details": "Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow.\n\nThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-61397.cve.json b/static/projects/cloudstack/CVE-2026-61397.cve.json
new file mode 100644
index 00000000..e8f3bff3
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-61397.cve.json
@@ -0,0 +1,115 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "OAuth2 Token Cross-Request Leak",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
+ "lang": "en",
+ "cweId": "CWE-200",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.19.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration.\n\nThis issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration.</p><p>This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "critical"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Katriel Moses <ka...@gmail.com>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "\"Network and Cloud Laboratory (NaCl) KMITL\" <na...@kmitl.ac.th>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Paratpanu Pechsaman <66...@kmitl.ac.th>",
+ "type": "analyst"
+ },
+ {
+ "lang": "en",
+ "value": "Nutthawat Charoensiriphong <68...@kmitl.ac.th>",
+ "type": "analyst"
+ },
+ {
+ "lang": "en",
+ "value": "Panabordee Panitchakit <68...@kmitl.ac.th>",
+ "type": "analyst"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-61397",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-61397.osv.json b/static/projects/cloudstack/CVE-2026-61397.osv.json
new file mode 100644
index 00000000..9b9d00b3
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-61397.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-61397", "summary": "OAuth2 Token Cross-Request Leak", "details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration.\n\nThis issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue.", "affected": [{"ranges": [ [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-61398.cve.json b/static/projects/cloudstack/CVE-2026-61398.cve.json
new file mode 100644
index 00000000..4c1480a4
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-61398.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-116 Improper Encoding or Escaping of Output",
+ "lang": "en",
+ "cweId": "CWE-116",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.15.1.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality.\n\nThis issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality.</p><p>This issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-61398",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-61398.osv.json b/static/projects/cloudstack/CVE-2026-61398.osv.json
new file mode 100644
index 00000000..65b25467
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-61398.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-61398", "summary": "Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI", "details": "Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality.\n\nThis issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes th [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-61399.cve.json b/static/projects/cloudstack/CVE-2026-61399.cve.json
new file mode 100644
index 00000000..84369e19
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-61399.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-116 Improper Encoding or Escaping of Output",
+ "lang": "en",
+ "cweId": "CWE-116",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.20.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality.\n\nThis issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality.</p><p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-61399",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-61399.osv.json b/static/projects/cloudstack/CVE-2026-61399.osv.json
new file mode 100644
index 00000000..245caf67
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-61399.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-61399", "summary": "Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI", "details": "Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality.\n\nThis issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.", "affected": [{"ra [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-61400.cve.json b/static/projects/cloudstack/CVE-2026-61400.cve.json
new file mode 100644
index 00000000..1833b1f6
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-61400.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Get and Run Diagnostics Command Injection",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')",
+ "lang": "en",
+ "cweId": "CWE-77",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.14.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers.\n\nAn authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers.<br><br>An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-pro [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-61400",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-61400.osv.json b/static/projects/cloudstack/CVE-2026-61400.osv.json
new file mode 100644
index 00000000..eed7eb91
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-61400.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-61400", "summary": "Get and Run Diagnostics Command Injection", "details": "Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers.\n\nAn authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-61422.cve.json b/static/projects/cloudstack/CVE-2026-61422.cve.json
new file mode 100644
index 00000000..ef81cdc0
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-61422.cve.json
@@ -0,0 +1,94 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Authenticated pre-validation SSRF in registerTemplate",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-918 Server-Side Request Forgery (SSRF)",
+ "lang": "en",
+ "cweId": "CWE-918",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality.\n\nWhen registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious template or ISO registration risk, as URL validation still occurs prior to the actual download by the Secondary Stor [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality.<br><br>When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious template or ISO registration risk, as URL validation still occurs prior to the actual download by the Second [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Yuliang Xiao <xy...@outlook.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-61422",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-61422.osv.json b/static/projects/cloudstack/CVE-2026-61422.osv.json
new file mode 100644
index 00000000..9a7fa157
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-61422.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-61422", "summary": "Authenticated pre-validation SSRF in registerTemplate", "details": "Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality.\n\nWhen registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious temp [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-62440.cve.json b/static/projects/cloudstack/CVE-2026-62440.cve.json
new file mode 100644
index 00000000..4f70ab0d
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-62440.cve.json
@@ -0,0 +1,94 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Improper access control in Kubernetes Service (CKS) cluster manipulation",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-284 Improper Access Control",
+ "lang": "en",
