PYSEC-2026-2084

Apache Airflow's Google provider operators GCSToSFTPOperator and GCSTimeSpanFileTransformOperator joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket...

PYSEC-0000-CVE-2026-49297

Apache Airflow's Google provider operators GCSToSFTPOperator and GCSTimeSpanFileTransformOperator joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket...

CVE-2026-49297

Apache Airflow's Google provider operators GCSToSFTPOperator and GCSTimeSpanFileTransformOperator joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket...

Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library

SummaryThe Azure Storage Encryption library in Java and other languages is vulnerable to a CBC Padding Oracle attack, similar to CVE-2020-8911. The library is not vulnerable to the equivalent of CVE-2020-8912, but only because it currently only supports AES-CBC as encryption mode. SeverityModerat...

PYSEC-2026-784 Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library

Summary The Azure Storage Encryption library in Java and other languages is vulnerable to a CBC Padding Oracle attack, similar to CVE-2020-8911. The library is not vulnerable to the equivalent of CVE-2020-8912, but only because it currently only supports AES-CBC as encryption mode. Severity...

blobxfer (>=1.0.0, <=1.1.0) potentially affected by CVE-2022-30187 via azure-storage-blob (0.37.1)

azure-storage-blob PYPI version 0.37.1 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - blobxfer =1.0.0, =1.1.0 Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-784...

aztk (>=0.9.0, <=0.10.3), azure-cli (>=2.0.2, <=2.0.67) +8 more potentially affected by CVE-2022-30187 via azure-storage-blob (1.3.1)

azure-storage-blob PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - aztk =0.9.0, =2.0.2, =2.1.7, =0.4.4, =1.4.0, =1.0.0.post1, =2.0.66, =2.2.9, =0.4.9, =0.4.12 Source cves: CVE-2022-30187 Sour...

blobxfer (1.1.1) potentially affected by CVE-2022-30187 via azure-storage-blob (1.0.0)

azure-storage-blob PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - blobxfer 1.1.1 Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-784...

altf1be-helpers (2.1.4), amplo (>=0.9.0, <=0.10.1) +127 more potentially affected by CVE-2022-30187 via azure-storage-blob (>=12.0.0b3, <=12.13.0b1)

azure-storage-blob PYPI version =12.0.0b3, =0.9.0, =2020.5.20rc1, =1.0.0b1, =4.0.6, =0.1.0b1, =0.2.5, =1.0.0b1, =0.21.2111.177147b1, =12.0.0b1, =12.0.0b5, =0.2.7, =0.5.0 and more Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-784...

afs2-datasource (>=3.6.0, <=3.8.2), azblobexplorer (>=1.1.1, <=1.1.4) +4 more potentially affected by CVE-2022-30187 via azure-storage-blob (2.0.1)

azure-storage-blob PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - afs2-datasource =3.6.0, =1.1.1, =1.8.0, =0.0.1, =0.5.2.1, =0.5.4.3 - xtlib 0.0.996 Source cves: CVE-2022-30187 Source...

blobxfer (>=1.5.5, <=1.6.0) potentially affected by CVE-2022-30187 via azure-storage-blob (1.4.0)

azure-storage-blob PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - blobxfer =1.5.5, =1.6.0 Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-784...

blobxfer (1.3.1), kfserving (0.2.1.0) potentially affected by CVE-2022-30187 via azure-storage-blob (1.3.0)

azure-storage-blob PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - blobxfer 1.3.1 - kfserving 0.2.1.0 Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-784...

aztk (>=0.7.0b14, <=0.8.1), azure-cli-acr (>=2.0.27, <=2.1.6) +5 more potentially affected by CVE-2022-30187 via azure-storage-blob (1.1.0)

azure-storage-blob PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - aztk =0.7.0b14, =2.0.27, =0.4.1, =1.2.0, =0.0.2, =0.0.3 - saltext-azurerm 1.0.0 - spongeblob 0.1.1 Source cves: CVE-2022-301...

agogosml (>=0.1.1, <=0.1.3), appdaemon (>=4.0.4, <=4.0.5) +40 more potentially affected by CVE-2022-30187 via azure-storage-blob (1.5.0)

azure-storage-blob PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - agogosml =0.1.1, =4.0.4, =0.2.100, =0.2.123, =1.0.0, =0.1.9, =3.0.0, =1.1.0, =2.0.68, =3.2.2, =0.1.0, =1.2.0rc1, =0.95.0,...

adlfs (>=0.1.2, <=0.2.0), airflow-ditto (0.0.1.2) +34 more potentially affected by CVE-2022-30187 via azure-storage-blob (2.1.0)

azure-storage-blob PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - adlfs =0.1.2, =0.0.1, =0.6.0, =1.0.1, =0.1.11, =1.1.5, =0.0.38, =0.1.15, =0.0.3, =0.0.1, =1.9.4, =4.7.0, =0.7.0, =0.7.9 and...

baybars (>=0.0.1, <=0.0.5), blobxfer (>=1.0.0rc1, <=1.0.0rc3) potentially affected by CVE-2022-30187 via azure-storage-blob (0.37.0)

azure-storage-blob PYPI version 0.37.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - baybars =0.0.1, =1.0.0rc1, =1.0.0rc3 Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-784...

PYSEC-2026-891 Openstack cinder Improper handling of ScaleIO backend credentials

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleI...

PYSEC-2026-812 OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service

OpenStack Image Service Glance before 2014.2.4 juno and 2015.1.x before 2015.1.2 kilo allows remote authenticated users to bypass the storage quota and cause a denial of service disk consumption by deleting images that are being uploaded using a token that expires during the process. NOTE: this...

OpenStack Glance Bypass the storage quota and Denial of service

OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause a denial of service disk consumption by deleting an image in the saving state...

PYSEC-2026-881 OpenStack Nova Multiple directory traversal vulnerabilities

Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted 1 tarball or 2 manifest...