PT-2026-53372

Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions before 3.1.1...

PT-2026-53373

Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if projects installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if projects installed a...

PT-2026-53370

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it...

PT-2026-53374

Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0...

PT-2026-53371

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider before 5.0.0...

PT-2026-53364

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airfl...

PT-2026-53367

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider...

PT-2026-53601

Impact A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same...

PT-2026-53602

Impact A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same...

PT-2026-53429

Technical Description The OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. A critical vulnerability exists in the build url method. When an OpenAPI...

PT-2026-53376

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0...

airflow-provider-skypilot (0.1.3), autodistill-efficient-yolo-world (>=0.1.0, <=0.1.1) +27 more potentially affected by CVE-2026-13482 via skypilot (>=0.2.2, <=0.13.0)

skypilot PYPI version =0.2.2, =0.1.0, =0.1.2.dev0, =0.24.0, =0.1.1, =0.9.9, =0.9.9rc23, =0.9.9rc23, =0.9.9, =0.9.9, =1.0.2, =0.1.0, =0.1.6, =0.1.7 and more Source cves: CVE-2026-13482 Source advisory: SNYK:PYTHON-SKYPILOT-17675441...

Rocket.Chat: Authentication Bypass via XML Signature Wrapping in SAML SSO

The SAML SSO implementation in Rocket.Chat verified XML signatures but did not bind the validated signature to the samlp:Response or saml:Assertion. As a result, an attacker could submit a wrapped document carrying forged identity attributes alongside a valid signature made by the trusted IdP...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: minio-fips, gitea, flux-source-controller-fips, flux-fips, argo-workflows, keda-fips, skaffold, skaffold-fips, chisel-fips, telegraf, gitlab-workhorse-ce-fips, harbor, gitlab-rails-ce, frankenphp-8.4, zarf, trivy-fips, kubescape-server-fips, flux-source-controller,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: terraform-provider-acme-fips, buildah, gitea, crossplane-provider-aws-elbv2, argo-workflows, crossplane-provider-aws-macie2, keda-fips, crossplane-provider-aws-elasticache, terraform-provider-azapi, chisel-fips, crossplane-provider-aws-cloudwatch-fips, harbor,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: chisel, osv-scanner, glab, chezmoi, age, gh, opentelemetry-collector, fscrypt, fulcio, podman, scorecard, cloud-provider-aws, snyk-cli, syft, terraform-provider-tls, gitlab-runner, apko, dagger, external-dns, istio, kots, nfpm, slsa-verifier,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: chisel, osv-scanner, zot, k3s, flux-source-controller, trivy-operator, kubernetes, kubescape, external-secrets-operator, trivy, loki, opentelemetry-collector, fscrypt, rancher-agent, k9s, containerd, cilium, cilium-cli, kaf, cloud-provider-aws, prometheus-operator,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: zot, k3s, kubernetes, external-secrets-operator, loki, opentelemetry-collector, fscrypt, rancher-agent, podman, containerd, cilium, cilium-cli, kaf, buildah, cloud-provider-aws, prometheus-operator, snyk-cli, kyverno, rancher, kine, kubernetes-dashboard, gitlab-kas,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: osv-scanner, chezmoi, opentelemetry-collector, fscrypt, podman, scorecard, cloud-provider-aws, snyk-cli, syft, apko, dagger, external-dns, istio, kots, nfpm, nerdctl, caddy, gomplate, mattermost, pulumi-language-java, docker-machine-driver-harvester, witness, trivy,...

CVE-2026-56823

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the POST /api/integrations/webhooks/webhookid/ping endpoint fetches the target webhook by primary key alone without verifying that the webhook belongs to the...