+ "cweId": "CWE-284",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes.\n\nThis issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes.</p><p>This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.22.1.1 or later, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "George Chen (GitHub: geo-chen)",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "D0HY30N (GitHub: D0HY30N)",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-62440",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-62440.osv.json b/static/projects/cloudstack/CVE-2026-62440.osv.json
new file mode 100644
index 00000000..6242fa95
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-62440.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-62440", "summary": "Improper access control in Kubernetes Service (CKS) cluster manipulation", "details": "Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes.\n\nThis issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.22.1.1 or later, which fixes th [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-65613.cve.json b/static/projects/cloudstack/CVE-2026-65613.cve.json
new file mode 100644
index 00000000..f7414d1e
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-65613.cve.json
@@ -0,0 +1,105 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Webhook Deliveries Incorrect Access",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
+ "lang": "en",
+ "cweId": "CWE-200",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "description": "CWE-284 Improper Access Control",
+ "lang": "en",
+ "cweId": "CWE-284",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.20.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries.\n\nThis issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries.</p><p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-65613",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-65613.osv.json b/static/projects/cloudstack/CVE-2026-65613.osv.json
new file mode 100644
index 00000000..0d3801e3
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-65613.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-65613", "summary": "Webhook Deliveries Incorrect Access", "details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries.\n\nThis issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.", "affected": [{"ra [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-66721.cve.json b/static/projects/cloudstack/CVE-2026-66721.cve.json
new file mode 100644
index 00000000..9a4ecd3d
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-66721.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Authorization issue with listHostTags for domain admins",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-862 Missing Authorization",
+ "lang": "en",
+ "cweId": "CWE-862",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.12.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Missing authorization issue for domain admins in CloudStack's host tags listing functionality.\n\n\n\n\nDomain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain.\n\n\n\n\nThis issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\n\n\n\n [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<div>Missing authorization issue for domain admins in CloudStack's host tags listing functionality.</div><div><br></div><div>Domain Admins, by default, have permission to call the <code>listHostTags</code> API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain.</div><div><br></div><div>This issue affects Apache CloudStack: from 4.12.0.0 through [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "KQ Wu <kq...@163.com>",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-66721",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-66721.osv.json b/static/projects/cloudstack/CVE-2026-66721.osv.json
new file mode 100644
index 00000000..41cfa40c
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-66721.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-66721", "summary": "Authorization issue with listHostTags for domain admins", "details": "Missing authorization issue for domain admins in CloudStack's host tags listing functionality.\n\n\n\n\nDomain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain.\n\n\n\n\n [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-66722.cve.json b/static/projects/cloudstack/CVE-2026-66722.cve.json
new file mode 100644
index 00000000..d3bd7079
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-66722.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "ProjectRole & ProjectRolePermission authorization issue",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-285 Improper Authorization",
+ "lang": "en",
+ "cweId": "CWE-285",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.15.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack.\n\n\n\n\nA Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the caller is a Domain Admin, without verifying whether the target project belongs to their domain or subdomain. This allows a malicious Domain Admin to tamper with project r [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<div>Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack.</div><div><br></div><div>A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the caller is a Domain Admin, without verifying whether the target project belongs to their domain or subdomain. This allows a malicious Domain Admin [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "KQ Wu <kq...@163.com>",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-66722",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-66722.osv.json b/static/projects/cloudstack/CVE-2026-66722.osv.json
new file mode 100644
index 00000000..f8a0f1f5
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-66722.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-66722", "summary": "ProjectRole & ProjectRolePermission authorization issue", "details": "Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack.\n\n\n\n\nA Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the caller is a Domain Admin, without verifying whether the [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-66797.cve.json b/static/projects/cloudstack/CVE-2026-66797.cve.json
new file mode 100644
index 00000000..13df1f0c
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-66797.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Unauthorised comment creation and disclosure",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-284 Improper Access Control",
+ "lang": "en",
+ "cweId": "CWE-284",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.16.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper access control in CloudStack's annotation functionality allows unauthorized\u00a0comment creation and disclosure.\n\n\n\n\nThe addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID.\n\n\n\n\nThis issue affects Apache Clo [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<div>Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.</div><div><br></div><div>The <code>addAnnotation</code> and <code>listAnnotation</code> APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplyi [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <lu...@exea.pl>",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-66797",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-66797.osv.json b/static/projects/cloudstack/CVE-2026-66797.osv.json
new file mode 100644
index 00000000..5f0a4f13
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-66797.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-66797", "summary": "Unauthorised comment creation and disclosure", "details": "Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.\n\n\n\n\nThe addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments [...]
