CLEANSTART-2026-FM11278 Security fixes in spark-operator 2.3.0-r4

Package spark-operator version 2.3.0-r4 fixes 11 vulnerabilities: CVE-2026-39817, CVE-2026-39820, CVE-2026-39826, CVE-2026-39823, CVE-2026-42499...

CLEANSTART-2026-WW94113 Security fixes in spark-operator 2.1.1-r3

Package spark-operator version 2.1.1-r3 fixes 4 vulnerabilities: CVE-2025-68121, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730...

CLEANSTART-2026-OD14993 Security fixes in spark-operator 2.4.0-r4

Package spark-operator version 2.4.0-r4 fixes 11 vulnerabilities: CVE-2026-39817, CVE-2026-39820, CVE-2026-39826, CVE-2026-39823, CVE-2026-42499...

CLEANSTART-2026-AR50437 Security fixes in spark-operator 2.2.1-r4

Package spark-operator version 2.2.1-r4 fixes 11 vulnerabilities: CVE-2026-39817, CVE-2026-39820, CVE-2026-39826, CVE-2026-39823, CVE-2026-42499...

CLEANSTART-2026-QN68353 Security fixes in spark-sc213-jdk17-py312 4.0.3-r0

Package spark-sc213-jdk17-py312 version 4.0.3-r0 fixes 10 vulnerabilities: CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, ghsa-3g76-f9xq-8vp6...

PT-2026-64810

Name of the Vulnerable Software and Affected Versions perwendel spark versions prior to 2.9.5 Description A flaw in the SparkJava component allows remote attackers to trigger symlink following. This occurs within the staticFiles.externalLocation function located in the...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15313 more potentially affected by CVE-2026-59949 via org.lz4:lz4-java (>=1.4, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2026-59949 Source advisory: SNYK:JAVA-ORGLZ4-18313067...

CVE-2026-8152

CVE-2026-8152 affects Unblu Spark. The issue is an open redirect that can be escalated to a DOM-based XSS when deployed with com.unblu.identifier.siteEmbeddedSetup=true, causing injected JavaScript to run in the host app’s origin and gain access to cookies, DOM, and same-origin APIs. This expands...

EUVD-2026-47656

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...

CVE-2026-8152 Unblu Spark Open Redirect leading to DOM-Based XSS

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...

CVE-2026-56741 vulnerabilities

Vulnerabilities for packages: apache-hop-fips, tez, apache-pulsar-fips, kafka-fips, apache-pulsar, spark-fips, spark-kubernetes-operator-fips, apache-nifi, apache-hop, confluent-kafka, kafka, zookeeper-fips, druid, apache-camel-karavan-devmode, hadoop-fips, spark, zookeeper, pinot-fips,...

CVE-2026-56740 vulnerabilities

Vulnerabilities for packages: apache-hop-fips, tez, apache-pulsar-fips, kafka-fips, apache-pulsar, spark-fips, spark-kubernetes-operator-fips, apache-nifi, apache-hop, confluent-kafka, kafka, zookeeper-fips, druid, apache-camel-karavan-devmode, hadoop-fips, spark, zookeeper, pinot-fips,...

CVE-2026-44180

CVE-2026-44180 affects Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be bypassed to run kernels as root by supplying KERNEL_UID/KERNEL_GID values with whitespace. Affected versions: 2.0.0rc1 through

CVE-2026-15183

Multiple input validation vulnerabilities in the Snowflake Spark Connector spark-snowflake versions prior to 3.2.1 can allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect COPY operations to attacker-controlled storage. An...

CVE-2026-15183

The CVE concerns the Snowflake Spark Connector (spark-snowflake) prior to version 3.2.1, where multiple input-validation issues enable attackers to exfiltrate OAuth client credentials, run arbitrary SQL under the connector’s Snowflake role, or redirect COPY operations to attacker-controlled stora...

EUVD-2026-43644

Multiple input validation vulnerabilities in the Snowflake Spark Connector spark-snowflake versions prior to 3.2.1 can allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect COPY operations to attacker-controlled storage. An...

CVE-2026-15183 Input Validation Vulnerabilities in Snowflake Spark Connector

Multiple input validation vulnerabilities in the Snowflake Spark Connector spark-snowflake versions prior to 3.2.1 can allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect COPY operations to attacker-controlled storage. An...

PYSEC-2026-1141 Apache Airflow Spark Provider Improper Input Validation vulnerability

Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to read files on the Airflow server. It is recommended to upgrade to a version that is not affected...

PYSEC-2026-1140 Apache Airflow Spark Provider vulnerable to improper input validation

Apache Software Foundation Apache Airflow Spark Provider before 4.0.1 is vulnerable to improper input validation because the host and schema of JDBC Hook can contain / and ? which is used to denote the end of the field...

PYSEC-2026-770 OS Command Injection in Apache Airflow

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider...