300 matches found
CVE-2025-66236
CVE-2025-66236 concerns Apache Airflow prior to 3.2.0. The OSV/SNYK entries describe that secrets from the Airflow config file could be logged in plain text in the DAG run logs UI, exposing confidential data to users with access to logs (Deployment Manager or privileged readers). Root cause: impr...
Apache Airflow 安全漏洞
Apache Airflow is the United States Apache Apache Foundation's set of open source platform with the creation, management and monitoring of workflow functions. The platform is scalable and dynamic monitoring and other features. Apache Airflow has a security bypass vulnerability that stems from...
PT-2026-32366
Name of the Vulnerable Software and Affected Versions Airflow versions prior to 3.2.0 Description Lack of clarity regarding the responsibilities of the Deployment Manager in ensuring secure deployments. Certain assumptions about the security model, workload isolation, and JWT authentication were...
GHSA-R7VR-M4JW-R794 Apache Airflow has an authorization bypass in DagRun wait endpoint
Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security mode...
Apache Airflow has an authorization bypass in DagRun wait endpoint
Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security mode...
PYSEC-2026-21
Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security mode...
CVE-2026-34538
Apache Airflow CVE-2026-34538 affects 3.0.0–3.1.8 where the DagRun wait endpoint exposes XCom payloads to users with only DAG Run read access (e.g., Viewer), bypassing FAB RBAC protections. Root cause: authorization flaw in the DagRun wait path that reveals XCom results to unauthorized users. Imp...
ClawLess: A Security Model of AI Agents
Autonomous AI agents powered by Large Language Models can reason, plan, and execute complex tasks, but their ability to autonomously retrieve information and run code introduces significant security risks. Existing approaches attempt to regulate agent behavior through training or prompting, which...
UBUNTU-CVE-2026-3479
DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.getdata has the same security model as open. The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.getdata did...
MGASA-2025-0300 Updated firefox packages fix security vulnerabilities
Race condition in the Graphics component. CVE-2025-13012 Mitigation bypass in the DOM: Core & HTML component. CVE-2025-13013 CVE-2025-13014: Use-after-free in the Audio/Video component. CVE-2025-13014 Spoofing issue in Firefox. CVE-2025-13015 Incorrect boundary conditions in the JavaScript:...
Apple may have to open its walled garden to outside app stores
The UK’s Competition and Markets Authority CMA ruled that both Google and Apple have a "strategic market status." Basically, they have a monopoly over their respective mobile platforms. As a result, Apple may soon be required to allow rival app stores on iPhones—a major shift for the smartphone...
EUVD-2003-1511
Malware in sbrugna...
EUVD-2009-3837
Malware in sbrugna...
EUVD-2003-1506
Malware in sbrugna...
EUVD-2020-21330
Malware in sbrugna...
EUVD-2012-3922
Malware in sbrugna...
EUVD-2006-4556
Malware in sbrugna...
EUVD-2023-0494
Malicious code in bioql PyPI...