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-68745.cve.json b/static/projects/cloudstack/CVE-2026-68745.cve.json
new file mode 100644
index 00000000..4f7b4eb2
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-68745.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "SAML2 Signature Validation Silently Skipped for Cert-less IdP",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-347 Improper Verification of Cryptographic Signature",
+ "lang": "en",
+ "cweId": "CWE-347",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.5.2",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures.\n\nUsers are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 and above, which fix this issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures.<br><br>Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 and above, which fi [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Katriel Moses <ka...@gmail.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68745",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/cloudstack/CVE-2026-68745.osv.json b/static/projects/cloudstack/CVE-2026-68745.osv.json
new file mode 100644
index 00000000..5ffc4423
--- /dev/null
+++ b/static/projects/cloudstack/CVE-2026-68745.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68745", "summary": "SAML2 Signature Validation Silently Skipped for Cert-less IdP", "details": "Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on [...]
\ No newline at end of file
diff --git a/static/projects/httpcomponents/CVE-2026-71290.cve.json b/static/projects/httpcomponents/CVE-2026-71290.cve.json
new file mode 100644
index 00000000..d498927b
--- /dev/null
+++ b/static/projects/httpcomponents/CVE-2026-71290.cve.json
@@ -0,0 +1,91 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "TLS hostname verification silently disabled on the async transport (default config, MITM)",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-295 Improper Certificate Validation",
+ "lang": "en",
+ "cweId": "CWE-295",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache HttpComponents Client",
+ "collectionURL": "https://repo.maven.apache.org/maven2/",
+ "packageName": "org.apache.httpcomponents.client5:httpclient5",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "5.4-alpha",
+ "lessThanOrEqual": "5.6.3",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer.\u00a0HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.\u00a0\n\n\nPlease note the classic version of HttpClient is not affected by this vulnerability.\u0 [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. <br></p><p>Please note the classic version of HttpClient is not affected by this vulne [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "n0mi1k",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-71290",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/httpcomponents/CVE-2026-71290.osv.json b/static/projects/httpcomponents/CVE-2026-71290.osv.json
new file mode 100644
index 00000000..dd815116
--- /dev/null
+++ b/static/projects/httpcomponents/CVE-2026-71290.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-71290", "summary": "TLS hostname verification silently disabled on the async transport (default config, MITM)", "details": "Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting [...]
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63015.cve.json b/static/projects/inlong/CVE-2026-63015.cve.json
new file mode 100644
index 00000000..8c149104
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63015.cve.json
@@ -0,0 +1,89 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Non-template responsible persons can view template information",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-400 Uncontrolled Resource Consumption",
+ "lang": "en",
+ "cweId": "CWE-400",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache InLong",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.0.0",
+ "lessThan": "2.4.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Uncontrolled Resource Consumption vulnerability in Apache InLong.\u00a0Non-template responsible persons can view template information.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0\u00a0or cherry-pick [1] to solve it.\n\n[1] \n\n https://github.com/apache/inlong/pull/12093 https://github.com/apache/inlong/pull/11732",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information.</p><p>This issue affects Apache InLong: from 2.0.0 before 2.4.0.</p><p></p><p><span style=\"background-color: var(--wht);\">Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.</span></p><p><span style=\"background-color: rgb(255, 255, 255);\">[1] <a target=\"_blank\" rel=\"nofollow\" href= [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/b7bvsg59bo619rywwpd7tj66rkzz62k4",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Tycho Knight",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-63015",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63015.osv.json b/static/projects/inlong/CVE-2026-63015.osv.json
new file mode 100644
index 00000000..2878bdde
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63015.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-63015", "summary": "Non-template responsible persons can view template information", "details": "Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.\n\n[1] \n\n https://github.com/apache/inlong/pull/12093 https://g [...]
