94950 matches found
PT-2026-108487
Security vulnerability affects the apache-superset package. A flaw in Node...
CVE-2026-71898: Incorrect Authorization
An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...
CVE-2026-102497: Uncontrolled Recursion
The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...
CVE-2026-81914: Improper Neutralization of Special Elements in Data Query Logic
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...
PT-2026-102459
Name of the Vulnerable Software and Affected Versions Apache Karaf versions prior to 4.4.12 Apache Karaf versions prior to 4.5.0 Description Apache Karaf contains a flaw in the KarafMBeanServerGuard which fails to enforce role-based access control RBAC on specific MBean lifecycle operations. The...
PT-2026-102508
The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...
PT-2026-102505
The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...
PT-2026-102615
An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...
PT-2026-102616
An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whethe...
PT-2026-108586
Security vulnerability affects the apache-hive package. PAC4J is vulnerable to LDAP Injection in multiple methods...
PT-2026-108464
Security vulnerability affects the apache-superset package. A flaw in Node...
PT-2026-102497
Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. S3ToTeradataOperator and AzureBlobStorageToTeradataOperator interpolate the source bucket's credentials as plain string literals into the CREATE MULTISET TABLE ... LOCATION statement whenever the...
PT-2026-102461
Name of the Vulnerable Software and Affected Versions Apache Karaf affected versions not specified Description An issue exists in the org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties function, which supports the config MBean and config shell commands. The software deriv...
PT-2026-108514
Security vulnerability affects the apache-hive package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...
CVE-2026-86843: Improper Neutralization of Special Elements used in an SQL Command
The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...
PT-2026-108580
Security vulnerability affects the apache-hive package. Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified...
PT-2026-108399
Security vulnerability affects the apache-hive package. UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns...
PT-2026-108368
Security vulnerability affects the apache-hive package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...
PT-2026-108470
Security vulnerability affects the apache-hive package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...