GHSA-W6J9-CWV2-H6WQ vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, airflow-core, openstack-glance-2026.1-fips, openstack-heat-2026.1, openstack-horizon-2025.1, openstack-placement-2025.2-fips, superset, openstack-glance-2025.1-fips, openstack-designate-2026.1, openstack-keystone-2025.2-fips,...

CVE-2026-101917 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, airflow-core, openstack-glance-2026.1-fips, openstack-heat-2026.1, openstack-horizon-2025.1, openstack-placement-2025.2-fips, superset, openstack-glance-2025.1-fips, openstack-designate-2026.1, openstack-keystone-2025.2-fips,...

CVE-2026-102274 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, airflow-core, openstack-glance-2026.1-fips, openstack-heat-2026.1, openstack-horizon-2025.1, openstack-placement-2025.2-fips, superset, openstack-glance-2025.1-fips, openstack-designate-2026.1, openstack-keystone-2025.2-fips,...

GHSA-P4G4-X82P-Q773 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, airflow-core, openstack-glance-2026.1-fips, openstack-heat-2026.1, openstack-horizon-2025.1, openstack-placement-2025.2-fips, superset, openstack-glance-2025.1-fips, openstack-designate-2026.1, openstack-keystone-2025.2-fips,...

GHSA-9V7F-9G4P-FFGJ vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, airflow-core, openstack-glance-2026.1-fips, openstack-heat-2026.1, openstack-horizon-2025.1, openstack-placement-2025.2-fips, superset, openstack-glance-2025.1-fips, openstack-designate-2026.1, openstack-keystone-2025.2-fips,...

GHSA-FFC3-869F-JXW9 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, airflow-core, openstack-glance-2026.1-fips, openstack-heat-2026.1, openstack-horizon-2025.1, openstack-placement-2025.2-fips, superset, openstack-glance-2025.1-fips, openstack-designate-2026.1, openstack-keystone-2025.2-fips,...

CVE-2026-102267 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, airflow-core, openstack-glance-2026.1-fips, openstack-heat-2026.1, openstack-horizon-2025.1, openstack-placement-2025.2-fips, superset, openstack-glance-2025.1-fips, openstack-designate-2026.1, openstack-keystone-2025.2-fips,...

CVE-2026-102271 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, airflow-core, openstack-glance-2026.1-fips, openstack-heat-2026.1, openstack-horizon-2025.1, openstack-placement-2025.2-fips, superset, openstack-glance-2025.1-fips, openstack-designate-2026.1, openstack-keystone-2025.2-fips,...

GHSA-2GX3-RCP4-G85Q vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, airflow-core, openstack-glance-2026.1-fips, openstack-heat-2026.1, openstack-horizon-2025.1, openstack-placement-2025.2-fips, superset, openstack-glance-2025.1-fips, openstack-designate-2026.1, openstack-keystone-2025.2-fips,...

CVE-2026-102268 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, airflow-core, openstack-glance-2026.1-fips, openstack-heat-2026.1, openstack-horizon-2025.1, openstack-placement-2025.2-fips, superset, openstack-glance-2025.1-fips, openstack-designate-2026.1, openstack-keystone-2025.2-fips,...

Exposure of Data Element to Wrong Session

Overview Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the GET /api/v2/assets/events endpoint in assets.py, which applies only a global "Assets" resource check via requiresaccessassetmethod="GET" and no per-DAG row filter. A caller with read...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration via the logout endpoint in airflow/apifastapi/coreapi/routes/public/auth.py, which previously read only the token cookie when revoking credentials. A client authenticating with an Authorization: Bearer...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in JWTRefreshMiddleware's caller resolution, which resolves the caller from the session cookie and ignores an accompanying Authorization: Bearer token, inverting the intended precedence of bearer over cookie. An...

GHSA-5P39-CFHJ-2XMP vulnerabilities

Vulnerabilities for packages: wazuh-manager, airflow-core, authentik-fips, py3.14-anyio, localstack, litellm, authentik, wazuh-manager-fips, airflow, open-webui, kserve...

CVE-2026-63374 vulnerabilities

Vulnerabilities for packages: wazuh-manager, airflow-core, authentik-fips, py3.14-anyio, localstack, litellm, authentik, wazuh-manager-fips, airflow, open-webui, kserve...

CVE-2026-64847 vulnerabilities

Vulnerabilities for packages: wazuh-manager, airflow-core, authentik-fips, py3.14-anyio, localstack, litellm, authentik, wazuh-manager-fips, airflow, open-webui, kserve...

GHSA-82R6-8W77-94W6 vulnerabilities

Vulnerabilities for packages: wazuh-manager, airflow-core, authentik-fips, py3.14-anyio, localstack, litellm, authentik, wazuh-manager-fips, airflow, open-webui, kserve...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the deleteassetqueuedevents, deletedagassetqueuedevents, and related queued-events DELETE routes in airflow/apifastapi/coreapi/routes/public/assets.py. An attacker can delete a DAG’s queued asset events by...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the connections/test API endpoint due to improper enforcement of team-scoped access controls. An attacker can access another team's environment connection and authenticate outward usin...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the handling of bulk requests to the PATCH /api/v2/variables and PATCH /api/v2/connections endpoints. An attacker can obtain sensitive secret values in cleartext by accessing the audit...