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63016.cve.json b/static/projects/inlong/CVE-2026-63016.cve.json
new file mode 100644
index 00000000..33273c79
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63016.cve.json
@@ -0,0 +1,89 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Ordinary users can create new packages",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-400 Uncontrolled Resource Consumption",
+ "lang": "en",
+ "cweId": "CWE-400",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache InLong",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.0.0",
+ "lessThan": "2.4.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of\u00a0non-official packages.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.\n\n[1] \n\n https://github.com/apache/inlong/pull/12095 https://github.com/apache/inlong/pull/11732",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages.</p><p>This issue affects Apache InLong: from 2.0.0 before 2.4.0.</p><p></p><p><span style=\"background-color: var(--wht);\">Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.</span></p><p><span style=\"background-color: rgb(255, 255, 255);\">[1] <a target=\"_blank\" rel= [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/jmsn2slhqmmw7kt24zqcnw6tyjnrcykp",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Tycho Knight",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-63016",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63016.osv.json b/static/projects/inlong/CVE-2026-63016.osv.json
new file mode 100644
index 00000000..36ea8082
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63016.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-63016", "summary": "Ordinary users can create new packages", "details": "Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.\n\n[1] \n\n https://github.com/apache/inlong/pull/12095 https://gi [...]
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63037.cve.json b/static/projects/inlong/CVE-2026-63037.cve.json
new file mode 100644
index 00000000..a63f0662
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63037.cve.json
@@ -0,0 +1,89 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+ "lang": "en",
+ "cweId": "CWE-89",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache InLong",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.0.0",
+ "lessThan": "2.4.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong.\u00a0This appears to allow SQL injection in the ORDER BY clause against the\nManager backend database.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.\n\n[1]\u00a0 https://github.com/apache/inlong/issues/12079 .",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. <span style=\"background-color: rgb(255, 255, 255);\">This appears to allow SQL injection in the ORDER BY clause against the\nManager backend database.</span></p><p>This issue affects Apache InLong: from 2.0.0 before 2.4.0.</p><p></p><p><span style=\"background-color: var(--wht);\">Users are advised to upgrade to Apache InLong's 2.4.0 or ch [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/po2gvsl30mfjk9cy415hsbzrmqkqpd5r",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "cat dg",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-63037",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63037.osv.json b/static/projects/inlong/CVE-2026-63037.osv.json
new file mode 100644
index 00000000..0eadf07d
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63037.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-63037", "summary": "Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint", "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the\nManager backend database.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2 [...]
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63038.cve.json b/static/projects/inlong/CVE-2026-63038.cve.json
new file mode 100644
index 00000000..e7cc0eaf
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63038.cve.json
@@ -0,0 +1,89 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "SQL Injection via String Concatenation Vulnerability Report",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+ "lang": "en",
+ "cweId": "CWE-89",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache InLong",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.0.0",
+ "lessThan": "2.4.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the\ndbName, tableName, schemaName, and username parameters.\u00a0\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.\n\n[1]\u00a0 https://github.com/apache/inlong/issues/12135 .",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. <span style=\"background-color: rgb(255, 255, 255);\">This allows an attacker to inject arbitrary SQL code through the\ndbName, tableName, schemaName, and username parameters. </span></p><p>This issue affects Apache InLong: from 2.0.0 before 2.4.0.</p><p></p><p><span style=\"background-color: var(--wht);\">Users are advised to upgrade to Apa [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/79w0cfnkhs3hctv8yn861qx3qwlc3p37",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "zhaokaifei",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-63038",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63038.osv.json b/static/projects/inlong/CVE-2026-63038.osv.json
new file mode 100644
index 00000000..ba256083
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63038.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-63038", "summary": "SQL Injection via String Concatenation Vulnerability Report", "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the\ndbName, tableName, schemaName, and username parameters. \n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong [...]
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63039.cve.json b/static/projects/inlong/CVE-2026-63039.cve.json
new file mode 100644
index 00000000..75468a3f
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63039.cve.json
@@ -0,0 +1,89 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+ "lang": "en",
+ "cweId": "CWE-89",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache InLong",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.0.0",
+ "lessThan": "2.4.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject\u00a0the string value into\nthe SQL statement, enabling SQL injection.\n\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.\n\n[1] https://github.com/apache/inlong/pull/12080 .",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. <span style=\"background-color: rgb(255, 255, 255);\">This allows an attacker to inject<span style=\"background-color: rgb(255, 255, 255);\"> the string value into\nthe SQL statement, enabling SQL injection.</span></span><span style=\"background-color: rgb(255, 255, 255);\"><span style=\"background-color: rgb(255, 255, 255);\"><br></span></s [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/wzpsgwcx2hxj025pcml0loxr16kl93qt",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Andrea Cosentino",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-63039",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63039.osv.json b/static/projects/inlong/CVE-2026-63039.osv.json
new file mode 100644
index 00000000..011cded9
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63039.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-63039", "summary": "SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService", "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the string value into\nthe SQL statement, enabling SQL injection.\n\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apach [...]
