311 matches found
CVE-2025-66236
Versions of Apache Airflow prior to 3.2.0 lack explicit security requirements and details for the Deployment Manager , which may lead to misconfigurations. The vulnerability stems from a poorly described security model and insufficient details regarding workload isolation and JWT authentication ....
CVE-2025-66236 Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI
Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not clear or explicit enough, even though...
CVE-2025-66236: Insertion of Sensitive Information into Log File
Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not clear or explicit enough, even though...
Apache Airflow 安全漏洞
Apache Airflow is the United States Apache Apache Foundation's set of open source platform with the creation, management and monitoring of workflow functions. The platform is scalable and dynamic monitoring and other features. Apache Airflow has a security bypass vulnerability that stems from...
PT-2026-32366
Name of the Vulnerable Software and Affected Versions Airflow versions prior to 3.2.0 Description Lack of clarity regarding the responsibilities of the Deployment Manager in ensuring secure deployments. Certain assumptions about the security model, workload isolation, and JWT authentication were...
GHSA-R7VR-M4JW-R794 Apache Airflow has an authorization bypass in DagRun wait endpoint
Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security mode...
Apache Airflow has an authorization bypass in DagRun wait endpoint
Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security mode...
PYSEC-2026-21
Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security mode...
CVE-2026-34538
Apache Airflow versions 3.0.0 through 3.1.8 contain an authorization bypass in the DagRun wait endpoint . The vulnerability allows users with only DAG Run read permissions , such as the Viewer role , to access XCom result values . This behavior contradicts the FAB RBAC model , which classifies XC...
ClawLess: A Security Model of AI Agents
Autonomous AI agents powered by Large Language Models can reason, plan, and execute complex tasks, but their ability to autonomously retrieve information and run code introduces significant security risks. Existing approaches attempt to regulate agent behavior through training or prompting, which...
UBUNTU-CVE-2026-3479
DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.getdata has the same security model as open. The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.getdata did...
MGASA-2025-0300 Updated firefox packages fix security vulnerabilities
Race condition in the Graphics component. CVE-2025-13012 Mitigation bypass in the DOM: Core & HTML component. CVE-2025-13013 CVE-2025-13014: Use-after-free in the Audio/Video component. CVE-2025-13014 Spoofing issue in Firefox. CVE-2025-13015 Incorrect boundary conditions in the JavaScript:...
Apple may have to open its walled garden to outside app stores
The UK’s Competition and Markets Authority CMA ruled that both Google and Apple have a "strategic market status." Basically, they have a monopoly over their respective mobile platforms. As a result, Apple may soon be required to allow rival app stores on iPhones—a major shift for the smartphone...
EUVD-2009-3837
Malware in sbrugna...
EUVD-2020-21330
Malware in sbrugna...
EUVD-2003-1511
Malware in sbrugna...
EUVD-2006-4556
Malware in sbrugna...
EUVD-2003-1506
Malware in sbrugna...