CVE-2026-53533 vulnerabilities

Vulnerabilities for packages: airflow-core, airflow...

CVE-2026-69247 vulnerabilities

Vulnerabilities for packages: openstack-glance-2025.1, tritonserver-backend-vllm-cuda-13.0, ggshield, awx, open-webui, mycli, openstack-placement-2025.1, py3-cassandra-medusa, dask-kubernetes-fips, ansible-operator-fips, vast-csi, openstack-keystone-2026.1, mitmproxy, kserve, mlflow, authentik,...

GHSA-MQ44-7P77-Q5H7 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-13.0, awx, open-webui, py3-cassandra-medusa, dask-kubernetes-fips, kserve, py3-vllm-cuda-12.4, airflow-core, puppygraph-python, kserve-models-web-app, airflow, text-generation-inference, py3.13-scanner-test-libraries-aiohttp,...

CLEANSTART-2026-YH06541 Security fixes in airflow-3 3.1.8-r4

Package airflow-3 version 3.1.8-r4 fixes 18 vulnerabilities: ghsa-hpj7-wq8m-9hgp, ghsa-xcgm-r5h9-7989, ghsa-2fqr-mr3j-6wp8, ghsa-4m7w-qmgq-4wj5, ghsa-6jv3-5f52-599m...

CLEANSTART-2026-WL07190 Security fixes in airflow-3 3.1.8-r0

Package airflow-3 version 3.1.8-r0 fixes 70 vulnerabilities: ghsa-79v4-65xg-pq4g, ghsa-r6ph-v2qm-q3c2, ghsa-h4gh-qq45-vh27, ghsa-m959-cc7f-wv43, CVE-2026-26007...

CLEANSTART-2026-KS43633 Security fixes in airflow-3 3.0.6-r1

Package airflow-3 version 3.0.6-r1 fixes 29 vulnerabilities: CVE-2026-25604, CVE-2026-42526, CVE-2026-27173, CVE-2026-41018, CVE-2026-46745...

CLEANSTART-2026-VP41831 Security fixes in airflow-2 2.11.0-r2

Package airflow-2 version 2.11.0-r2 fixes 2 vulnerabilities: CVE-2026-44503, ghsa-7j59-v9qr-6fq9...

CLEANSTART-2026-PZ43099 Security fixes in airflow-3 3.2.1-r4

Package airflow-3 version 3.2.1-r4 fixes 16 vulnerabilities: ghsa-4m7w-qmgq-4wj5, ghsa-9x8q-7h8h-wcw9, ghsa-537c-gmf6-5ccf, ghsa-4xpc-pv4p-pm3w, ghsa-5rvq-cxj2-64vf...

CLEANSTART-2026-CW50457 Security fixes in airflow-3 3.2.0-r0

Package airflow-3 version 3.2.0-r0 fixes 85 vulnerabilities: CVE-2026-44405, CVE-2026-42561, CVE-2026-8838, CVE-2026-41018, CVE-2026-41016...

CLEANSTART-2026-KV57465 Security fixes in airflow-3 3.2.1-r2

Package airflow-3 version 3.2.1-r2 fixes 5 vulnerabilities: CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526...

CLEANSTART-2026-EG70674 Security fixes in airflow-3 3.2.2.-r0

Package airflow-3 version 3.2.2.-r0 fixes 1 vulnerabilities: CVE-2026-45186...

CLEANSTART-2026-MS00856 Security fixes in airflow-3 3.1.8-r3

Package airflow-3 version 3.1.8-r3 fixes 15 vulnerabilities: CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526...

CLEANSTART-2026-BC02149 Security fixes in airflow-3 3.1.8-r6

Package airflow-3 version 3.1.8-r6 fixes 13 vulnerabilities: CVE-2026-53533, CVE-2026-59885, CVE-2026-59886, CVE-2026-59890, CVE-2026-49476...

CLEANSTART-2026-IU24971 Security fixes in airflow-3 3.2.2-r1

Package airflow-3 version 3.2.2-r1 fixes 16 vulnerabilities: CVE-2026-59885, CVE-2026-59886, CVE-2026-59884, CVE-2026-59939, CVE-2026-54590...

CLEANSTART-2026-FU63080 Security fixes in airflow-2 2.10.3-r0

Package airflow-2 version 2.10.3-r0 fixes 2 vulnerabilities: CVE-2026-44503, ghsa-7j59-v9qr-6fq9...

CLEANSTART-2026-IW40229 Security fixes in airflow-3 3.1.8-r5

Package airflow-3 version 3.1.8-r5 fixes 19 vulnerabilities: CVE-2026-42526, CVE-2026-27173, CVE-2026-41018, CVE-2026-46745, CVE-2026-50203...

CLEANSTART-2026-US20993 Security fixes in airflow-2 2.10.3-r3

Package airflow-2 version 2.10.3-r3 fixes 22 vulnerabilities: ghsa-27jp-wm6q-gp25, ghsa-5rvq-cxj2-64vf, ghsa-82w8-qh3p-5jfq, ghsa-wqp7-x3pw-xc5r, ghsa-3x9g-8vmp-wqvf...

CLEANSTART-2026-ER33970 Security fixes in airflow-3 3.2.2-r2

Package airflow-3 version 3.2.2-r2 fixes 3 vulnerabilities: CVE-2026-44405, CVE-2026-54590, CVE-2026-54591...

CLEANSTART-2026-KA71089 Security fixes in airflow-3 3.1.8-r2

Package airflow-3 version 3.1.8-r2 fixes 5 vulnerabilities: ghsa-r95x-qfjj-fjj2, CVE-2026-44681, CVE-2026-48710, ghsa-29h4-r29x-hchv, CVE-2026-8838...

CVE-2026-59243

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...