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63040.cve.json b/static/projects/inlong/CVE-2026-63040.cve.json
new file mode 100644
index 00000000..ea8af72d
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63040.cve.json
@@ -0,0 +1,89 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Missing authorization in StreamSource forceDelete",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-552 Files or Directories Accessible to External Parties",
+ "lang": "en",
+ "cweId": "CWE-552",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache InLong",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.0.0",
+ "lessThan": "2.4.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Files or Directories Accessible to External Parties vulnerability in Apache InLong.\u00a0StreamSource\u00a0performs no authorization\u00a0check, any\u00a0authenticated user can logically delete ALL stream sources.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.\n\n[1]\u00a0 https://github.com/apache/inlong/pull/12145 .",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource <span style=\"background-color: rgb(255, 255, 255);\">performs no </span><span style=\"background-color: rgb(255, 255, 255);\">authorization</span><span style=\"background-color: rgb(255, 255, 255);\"> check, a</span><span style=\"background-color: rgb(255, 255, 255);\">ny </span><span style=\"background-color: rgb(255, 255, 255);\">authenticated [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/sbqrk88cjv3r9rnqfqgn31ox4711offy",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Mingrui Liu",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-63040",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63040.osv.json b/static/projects/inlong/CVE-2026-63040.osv.json
new file mode 100644
index 00000000..ba65685e
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63040.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-63040", "summary": "Missing authorization in StreamSource forceDelete", "details": "Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.\n\n[1] https: [...]
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63042.cve.json b/static/projects/inlong/CVE-2026-63042.cve.json
new file mode 100644
index 00000000..f7a5fde0
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63042.cve.json
@@ -0,0 +1,89 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Missing authorization on DataNode management endpoints",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-552 Files or Directories Accessible to External Parties",
+ "lang": "en",
+ "cweId": "CWE-552",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache InLong",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.0.0",
+ "lessThan": "2.4.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.\n\n[1]\u00a0 https://github.com/apache/inlong/pull/12161 .",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions.</p><p>This issue affects Apache InLong: from 2.0.0 before 2.4.0.</p><p></p><p><span style=\"background-color: var(--wht);\">Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.</span></p><p><span style=\"background-color: rgb(255, 255, 255);\">[1]&n [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/wxs4jfjkoo6rlyovhrx8bo74rfmzwbk7",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "tonghuaroot",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-63042",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63042.osv.json b/static/projects/inlong/CVE-2026-63042.osv.json
new file mode 100644
index 00000000..e6321224
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63042.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-63042", "summary": "Missing authorization on DataNode management endpoints", "details": "Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.\n\n[1] https://githu [...]
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63043.cve.json b/static/projects/inlong/CVE-2026-63043.cve.json
new file mode 100644
index 00000000..59ec2ef2
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63043.cve.json
@@ -0,0 +1,89 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Agent path traversal via unvalidated file source path",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-23 Relative Path Traversal",
+ "lang": "en",
+ "cweId": "CWE-23",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache InLong",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.0.0",
+ "lessThan": "2.4.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Relative Path Traversal vulnerability in Apache InLong.\u00a0Arbitrary file read from the Agent host filesystem.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.\n\n[1]\u00a0 https://github.com/apache/inlong/pull/12146 .",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Relative Path Traversal vulnerability in Apache InLong. <span style=\"background-color: rgb(255, 255, 255);\">Arbitrary file read from the Agent host filesystem.</span></p><p>This issue affects Apache InLong: from 2.0.0 before 2.4.0.</p><p></p><p><span style=\"background-color: var(--wht);\">Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.</span></p><p><span style=\"background-color: rgb(255, 255, 255);\">[1] <a t [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/0ohn861tzd9g7nsosd6oz3of6dvhvqnk",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "dyingman1",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-63043",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63043.osv.json b/static/projects/inlong/CVE-2026-63043.osv.json
new file mode 100644
index 00000000..1fafb37c
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63043.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-63043", "summary": "Agent path traversal via unvalidated file source path", "details": "Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.\n\n[1] https://github.com/apache/inlong/pull/12146 .", "affected": [{"ranges": [{"type": "SEMVE [...]
