PYSEC-2026-273 Apache Airflow Hive Provider Beeline remote code execution with Principal

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it...

PYSEC-2026-271 Apache Airflow Hive Provider vulnerable to code injection

Apache Software Foundation's Apache Airflow Hive Provider before 6.0.0 is vulnerable to improper control of generation of code...

PYSEC-2026-272 Apache Airflow Hive Provider Improper Input Validation vulnerability

Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3...

PYSEC-2026-277 Apache Airflow Google Provider Improper Input Validation vulnerability

Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0...

PYSEC-2026-275 Apache Airflow Sqoop Provider Improper Input Validation vulnerability

Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions before 3.1.1...

PYSEC-2026-276 Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context

Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if projects installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if projects installed a...

PYSEC-2026-532 Sentry's improper authentication on SAML SSO process allows user impersonation

Impact A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same...

PYSEC-2026-267 OS Command Injection in Apache Airflow

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airfl...

PYSEC-2026-270 OS Command Injection in Apache Airflow

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider...

PYSEC-2026-274 Apache Airflow Hive Provider vulnerable to Command Injection

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider before 5.0.0...

PT-2026-53429

Technical Description The OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. A critical vulnerability exists in the build url method. When an OpenAPI...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: coder, gitea-fips, skaffold-fips, terraform, kubevela-fips, mattermost-fips, nerdctl, containerd, fscrypt, argocd-image-updater-fips, kubescape-server, calico-fips, trivy-operator, rancher, vitess, cloudbeat, prometheus, aactl, kyverno-fips, elastic-agent-fips,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-servicenetworking, gitea-fips, ksops, crossplane-provider-aws-s3-fips, crossplane-provider-aws-acm-fips, elastic-agent, crossplane-fips, crossplane-provider-aws-bedrockagent-fips, crossplane-provider-aws-sqs-fips,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: cert-manager, kots, flux-source-controller, nerdctl, k3s, kubernetes-dashboard, cilium-cli, istio, osv-scanner, cloud-provider-aws, kubernetes, flux, helm, trivy, skaffold, zarf, aactl, kaf, flux-image-automation-controller, gitea, k9s, gitlab-kas,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, docker, terragrunt, age, tkn, rancher-machine, terraform-provider-azurerm, buildah, dagger, kaf, scorecard, gitea, external-secrets-operator, pulumi-kubernetes-operator, flux-notification-controller, atlantis, witness, minio, kyvern...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: terragrunt, buildah, dagger, kaf, scorecard, gitea, external-secrets-operator, pulumi-kubernetes-operator, witness, minio, kyverno, snyk-cli, guac, kubescape, gomplate, docker-cli-buildx, kine, cert-manager, kots, openbao, step-kms-plugin, nerdctl, k3s,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: cert-manager, kots, nerdctl, k3s, kubernetes-dashboard, cilium-cli, istio, cloud-provider-aws, kubernetes, flux, helm, buildah, aactl, kaf, opentelemetry-collector, gitlab-kas, prometheus-operator, telegraf, spire-server, zot, fscrypt, containerd, rancher, minio,...

CVE-2026-56823

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the POST /api/integrations/webhooks/webhookid/ping endpoint fetches the target webhook by primary key alone without verifying that the webhook belongs to the...

EUVD-2026-39797

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the POST /api/integrations/webhooks/webhookid/ping endpoint fetches the target webhook by primary key alone without verifying that the webhook belongs to the...

CVE-2026-56823

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the POST /api/integrations/webhooks/webhookid/ping endpoint fetches the target webhook by primary key alone without verifying that the webhook belongs to the...