CVE-2026-76187 - apache airflow keycloak provider
If your Airflow installation uses the Keycloak authentication manager and shares the Keycloak realm with other applications, any of those applications can…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachefoundation #CVE #infosec

CVE-2026-76186 - apache airflow keycloak provider
If you run Apache Airflow version 3.3 or newer with the Keycloak authentication add‑on, a user’s login session can be combined with a different person’s…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachefoundation #CVE #infosec

CVE-2026-86462 - apache airflow fab provider
When a password is changed through the admin interface in Apache Airflow's FAB provider, any existing login sessions that use the database for session storage…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachefoundation #CVE #infosec

CVE-2026-82311 - apache airflow fab provider
When a password is changed in Airflow using the FAB authentication manager with database‑backed sessions, existing user sessions are not removed because the…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachefoundation #CVE #infosec

CVE-2026-82435 - apache storm worker
Apache Storm worker nodes accept specially crafted network packets before checking who sent them. An attacker who can reach a worker's port could cause the worker to use…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachefoundation #CVE #infosec

CVE-2026-82431 - apache storm client
If the Storm configuration defines only group restrictions (nimbus.groups) and leaves the user list (nimbus.users) empty, the system does not enforce those group rules.…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachefoundation #CVE #infosec

CVE-2026-82439 - apache storm drpc
The DRPC component of Apache Storm stores each request name forever, even if it is never used again. An attacker can send many fake request names and cause the server to…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachefoundation #CVE #infosec

CVE-2026-82441 - apache storm nimbus
Nimbus in Apache Storm can remove files belonging to other topologies when a job finishes, and a missing file can cause the whole cluster to lose its leader, stopping new…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachefoundation #CVE #infosec

CVE-2026-77051 - apache syncope
In certain versions of Apache Syncope, an admin with proper rights can insert malicious input that makes the system execute any database command. This could let…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachesyncope #apachefoundation #CVE #infosec

CVE-2026-75030 - apache syncope
In Apache Syncope versions up to 3.0.16, 4.0.7, and 4.1.2, an administrator who is only allowed to run tasks can add or remove large numbers of users from…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachesyncope #apachefoundation #CVE #infosec

CVE-2026-73668 - apache syncope
In certain versions of Apache Syncope, an administrator who has rights in one area could use the REST interface to see the full configuration of connectors…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachesyncope #apachefoundation #CVE #infosec

CVE-2026-73370 - apache syncope
Versions of Apache Syncope up to 3.16, 4.0.7, and 4.1.2 may let an administrator use a data‑sync feature to perform actions in parts of the system they are not…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachesyncope #apachefoundation #CVE #infosec

CVE-2026-73470 - apache syncope
In versions of Apache Syncope from 3.0.0-M0 up to 4.1.2, a user who is given delegation rights can grant roles they do not own or that belong to a different…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachesyncope #apachefoundation #CVE #infosec

CVE-2026-73579 - apache syncope
Apache Syncope versions up to 3.0.16, 4.0.7 and 4.1.2 can omit permission checks on certain search queries, allowing users to see information they shouldn’t.…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachesyncope #apachefoundation #CVE #infosec

CVE-2026-82232 - apache syncope
If an administrator with sufficient rights uses the task‑search feature, they can insert specially crafted sorting instructions that cause the system to execute…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachesyncope #apachefoundation #CVE #infosec

CVE-2026-86460 - apache syncope
Versions of Apache Syncope from 3.0.0‑M0 to 3.0.16, 4.0.0‑M0 to 4.0.7, and 4.1.0‑M0 to 4.1.2 let specially formed search queries run commands on the Neo4j…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachesyncope #apachefoundation #CVE #infosec

CVE-2026-87785 - apache syncope
Certain versions of Apache Syncope (3.0.0‑M0 through 3.0.16 and 4.0.0‑M0 through 4.1.2) can expose the settings used to verify internal login tokens. If an…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachesyncope #apachefoundation #CVE #infosec

CVE-2026-87802 - apache syncope
Apache Syncope versions from 3.0.0‑M0 to 4.1.2 can accept forged authentication tokens when OAuth 2.0 is set up without a proper key source. An attacker could…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachesyncope #apachefoundation #CVE #infosec

CVE-2026-77181 - apache syncope
In Apache Syncope versions up to 3.0.16, 4.0.7 and 4.1.2, the system checks the wrong permission when changing a ClientApp, allowing users who can only create a…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachesyncope #apachefoundation #CVE #infosec

CVE-2026-78330 - apache syncope
Versions of Apache Syncope from 3.0.0‑M0 up to 3.0.16, and from 4.0.0‑M0 through 4.1.2, may let an attacker who has a normal user’s login token obtain full…

Too many irrelevant or confusing CVEs? Use stackflag.com

#apachesyncope #apachefoundation #CVE #infosec