CVE-2026-48891: Exposure of Sensitive Information to an Unauthorized Actor

A bug in Apache Airflow's /ui/dependencies scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the dep.source and dep.target fields of trigger / sensor dependency entries. An authenticated UI user with...

CVE-2025-54550: Improper Control of Generation of Code

The example examplexcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly...

Malicious code in jz-ui-user (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83849bf539335824cd90b4dfa14f83dd1e644e9cf22805417940ec3b7ad3a7af The package jz-ui-user was found to contain malicious code...

MAL-2025-192818 Malicious code in jz-ui-user (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83849bf539335824cd90b4dfa14f83dd1e644e9cf22805417940ec3b7ad3a7af The package jz-ui-user was found to contain malicious code...

CVE-2025-30473: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Airflow Common SQL Provider. When using the partition clause in SQLTableCheckOperator as parameter which was a recommended pattern, Authenticated UI User could inject arbitrary SQL command...

CVE-2024-2448

An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands into a UI component using a shell command resulting in OS command injection...

CVE-2024-2448: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands into a UI component using a shell command resulting in OS command injection...

VMware vCenter Server Virtual SAN Health Check Remote Code Execution Exploit

This Metasploit module exploits Java unsafe reflection and SSRF in the VMware vCenter Server Virtual SAN Health Check plugin's ProxygenController class to execute code as the vsphere-ui user. See the vendor advisory for affected and patched versions. Tested against VMware vCenter Server 6.7 Updat...