759 matches found
CVE-2025-54941 Apache Airflow: Command injection in "example_dag_decorator"
An example dag exampledagdecorator had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production not default or the example dag code copied to build your own...
CVE-2025-62402 Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API
API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...
CVE-2025-62402 Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API
API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...
CVE-2025-62402 Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API
API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...
CVE-2025-62402
In Apache Airflow , API users can perform DAG code execution within the context of the api-server via the /api/v2/dagReports interface. This vulnerability occurs if the api-server is deployed in an environment where DAG files are accessible. This flaw can potentially lead to remote code execution...
PT-2025-45771
An example dag example dag decorator had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production not default or the example dag code copied to build your own...
Apache Airflow 安全漏洞
Apache Airflow is a set of open source platforms with the ability to create, manage and monitor workflows from the US Apache Apache Foundation. The platform is characterized by scalability and dynamic monitoring. A security vulnerability exists in Apache Airflow, which stems from the...
CVE-2025-62402: Execution with Unnecessary Privileges
API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...
PT-2025-45649
API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...
PT-2025-44367
Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.0.5 Description A parameter in the example dag decorator dag was not properly validated, potentially allowing a user of the Airflow UI to redirect the example to a malicious server and execute code on a worke...
PT-2025-44368
Name of the Vulnerable Software and Affected Versions API users affected versions not specified Description The API allows code execution within the context of the api-server through the /api/v2/dagReports endpoint. This occurs when the api-server is deployed in an environment where Dag files are...
EUVD-2024-0540
Malicious code in bioql PyPI...
EUVD-2023-0022
Malicious code in bioql PyPI...
EUVD-2023-0438
Malicious code in bioql PyPI...
EUVD-2022-0007
Malicious code in bioql PyPI...
EUVD-2023-0018
Malicious code in bioql PyPI...
EUVD-2022-7573
Malicious code in bioql PyPI...
EUVD-2022-0012
Malicious code in bioql PyPI...
GHSA-GWRF-JF3H-W649 vulnerabilities
Vulnerabilities for packages: addon-resizer, gitsign, terraform-provider-time, kubeflow-katib, secrets-store-csi-driver-provider-aws, blobfuse2, newrelic-nri-statsd, kserve-rest-proxy, git-lfs, k8sgpt-operator, rancher-machine, vault-benchmark, sftpgo-plugin-pubsub,...
