17732 matches found
ansible-inventory-to-ssh-config (>=0.0.2, <=1.0.0) potentially affected by CVE-2023-5115 via ansible (2.10.5)
ansible PYPI version 2.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on ansible and may be impacted: - ansible-inventory-to-ssh-config =0.0.2, =1.0.0 Source cves: CVE-2023-5115 Source advisory: OSV:PYSEC-2026-1120...
mlflow Command Injection vulnerability
with only one user interactiondownload a malicious config, attackers can gain full command execution on the victim system...
PYSEC-2026-1652 mlflow Command Injection vulnerability
with only one user interactiondownload a malicious config, attackers can gain full command execution on the victim system...
Fides Information Disclosure Vulnerability in Config API Endpoint
ImpactThe Fides webserver API allows users to retrieve its configuration using the GET api/v1/config endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the...
PYSEC-2026-1347 Fides Information Disclosure Vulnerability in Config API Endpoint
Impact The Fides webserver API allows users to retrieve its configuration using the GET api/v1/config endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the...
PYSEC-2026-1456 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it
Summary hyper-bump-it reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is used to find files that should be edited. These matched files should be contained within the project root directory, but that is n...
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it
Summaryhyper-bump-it reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is used to find files that should be edited. These matched files should be contained within the project root directory, but that is no...
FaucetSDN Ryu Denial of Service Vulnerability
An issue was discovered in OFPQueueGetConfigReply in parser.py in FaucetSDN Ryu version 4.34, allows remote attackers to cause a denial of service DoS infinite loop...
PYSEC-2026-2087
The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in sensitiveconfigvalues, so the masker did not redact...
PYSEC-2026-2087
The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in sensitiveconfigvalues, so the masker did not redact...
CVE-2026-48892
The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in sensitiveconfigvalues, so the masker did not redact...
CVE-2026-33264
A bug in BaseSerialization.deserialize allowed unrestricted importstring of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossin...
CVE-2026-48892
The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in sensitiveconfigvalues, so the masker did not redact...
CVE-2026-48892
The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like "AIRFLOWSECRETSBACKENDKWARGSECRETID" and "AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID" as synthetic config options whose option names were not in "sensitiveconfigvalues", so the masker did not...
CVE-2026-48892 Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options
The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in sensitiveconfigvalues, so the masker did not redact...
CVE-2026-48892 Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options
The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in sensitiveconfigvalues, so the masker did not redact...
CVE-2026-48892
The Config API in Apache Airflow fails to redact per-key secrets-backend overrides (e.g., AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID) because these synthetic config options are missing from the sensitive_config_values list. This allows an authenticated UI/API user with Config read permission to r...
CVE-2026-48892 Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options
The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in sensitiveconfigvalues, so the masker did not redact...
SEIKO EPSON printers and scanners Web Config vulnerable to cross-site request forgery
Overview Web Config embedded in multiple printers and scanners provided by SEIKO EPSON CORPORATION contains the following vulnerability. Cross-site request forgery CWE-352 - CVE-2026-58315 Kentaro Ishii of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated...