CVE Vulnerability Catalog

Apache Airflow before version 3.2.2 has a vulnerability in the partitioned_dag_runs endpoints in the UI, which enforce only asset-level access control, not per-Dag authorization. An authenticated user with global Asset:read permission can enumerate partition run state, schedule configuration, and asset wiring for Dags they are not authorized to read.

A DAG author can use symlinks or `..` sequences in task IDs to read or overwrite arbitrary files outside the configured log folder if the worker log folder is shared with the API server.

SOPlanning version 1.55 and below is vulnerable to CSRF in the groupe_save endpoints (create, modify, delete). An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged request.

SOPlanning version 1.55 and below does not verify uploaded file extensions, allowing an authenticated attacker to upload a crafted ZIP archive containing a malicious file.

SOPlanning version 1.55 and below is vulnerable to Path Traversal in backup endpoints. An authenticated remote attacker can exploit a vulnerable endpoint to read and execute files previously added via the backup functionality. Additionally, due to CVE-2026-40543, any backup file can be read by an unauthorized user.

A Reflected XSS vulnerability in SOPlanning (versions 1.55 and below) via the taches parameter. An attacker can craft a malicious URL which, when opened by an authenticated victim, results in arbitrary JavaScript execution in the victim's browser.

Stored XSS vulnerability in SOPlanning version 1.55 and below. An authenticated attacker can upload a crafted ZIP archive with a malicious user.csv file containing JavaScript, which executes when a user clicks the Edit button.

An SQL injection vulnerability was discovered in itsourcecode Content Management System 1.0. The issue affects the /instructions.php file where the topic_id argument is not properly sanitized. Remote attack is possible and the exploit is publicly available.

In jeecgboot up to version 3.9.1, a server-side request forgery vulnerability exists in the FileDownloadUtils.download2DiskFromNet function of /airag/app/debug. The attack can be performed remotely and the exploit has been released. Version 3.9.2 fixes the issue.

In JeecgBoot up to version 3.9.2, a server-side request forgery vulnerability exists in an unknown function of /airag/airagModel/test. Manipulation of the baseUrl argument allows remote attack. The exploit is publicly available.

In JeecgBoot up to version 3.9.2, a server-side request forgery vulnerability exists in the WordUtil.addImage function of /airag/word/edit. The attack can be performed remotely and the exploit has been publicly disclosed.

SourceCodester Water Billing Management System 1.0 has an SQL injection vulnerability in /admin/?page=user/manage_user via the ID argument.

A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allows an authenticated user with Connection-read permission to retrieve secrets stored in a Connection's `extra` JSON blob under field names not in the redaction allowlist. Affects deployments storing credentials in `extra` blobs and granting Connection-read access to multiple users.

A SQL injection vulnerability was found in CodeAstro Ingredients Stock Management System 1.0 in the file /Ingredients-Stock/stock_manager.php via the txt_search_category argument. The attack can be performed remotely, and the exploit is publicly available.

In Assimp up to version 6.0.4, a vulnerability was found in the function aiNode::~aiNode in file scene.cpp of the ASE File Parser component. Manipulation can lead to use-after-free. The attack requires local access.

In Assimp up to version 6.0.4, a vulnerability was found in the function HL1MDLLoader::extract_anim_value in file HL1MDLLoader.cpp of the Half-Life 1 MDL Loader component. Manipulation of the num.total argument leads to a heap-based buffer overflow. The attack requires local access.

A heap-based buffer overflow in the function Assimp::MDL::HalfLife::HL1MDLLoader::read_animations in Assimp up to version 6.0.4 allows local attackers to cause a crash or potentially execute arbitrary code.

A heap-based buffer overflow in the function HL1MDLLoader::read_meshes in Assimp up to version 6.0.4 allows local attackers to cause a crash or potentially execute arbitrary code.

A vulnerability was detected in NousResearch hermes-agent up to version 2026.4.30. It affects the _handle_webhook_request function in the file gateway/platforms/feishu.py of the Webhook Endpoint component. Manipulation leads to resource consumption. The attack can be launched remotely. The exploit has been publicly disclosed.

A weakness was identified in NousResearch hermes-agent up to version 2026.4.30 in the function _scan_memory_content of file tools/memory_tool.py, allowing remote injection. The exploit has been made public and could be used for attacks. The vendor did not respond.