CVE Watch358,897 in full archive

Vulnerabilities exploitable today

358,897in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,665

New KEV · 24H0

Exploit Today ≥ 701,607

Distribution · last window

Critical
2,708
High
11,665
Medium
7,438
Low
683

Filters

Window

Severity

Flags

Vulnerabilities358,881–358,897 · 358,897

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-58076—

—

———Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example `subprocess.check_output`, or `builtins.eval` on the `builtins`-prefixed variant. The code runs in the **Scheduler**, which reconstructs serialized Dags in its normal loop with no request involved, and in the **API server**, on any authenticated read of the Dag such as `GET /api/v2/dags/{dag_id}/details`. Both are components the Airflow security model states must never execute Dag-author code, and both hold the metadata database credentials and the JWT signing secret. No non-default configuration is required. This is a **different sink from CVE-2026-33264**, which covered only the trigger branch of the same deserializer: deployments that upgraded in response to that advisory are still affected through the exception branch and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later, which restricts the imported class to a subclass of `BaseException`.4h CVE-2026-687527.2 HIG

—

———A Project Resource Manager may gain broader administrative privileges under specific conditions.7h CVE-2026-687546.5 MED

—

———A repository publisher without delete permission may modify protected package content under specific conditions.8h CVE-2026-15803—

—

———In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by default.6h CVE-2025-35988—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9h CVE-2025-35977—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9h CVE-2025-32737—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9h CVE-2025-32087—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9h CVE-2025-32084—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9h CVE-2026-687554.3 MED

—

———A bundle writer may create misleading release promotion information under specific conditions.8h CVE-2026-687566.6 MED

—

———A party with write access to stored session data may affect JFrog Artifactory under specific conditions.9h CVE-2026-687577.5 HIG

—

———A user with access to a valid SAML response may impersonate another user under specific conditions.5h CVE-2026-687605.3 MED

—

———An unauthenticated user may bypass authentication under specific cache conditions.6h CVE-2026-732639.9 CRI

—

———Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfig_contains_exec_auth in api/src/backend/api/v1/serializers.py checked only exec blocks, and POST /api/v1/providers/{id}/connection loaded it through config.load_kube_config_from_dict in prowler/providers/kubernetes/kubernetes_provider.py, causing kubernetes-python CommandTokenSource.token to run the attacker-supplied command through subprocess.Popen on the shared worker. This issue is fixed in version 5.36.0.9h CVE-2026-732647.6 HIG

—

———Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/{id}/connection, causing api/src/backend/tasks/jobs/lighthouse_providers.py to send outbound requests, including the API key in the Authorization header, to attacker-controlled or internal endpoints when client.models.list was called. This issue is fixed in version 5.33.1.9h CVE-2025-31943—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9h CVE-2026-732656.5 MED

—

———RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known historical object content. This issue is fixed in version 1.0.0-beta.11.9h