CVE-2025-62402 Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API

API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...

Apache Airflow 安全漏洞

Apache Airflow is a set of open source platforms with the ability to create, manage and monitor workflows from the US Apache Apache Foundation. The platform is characterized by scalability and dynamic monitoring. A security vulnerability exists in Apache Airflow, which stems from the...

CVE-2025-62402: Execution with Unnecessary Privileges

API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...

PT-2025-44367

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.0.5 Description A parameter in the example dag decorator dag was not properly validated, potentially allowing a user of the Airflow UI to redirect the example to a malicious server and execute code on a worke...

PT-2025-44368

Name of the Vulnerable Software and Affected Versions API users affected versions not specified Description The API allows code execution within the context of the api-server through the /api/v2/dagReports endpoint. This occurs when the api-server is deployed in an environment where Dag files are...

EUVD-2023-0022

Malicious code in bioql PyPI...

EUVD-2024-0540

Malicious code in bioql PyPI...

EUVD-2022-7573

Malicious code in bioql PyPI...

EUVD-2023-0438

Malicious code in bioql PyPI...

EUVD-2022-0012

Malicious code in bioql PyPI...

EUVD-2022-0007

Malicious code in bioql PyPI...

EUVD-2023-0018

Malicious code in bioql PyPI...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: octo-sts, kube-vip, docker-credential-ecr-login, php-fpmexporter, gostatsd, confluent-common-docker, terraform-provider-time, vault-benchmark, k8sgpt-operator, cloud-provider-aws, dagdotdev, kubeflow-katib, newrelic-fluent-bit-output, mongodb-kubernetes-operator,...

Malicious code in xs-js-ipld-dag-cbor (npm)

The package xs-js-ipld-dag-cbor was found to contain malicious code...

MAL-2025-39993 Malicious code in xs-js-ipld-dag-cbor (npm)

The package xs-js-ipld-dag-cbor was found to contain malicious code...

CVE-2025-54415

dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files. In versions 0.23.0a8 and below, a high-severity vulnerability has been identified in the cicd.yml workflow within the astronomer/dag-factory GitHub repository. The workflow, specifically when...

CVE-2025-54415

dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files. In versions 0.23.0a8 and below, a high-severity vulnerability has been identified in the cicd.yml workflow within the astronomer/dag-factory GitHub repository. The workflow, specifically when...

CVE-2025-54415 dag-factory's CI/CD Workflow Allows for Repository Takeover and Secret Exfiltration

dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files. In versions 0.23.0a8 and below, a high-severity vulnerability has been identified in the cicd.yml workflow within the astronomer/dag-factory GitHub repository. The workflow, specifically when...

CVE-2025-54415 dag-factory's CI/CD Workflow Allows for Repository Takeover and Secret Exfiltration

dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files. In versions 0.23.0a8 and below, a high-severity vulnerability has been identified in the cicd.yml workflow within the astronomer/dag-factory GitHub repository. The workflow, specifically when...

CVE-2025-54415

CVE-2025-54415 affects the dag-factory project (Apache Airflow) for versions ≤ 0.23.0a8. The vulnerability lies in the cicd.yml workflow configured in the astronomer/dag-factory GitHub repository, which, when triggered by pull_request_target, can be exploited to execute arbitrary code in the GitH...