airgoodies (>=0.0.3, <=0.0.4) potentially affected by CVE-2026-42526 via apache-airflow-providers-amazon (8.7.1)

apache-airflow-providers-amazon PYPI version 8.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airgoodies =0.0.3, =0.0.4 Source cves: CVE-2026-42526 Source advisory: OSV:PYSEC-2026-595...

flowui-project (>=0.0.1, <=0.0.13) potentially affected by CVE-2026-42526 via apache-airflow-providers-amazon (4.0.0)

apache-airflow-providers-amazon PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - flowui-project =0.0.1, =0.0.13 Source cves: CVE-2026-42526 Source advisory: OSV:PYSEC-2026-595...

apache-liminal (>=0.0.4rc1, <=0.0.5), apache-liminal-zion (>=0.0.0, <=2.0.0) +1 more potentially affected by CVE-2026-42526 via apache-airflow-providers-amazon (1.4.0)

apache-airflow-providers-amazon PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - apache-liminal =0.0.4rc1, =0.0.0, =2.0.0 - example-pkg-naturalett 14.7.0 Source cves: CVE-2026-425...

airflow-poetry-test (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-42526 via apache-airflow-providers-amazon (3.4.0)

apache-airflow-providers-amazon PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-poetry-test =0.1.0, =0.1.2 Source cves: CVE-2026-42526 Source advisory: OSV:PYSEC-2026-595...

airflow-providers (>=0.1.0, <=0.3.0) potentially affected by CVE-2026-42526 via apache-airflow-providers-amazon (5.1.0)

apache-airflow-providers-amazon PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-providers =0.1.0, =0.3.0 Source cves: CVE-2026-42526 Source advisory: OSV:PYSEC-2026-595...

example-pkg-naturalett (>=14.4.0, <=14.4.8) potentially affected by CVE-2026-42526 via apache-airflow-providers-amazon (2.0.0)

apache-airflow-providers-amazon PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - example-pkg-naturalett =14.4.0, =14.4.8 Source cves: CVE-2026-42526 Source advisory:...

airflow-aws-shared-secrets (>=0.0.1, <=0.0.5), airflow-tools (>=0.1.0, <=0.8.6) potentially affected by CVE-2026-42526 via apache-airflow-providers-amazon (8.29.0)

apache-airflow-providers-amazon PYPI version 8.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-aws-shared-secrets =0.0.1, =0.1.0, =0.8.6 Source cves: CVE-2026-42526 Source advisory:...

airflow-add-ons (>=0.2.9b1, <=0.2.9b2) potentially affected by CVE-2026-42526 via apache-airflow-providers-amazon (3.2.0)

apache-airflow-providers-amazon PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-add-ons =0.2.9b1, =0.2.9b2 Source cves: CVE-2026-42526 Source advisory: OSV:PYSEC-2026-595...

CVE-2026-42526

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

airflow-toolkit (0.13.3), airflow-tools (>=0.9.0, <=0.12.0) +4 more potentially affected by CVE-2026-42526 via apache-airflow-providers-amazon (>=9.0.0, <=9.17.0)

apache-airflow-providers-amazon PYPI version =9.0.0, =0.9.0, =0.0.1, =2.10.3, =0.0.1rc1, =2.10.7rc1, =2.10.11rc5 Source cves: CVE-2026-42526 Source advisory: OSV:PYSEC-2026-595...

ch.admin.bit.jeap:jeap-messaging-glue-schema-registry (>=8.15.0, <=8.50.0), com.agorapulse:micronaut-amazon-awssdk-kinesis-worker (>=3.4.3, <=4.0.6) +90 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (4.3.0)

com.squareup.wire:wire-runtime MAVEN version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - ch.admin.bit.jeap:jeap-messaging-glue-schema-registry =8.15.0, =3.4.3, =0.15.8, =1.0.20, =1.0.20,...

CVE-2026-42526

In the AWS Secrets Manager and SSM Parameter Store secrets backends of "apache-airflow-providers-amazon" prior to 9.28.0, the team-scoping logic could resolve a "connid" containing a "/" e.g. ""myteam/conn"" to the same path as another team's team-scoped secret when the caller had no team context...

CVE-2026-42526 Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

CVE-2026-42526 Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

airflow-add-ons (>=0.2.9b1, <=0.2.9b2), airflow-aws-shared-secrets (>=0.0.1, <=0.0.5) +13 more potentially affected by CVE-2026-42526 via apache-airflow-providers-amazon (>=1.4.0, <=9.17.0)

apache-airflow-providers-amazon PYPI version =1.4.0, =0.2.9b1, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.0.3, =0.0.4rc1, =0.0.0, =0.0.1, =2.10.3, =14.4.0, =0.0.1, =0.0.1rc1, =2.10.7rc1, =2.10.11rc5 Source cves: CVE-2026-42526 Source advisory: MEND:CVE-2026-42526...

CVE-2026-42526 Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

CVE-2026-42526

The apache-airflow-providers-amazon package (prior to version 9.28.0 ) contains a vulnerability in its AWS Secrets Manager and SSM Parameter Store backends. The team-scoping logic could incorrectly resolve a conn_id containing a forward slash (e.g., "my_team/conn") to a path belonging to a differ...

Exploit for CVE-2026-8838

CVE-2026-8838 — Amazon Redshift Python Driver: Remote Code Exe...

WordPress Amazon Scraper plugin <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin Amazon Scraper versions = 1.1...

Malicious code in @antv/f2-site (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...