95233 matches found
CVE-2026-81862: Insertion of Sensitive Information into Log File
Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. S3ToTeradataOperator and AzureBlobStorageToTeradataOperator interpolate the source bucket's credentials as plain string literals into the CREATE MULTISET TABLE ... LOCATION statement whenever the...
PT-2026-108487
Security vulnerability affects the apache-superset package. A flaw in Node...
PT-2026-108370
Security vulnerability affects the elasticsearch package. Uncontrolled Recursion vulnerability in Apache Commons Lang...
PT-2026-108480
Security vulnerability affects the apache-hive package. When audit logging is enabled zookeeper...
PT-2026-108541
Security vulnerability affects the apache-superset package. A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable...
PT-2026-108547
Security vulnerability affects the apache-superset package. A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node...
CVE-2026-91085: Missing Authorization
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files etc/org.apache.karaf.command.acl. .cfg. SecuredSessionFactoryImpl.checkSecurity resolves the roles required for an invocation and, when no ACL rule matches the command, fails...
CVE-2026-92142: Missing Authorization
Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control RBAC on MBean operations invoked over the remote JMX connector RMI registry/server, enabled by default on ports 1099 and 44444. The guard is implemented as a...
PT-2026-108414
Security vulnerability affects the apache-superset package. We have identified a bug in Node...
CVE-2026-71898: Incorrect Authorization
An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...
CVE-2026-81914: Improper Neutralization of Special Elements in Data Query Logic
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...
PT-2026-102615
An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...
PT-2026-102616
An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whethe...
PT-2026-102497
Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. S3ToTeradataOperator and AzureBlobStorageToTeradataOperator interpolate the source bucket's credentials as plain string literals into the CREATE MULTISET TABLE ... LOCATION statement whenever the...
PT-2026-102461
Name of the Vulnerable Software and Affected Versions Apache Karaf affected versions not specified Description An issue exists in the org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties function, which supports the config MBean and config shell commands. The software deriv...
PT-2026-108514
Security vulnerability affects the apache-hive package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...
PT-2026-108399
Security vulnerability affects the apache-hive package. UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns...
PT-2026-108368
Security vulnerability affects the apache-hive package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...
PT-2026-108470
Security vulnerability affects the apache-hive package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...