5 matches found
CVE-2026-105330
Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key value that...
CVE-2026-105330
Apache OFBiz versions 24.09.06 and 24.09.07 on all platforms are vulnerable to unauthenticated administrative access due to the use of a hard-coded cryptographic key (CWE-321) in JWT token authentication. An attacker can obtain full administrative access by forging a JWT signed with the factory-d...
PYSEC-2026-8
Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not clear or explicit enough, even though...
CVE-2025-66236: Insertion of Sensitive Information into Log File
Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not clear or explicit enough, even though...
