Sensitive Information Disclosure

Apache Camel Netty HTTP component is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper handling of exception responses, where processing errors return full Java stack traces instead of suppressing them, allowing attackers to obtain sensitive information such as...

PT-2026-71126

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default allowed deserialization classes allow-list, so tightening that...

PT-2026-71138

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The secrets masker in the UI fails to hide values stored under sensitive key names when they are nested inside a list, tuple, or set beyond the recursion-depth limit. This results in Airflow...

PT-2026-71125

Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new awaiting input task state swept by the scheduler. That sweep deserializes the task instance's next kwargs without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an...

TencentOS Server 4: apr-util (TSSA-2026:0830)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0830 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

PT-2026-71139

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The serialization layer fails to restrict the classes imported during the reconstruction of exception nodes. By calling import string on a class name and instantiating it with arguments from a...

PT-2026-71131

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description Sensitive data, including Variable values and Connection extra contents, are written to the audit log in cleartext when submitted via the bulk endpoints PATCH /api/v2/variables and PATCH...

PT-2026-71178

Name of the Vulnerable Software and Affected Versions Apache Allura versions prior to 1.19.1 Description Specifically crafted inputs may lead to git argument injection, a flaw where an attacker can insert unauthorized arguments into a git command executed by the application. Recommendations Upgra...

PT-2026-71177

Name of the Vulnerable Software and Affected Versions Apache Allura versions prior to 1.19.1 Description An Insecure Direct Object Reference IDOR exists due to missing permission checks for multiple Artifact types. IDOR is a type of access control vulnerability that occurs when an application...

PT-2026-71133

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description In deployments using multi-team mode with a team-aware auth manager, the asset materialization endpoint POST /api/v2/assets/asset id/materialize and the XCom result check on wait dag run until...

PT-2026-71132

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The Task SDK fails to mask the contents of a Variable when its JSON value is a list. This occurs because masking is only applied to deserialized values that are strings or dictionaries, leavin...

Apache Tomcat 11.0.23 RewriteValve Authentication Bypass

A proof of concept exploit for an authentication bypass vulnerability in Apache Tomcat version 11.0.23. The vulnerability exists because RewriteValve rebuilds decoded request URIs using java.net.URLDecoder, causing literal plus characters to be interpreted differently during security constraint...

PT-2026-71130

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description An authorization flaw exists in the Backfill API where a discrepancy in how the backfill id path segment is parsed allows an authenticated user with edit permissions on any single Dag to perfo...

PT-2026-71127

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The environment-variable secrets backend incorrectly resolves team-scoped Connections or Variables from the wrong team's scope. This occurs because the security guard intended to prevent this...

PT-2026-71116

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

PT-2026-71140

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description An authenticated API user with XCom write-and-read access can instantiate arbitrary airflow. classes on the API server. This occurs because the GET /api/v2/.../xcomEntries/key?deserialize=true...

PT-2026-71141

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The secrets masker fails to mask var.json Variable values when the value is a dictionary within the Rendered Templates UI. This occurs because the dictionary value fails an isinstancestr guard...

DEBIAN-CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...