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63044.cve.json b/static/projects/inlong/CVE-2026-63044.cve.json
new file mode 100644
index 00000000..e1452f25
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63044.cve.json
@@ -0,0 +1,89 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Authenticated SSRF via POST /api/node/testConnection",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-918 Server-Side Request Forgery (SSRF)",
+ "lang": "en",
+ "cweId": "CWE-918",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache InLong",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.0.0",
+ "lessThan": "2.4.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.\u00a0\u00a0Any authenticated\u00a0user (no admin role required) can cause the\u00a0InLong Manager server to make outbound HTTP requests or TCP connections to\narbitrary internal hosts and ports.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.\n\n[1]\u00a0 https://github.com/apache/inlong/pull/12130 .",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. <span style=\"background-color: rgb(255, 255, 255);\"> Any </span><span style=\"background-color: rgb(255, 255, 255);\">authenticated</span><span style=\"background-color: rgb(255, 255, 255);\"> user (no admin role required) can cause the </span><span style=\"background-color: rgb(255, 255, 255);\">InLong Manager server to make outbound HTTP requests or TCP connections to</sp [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/b3rtzssd8hdk0dyq4y6mpdx6jj5ro4g6",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Geo",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-63044",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63044.osv.json b/static/projects/inlong/CVE-2026-63044.osv.json
new file mode 100644
index 00000000..7d08640b
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63044.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-63044", "summary": "Authenticated SSRF via POST /api/node/testConnection", "details": "Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to\narbitrary internal hosts and ports.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2 [...]
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63046.cve.json b/static/projects/inlong/CVE-2026-63046.cve.json
new file mode 100644
index 00000000..2e06c0b1
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63046.cve.json
@@ -0,0 +1,89 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Agent Installer \u2014 Command Injection to RCE via Default Credentials",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')",
+ "lang": "en",
+ "cweId": "CWE-88",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache InLong",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.0.0",
+ "lessThan": "2.4.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong.\u00a0Agent Installer's ModuleManager executes arbitrary shell\ncommands via ExcuteLinux.exeCmd() with no filtering or whitelist\nvalidation. \n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve it.\n\n[1]\u00a0 https://github.com/apache/inlong/pull/1215 [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. <span style=\"background-color: rgb(255, 255, 255);\">Agent Installer's ModuleManager executes arbitrary shell\ncommands via ExcuteLinux.exeCmd() with no filtering or whitelist\nvalidation. </span></p><p>This issue affects Apache InLong: from 2.0.0 before 2.4.0.</p><p></p><p><span style=\"background-color: var(--wht);\">Users are advised to up [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/2pgz70rz9ozfm7vm5c33po3yyspq846y",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "IcySun",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-63046",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/inlong/CVE-2026-63046.osv.json b/static/projects/inlong/CVE-2026-63046.osv.json
new file mode 100644
index 00000000..3fa7469e
--- /dev/null
+++ b/static/projects/inlong/CVE-2026-63046.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-63046", "summary": "Agent Installer — Command Injection to RCE via Default Credentials", "details": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell\ncommands via ExcuteLinux.exeCmd() with no filtering or whitelist\nvalidation. \n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgra [...]
\ No newline at end of file
diff --git a/static/projects/shindig/CVE-2026-66256.cve.json b/static/projects/shindig/CVE-2026-66256.cve.json
new file mode 100644
index 00000000..35a01313
--- /dev/null
+++ b/static/projects/shindig/CVE-2026-66256.cve.json
@@ -0,0 +1,114 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Remote Code Execution via XStream deserialization (OpenSocial REST API)",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-502 Deserialization of Untrusted Data",
+ "lang": "en",
+ "cweId": "CWE-502",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Shindig Common",
+ "collectionURL": "https://repo.maven.apache.org/maven2",
+ "packageName": "org.apache.shindig:shindig-common",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThanOrEqual": "*",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Shindig Social-Api",
+ "collectionURL": "https://repo.maven.apache.org/maven2",
+ "packageName": "org.apache.shindig:shindig-social-api",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThanOrEqual": "*",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig.\n\nThis issue affects Apache Shindig: all versions.\n\nUsers with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig.</p><p>This issue affects Apache Shindig: all versions.</p><p>Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server.</p><p>As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/opgpnhk149614gx6vcy3lvyjnycw8mkh",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Daryle Bourque, Horizon3.ai",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Noah King, Horizon3.ai",
+ "type": "finder"
+ }
+ ],
+ "tags": [
+ "unsupported-when-assigned"
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-66256",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/shindig/CVE-2026-66256.osv.json b/static/projects/shindig/CVE-2026-66256.osv.json
new file mode 100644
index 00000000..c49e3522
--- /dev/null
+++ b/static/projects/shindig/CVE-2026-66256.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-66256", "summary": "Remote Code Execution via XStream deserialization (OpenSocial REST API)", "details": "** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig.\n\nThis issue affects Apache Shindig: all versions.\n\nUsers with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server.\n\nAs this project is retired, we do not plan to release a [...]
