94023 matches found
PT-2026-108454
Security vulnerability affects the apache-superset package. A flaw in Node...
PT-2026-102613
An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...
PT-2026-102461
Name of the Vulnerable Software and Affected Versions Apache Karaf affected versions not specified Description An issue exists in the org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties function, which supports the config MBean and config shell commands. The software deriv...
PT-2026-108450
Security vulnerability affects the apache-hive package. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add auth"ensemble",...
PT-2026-108415
Security vulnerability affects the spark-sc212-jdk17-py311 package. Apache Log4j Core's Rfc5424Layout https://logging...
PT-2026-108522
Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...
PT-2026-108443
Security vulnerability affects the apache-superset package. Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS12 file...
CVE-2026-81930: Insufficiently Protected Credentials
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
CVE-2026-81914: Improper Neutralization of Special Elements in Data Query Logic
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...
PT-2026-108469
Security vulnerability affects the sonarqube package. Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5...
PT-2026-108482
Security vulnerability affects the apache-superset package. A flaw in Node...
PT-2026-102608
The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...
PT-2026-108403
Security vulnerability affects the apache-superset package. Issue summary: Processing a malformed PKCS12 file can trigger a NULL pointer dereference in the PKCS12 item decrypt d2i ex function...
CVE-2026-81862: Insertion of Sensitive Information into Log File
Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. S3ToTeradataOperator and AzureBlobStorageToTeradataOperator interpolate the source bucket's credentials as plain string literals into the CREATE MULTISET TABLE ... LOCATION statement whenever the...
PT-2026-102505
The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...
CVE-2026-102497: Uncontrolled Recursion
The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...
CVE-2026-82804: Improper Neutralization of Special Elements used in an OS Command
The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...
PT-2026-102721
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...
CVE-2026-71898: Incorrect Authorization
An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...
CVE-2026-91085: Missing Authorization
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files etc/org.apache.karaf.command.acl. .cfg. SecuredSessionFactoryImpl.checkSecurity resolves the roles required for an invocation and, when no ACL rule matches the command, fails...