CVE Monitor
3.44K subscribers
33.2K links
Download Telegram
{
"Source": "CVE FEED",
"Title": "CVE-2025-27555 - Apache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli",
"Content": "CVE ID : CVE-2025-27555
Published : Feb. 24, 2026, 10:09 a.m. | 19 minutes ago
Description : Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.11.1 or a later version, which addresses this issue. Users who previously used the CLI to set connections should manually delete entries with those connection sensitive values from the log table. This is similar but not the same issue as CVE-2024-50378
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2664 - Out of bounds read vulnerability in grpcfuse kernel module",
"Content": "CVE ID : CVE-2026-2664
Published : Feb. 24, 2026, 10:09 a.m. | 20 minutes ago
Description : An out of bounds read vulnerability in the grpcfuse kernel module present in the Linux VM in Docker Desktop for Windows, Linux and macOS up to version 4.61.0 could allow a local attacker to cause an unspecified impact by writing to /proc/docker entries. The issue has been fixed in Docker Desktop 4.62.0 .
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2024-56373 - Apache Airflow: SSTI to Code Execution in Airflow through Shared DB Information",
"Content": "CVE ID : CVE-2024-56373
Published : Feb. 24, 2026, 10:06 a.m. | 23 minutes ago
Description : DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server (server-side) as a result of a user viewing historical task information.

The functionality responsible for that (log template history) has been disabled by default in 2.11.1 and users should upgrade to Airflow 3 if they want to continue to use log template history. They can also manually modify historical log file names if they want to see historical logs that were generated before the last log template change.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2025-11165 - DotCMS Velocity Sandbox Escape Vulnerability",
"Content": "CVE ID : CVE-2025-11165
Published : Feb. 24, 2026, 9:16 a.m. | 1 hour, 13 minutes ago
Description : A sandbox escape vulnerability exists in dotCMSโ€™s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl.

By dynamically modifying the Velocity engineโ€™s runtime configuration and reinitializing its Uberspect, a malicious actor can remove the introspector.restrict.classes and introspector.restrict.packages protections.

Once these restrictions are cleared, the attacker can access arbitrary Java classes, including java.lang.Runtime, and execute arbitrary system commands under the privileges of the application process (e.g. dotCMS or Tomcat user).
Severity: 9.4 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2024-1524 - A local user can be impersonated when using federated authentication with Silent JIT Provisioning.",
"Content": "CVE ID : CVE-2024-1524
Published : Feb. 24, 2026, 9:16 a.m. | 1 hour, 13 minutes ago
Description : When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk that a local user store user's information may be replaced during the account provisioning process in cases where federated users share the same username as local users.

There will be no impact on your deployment if any of the preconditions mentioned below are not met. Only when all the preconditions mentioned below are fulfilled could a malicious actor associate a targeted local user account with a federated IDP user account that they control.

The Deployment should have:
-An IDP configured for federated authentication with Silent JIT provisioning enabled.

The malicious actor should have:
-A fresh valid user account in the federated IDP that has not been used earlier.
-Knowledge of the username of a valid user in the local IDP.
-An account at the federated IDP matching the targeted local username.
Severity: 7.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2805 - Invalid pointer in the DOM: Core & HTML component",
"Content": "CVE ID : CVE-2026-2805
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : Invalid pointer in the DOM: Core & HTML component. This vulnerability affects Firefox < 148.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2806 - Uninitialized memory in the Graphics: Text component",
"Content": "CVE ID : CVE-2026-2806
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : Uninitialized memory in the Graphics: Text component. This vulnerability affects Firefox < 148.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2807 - Memory safety bugs fixed in Firefox 148 and Thunderbird 148",
"Content": "CVE ID : CVE-2026-2807
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 148.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2796 - JIT miscompilation in the JavaScript: WebAssembly component",
"Content": "CVE ID : CVE-2026-2796
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2797 - Use-after-free in the JavaScript: GC component",
"Content": "CVE ID : CVE-2026-2797
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2798 - Use-after-free in the DOM: Core & HTML component",
"Content": "CVE ID : CVE-2026-2798
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox < 148.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2799 - Use-after-free in the DOM: Core & HTML component",
"Content": "CVE ID : CVE-2026-2799
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox < 148.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2800 - Spoofing issue in the WebAuthn component in Firefox for Android",
"Content": "CVE ID : CVE-2026-2800
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability affects Firefox < 148.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2801 - Incorrect boundary conditions in the JavaScript: WebAssembly component",
"Content": "CVE ID : CVE-2026-2801
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2802 - Race condition in the JavaScript: GC component",
"Content": "CVE ID : CVE-2026-2802
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : Race condition in the JavaScript: GC component. This vulnerability affects Firefox < 148.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2803 - Information disclosure, mitigation bypass in the Settings UI component",
"Content": "CVE ID : CVE-2026-2803
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : Information disclosure, mitigation bypass in the Settings UI component. This vulnerability affects Firefox < 148.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2804 - Use-after-free in the JavaScript: WebAssembly component",
"Content": "CVE ID : CVE-2026-2804
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2795 - Use-after-free in the JavaScript: GC component",
"Content": "CVE ID : CVE-2026-2795
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2787 - Use-after-free in the DOM: Window and Location component",
"Content": "CVE ID : CVE-2026-2787
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : Use-after-free in the DOM: Window and Location component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, and Firefox ESR < 140.8.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2786 - Use-after-free in the JavaScript Engine component",
"Content": "CVE ID : CVE-2026-2786
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 148 and Firefox ESR < 140.8.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น
{
"Source": "CVE FEED",
"Title": "CVE-2026-2789 - Use-after-free in the Graphics: ImageLib component",
"Content": "CVE ID : CVE-2026-2789
Published : Feb. 24, 2026, 2:16 p.m. | 14 minutes ago
Description : Use-after-free in the Graphics: ImageLib component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, and Firefox ESR < 140.8.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "24 Feb 2026",
"Type": "Vulnerability"
}
๐Ÿ”น t.me/cvedetector ๐Ÿ”น