\ No newline at end of file
diff --git a/static/projects/skywalking/CVE-2026-34884.cve.json b/static/projects/skywalking/CVE-2026-34884.cve.json
new file mode 100644
index 00000000..f8acf1d8
--- /dev/null
+++ b/static/projects/skywalking/CVE-2026-34884.cve.json
@@ -0,0 +1,88 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-918 Server-Side Request Forgery (SSRF)",
+ "lang": "en",
+ "cweId": "CWE-918",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache SkyWalking MCP",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP.\n\n\n\n\n\nThis issue affects Apache SkyWalking MCP: 0.1.0.\n\nUsers are recommended to upgrade to version 0.2.0, which fixes this issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p></p><div><div>SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP.</div></div><p></p><p>This issue affects Apache SkyWalking MCP: 0.1.0.</p>Users are recommended to upgrade to version 0.2.0, which fixes this issue."
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/s447p6h5dfr02lx17v27phoksgb8mkkp",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Andrea Cosentino <an...@gmail.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-34884",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/skywalking/CVE-2026-34884.osv.json b/static/projects/skywalking/CVE-2026-34884.osv.json
new file mode 100644
index 00000000..f4e6908f
--- /dev/null
+++ b/static/projects/skywalking/CVE-2026-34884.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-34884", "summary": "SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server", "details": "SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP.\n\n\n\n\n\nThis issue affects Apache SkyWalking MCP: 0.1.0.\n\nUsers are recommended to upgrade to version 0.2.0, which fixes this issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0.1.0"}, {"last_a [...]
\ No newline at end of file
diff --git a/static/projects/struts/CVE-2026-73631.cve.json b/static/projects/struts/CVE-2026-73631.cve.json
new file mode 100644
index 00000000..00495888
--- /dev/null
+++ b/static/projects/struts/CVE-2026-73631.cve.json
@@ -0,0 +1,89 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Shared parsing state in the JSON plugin",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-567 Unsynchronized Access to Shared Data in a Multithreaded Context",
+ "lang": "en",
+ "cweId": "CWE-567",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Struts",
+ "packageName": "org.apache.struts:struts2-json-plugin",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "7.2.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intended. Populating actions from a JSON request body is not enabled by default; applications that do not use the JSON plugin are not affected.\n\nThis issue affects Apache Struts: 7 [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intended. Populating actions from a JSON request body is not enabled by default; applications that do not use the JSON plugin are not affected.<br><br>This issue affects Apache S [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://cwiki.apache.org/confluence/display/WW/S2-070",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "g0w6y (https://github.com/g0w6y)",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-73631",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/struts/CVE-2026-73631.osv.json b/static/projects/struts/CVE-2026-73631.osv.json
new file mode 100644
index 00000000..b147284c
--- /dev/null
+++ b/static/projects/struts/CVE-2026-73631.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-73631", "summary": "Shared parsing state in the JSON plugin", "details": "Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intended. Populating actions from a JSON request body is not enabled by default; app [...]
\ No newline at end of file
diff --git a/static/projects/struts/CVE-2026-73632.cve.json b/static/projects/struts/CVE-2026-73632.cve.json
new file mode 100644
index 00000000..473fc8eb
--- /dev/null
+++ b/static/projects/struts/CVE-2026-73632.cve.json
@@ -0,0 +1,89 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Shared serialization state in the JSON plugin",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-567 Unsynchronized Access to Shared Data in a Multithreaded Context",
+ "lang": "en",
+ "cweId": "CWE-567",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Struts",
+ "packageName": "org.apache.struts:struts2-json-plugin",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "7.2.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.\n\nThis issue affects Apache Struts: 7.2.1.\n\nUsers a [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.<br><br>This issue affects Apache Struts: 7.2.1.<br [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://cwiki.apache.org/confluence/display/WW/S2-071",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "g0w6y (https://github.com/g0w6y)",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-73632",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/struts/CVE-2026-73632.osv.json b/static/projects/struts/CVE-2026-73632.osv.json
new file mode 100644
index 00000000..bc5f0fbd
--- /dev/null
+++ b/static/projects/struts/CVE-2026-73632.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-73632", "summary": "Shared serialization state in the JSON plugin", "details": "Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applicat [...]
\ No newline at end of file
diff --git a/static/projects/struts/CVE-2026-73633.cve.json b/static/projects/struts/CVE-2026-73633.cve.json
new file mode 100644
index 00000000..d2f4206b
--- /dev/null
+++ b/static/projects/struts/CVE-2026-73633.cve.json
@@ -0,0 +1,109 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Unbounded read of a JSON request body",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-400 Uncontrolled Resource Consumption",
+ "lang": "en",
+ "cweId": "CWE-400",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Struts",
+ "collectionURL": "https://repo.maven.apache.org/maven2",
+ "packageName": "org.apache.struts:struts2-json-plugin",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.1.8",
+ "lessThanOrEqual": "2.3.37",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "2.5.0",
+ "lessThanOrEqual": "2.5.33",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "6.0.0",
+ "lessThanOrEqual": "6.10.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "7.0.0",
+ "lessThanOrEqual": "7.2.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. The JSON plugin is an optional component; applications that do not use it, o [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. The JSON plugin is an optional component; applications that do not use i [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://cwiki.apache.org/confluence/display/WW/S2-072",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Michael Mullins",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-73633",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/struts/CVE-2026-73633.osv.json b/static/projects/struts/CVE-2026-73633.osv.json
new file mode 100644
index 00000000..466f4461
--- /dev/null
+++ b/static/projects/struts/CVE-2026-73633.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-73633", "summary": "Unbounded read of a JSON request body", "details": "Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does n [...]
\ No newline at end of file
diff --git a/static/projects/struts/CVE-2026-73634.cve.json b/static/projects/struts/CVE-2026-73634.cve.json
new file mode 100644
index 00000000..543c6318
--- /dev/null
+++ b/static/projects/struts/CVE-2026-73634.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Unbounded read of a Content Security Policy violation report",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-400 Uncontrolled Resource Consumption",
+ "lang": "en",
+ "cweId": "CWE-400",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Struts",
+ "packageName": "org.apache.struts:struts2-core",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "6.0.0",
+ "lessThanOrEqual": "6.10.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "7.0.0",
+ "lessThanOrEqual": "7.2.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. The core distribution maps no such endpoint by default; applications that do not collect viola [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. The core distribution maps no such endpoint by default; applications that do not collect v [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://cwiki.apache.org/confluence/display/WW/S2-073",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Michael Mullins",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-73634",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/struts/CVE-2026-73634.osv.json b/static/projects/struts/CVE-2026-73634.osv.json
new file mode 100644
index 00000000..a1fc8277
--- /dev/null
+++ b/static/projects/struts/CVE-2026-73634.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-73634", "summary": "Unbounded read of a Content Security Policy violation report", "details": "Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable [...]
\ No newline at end of file
diff --git a/static/projects/struts/CVE-2026-73635.cve.json b/static/projects/struts/CVE-2026-73635.cve.json
new file mode 100644
index 00000000..9c250829
--- /dev/null
+++ b/static/projects/struts/CVE-2026-73635.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Unbounded growth of localized-text caches driven by the request locale",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
+ "lang": "en",
+ "cweId": "CWE-770",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Struts",
+ "packageName": "org.apache.struts:struts2-core",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.0.0",
+ "lessThanOrEqual": "2.3.37",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "2.5.0",
+ "lessThanOrEqual": "2.5.33",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "6.0.0",
+ "lessThanOrEqual": "6.10.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "7.0.0",
+ "lessThanOrEqual": "7.2.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.\n\nThis issue affects Apache Str [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.<br><br>This issue affects Ap [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://cwiki.apache.org/confluence/display/WW/S2-074",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Kuniyoshi Noguchi (\u91ce\u53e3 \u664b\u7fa9), (@KuniNogu)",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-73635",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/static/projects/struts/CVE-2026-73635.osv.json b/static/projects/struts/CVE-2026-73635.osv.json
new file mode 100644
index 00000000..72e0ab75
--- /dev/null
+++ b/static/projects/struts/CVE-2026-73635.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-73635", "summary": "Unbounded growth of localized-text caches driven by the request locale", "details": "Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java he [...]
\ No newline at end of file