DLA-4444-1 apache-log4j2 - security update

Bulletin has no description...

Exploit for Improper Input Validation in Apache Tomcat

CVE-2013-4322PoC A...

OSV-2026-87 Security exception in org.apache.poi.util.IOUtils.safelyAllocate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476184826 Crash type: Security exception Crash state: org.apache.poi.util.IOUtils.safelyAllocate org.apache.poi.ddf.EscherComplexProperty.ensureComplexData org.apache.poi.ddf.EscherComplexProperty.getComplexData...

OSV-2025-1061 Security exception in org.apache.poi.hssf.record.aggregates.SharedValueManager$SharedFormulaGroup.<ini

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476431391 Crash type: Security exception Crash state: org.apache.poi.hssf.record.aggregates.SharedValueManager$SharedFormulaGroup. org.apache.poi.hssf.record.aggregates.SharedValueManager.create...

CVE-2025-68675

In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result,...

Exploit for Path Traversal in Apache Http_Server

🛑 CVE-2021-41773 Checker CVE-2021-41773 Checker is a Python-b...

airflow-balancer (>=0.7.0 <=0.7.6), airflow-clickhouse-plugin (=1.5.0) +28 more potentially affected by CVE-2025-68438 via apache-airflow-task-sdk (>=1.0.0 <=1.1.6)

apache-airflow-task-sdk PYPI version =1.0.0, =0.7.0, =0.6.1, =1.10.7, =0.1.0, =1.4.3, =1.2.10, =0.1.1, =3.0.0, =3.0.0, =1.6.0, =1.5.3, =1.25.0, =3.12.0, =0.0.4, =0.0.6.dev1 and more Source cves: CVE-2025-68438 Source advisory: SNYK:PYTHON-APACHEAIRFLOWTASKSDK-15032537...

GHSA-7C2F-R6GC-H92H Apache Airflow proxy credentials for various providers might leak in task logs

In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result,...

apache-airflow-core (>=3.1.0 <=3.1.5), apache-airflow-providers-common-compat (>=1.6.0 <=1.7.3rc1) +14 more potentially affected by CVE-2025-68438 via apache-airflow (>=3.1.0 <=3.1.5)

apache-airflow PYPI version =3.1.0, =3.1.0, =1.6.0, =1.5.3, =1.26.0, =2.0.2, =0.4.0, =1.1.0, =12.0.0rc1, =7.0.0rc1, =1.9.0rc1, =1.9.0rc2 - dkist-processing-test =1.37.0rc2 - dkist-processing-vbi =1.26.0rc1 and more Source cves: CVE-2025-68438 Source advisory: OSV:GHSA-3QMM-R55X-HPXX...

airflow-balancer (>=0.7.0 <=0.7.6), airflow-clickhouse-plugin (=1.5.0) +28 more potentially affected by CVE-2025-68675 via apache-airflow (>=3.0.0rc4 <=3.1.5)

apache-airflow PYPI version =3.0.0rc4, =0.7.0, =0.6.1, =1.10.7, =0.1.0, =1.4.3, =1.2.10, =0.1.1, =3.0.1, =1.6.0, =1.5.3, =1.25.0rc1, =3.12.0, =0.0.4, =2.0.2, =2.3.0rc1 and more Source cves: CVE-2025-68675 Source advisory: OSV:GHSA-7C2F-R6GC-H92H...

acceldata-o2a (=1.0.0), aglow (>=0.1.0rc3 <=0.1.0rc4) +33 more potentially affected by CVE-2025-68675 via apache-airflow (>=1.8.2 <=2.11.0)

apache-airflow PYPI version =1.8.2, =0.1.0rc3, =0.1.0, =0.6.0, =2.4.2, =0.0.1, =0.6.4, =1.0.0, =0.2.0, =1.7.2, =2.10.3, =0.3.12, =1.8.2 and more Source cves: CVE-2025-68675 Source advisory: OSV:GHSA-7C2F-R6GC-H92H...

Apache Airflow proxy credentials for various providers might leak in task logs

In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result,...

Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated

In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed core maxtemplatedfieldlength, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include...

OESA-2026-1064 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: An integer overflow vulnerability was found in Apache HTTP Server versions 2.4.30 to 2.4.66. In case of failed ACME certificate renewal, after a number of failures 30 days in default configurations, the...

PYSEC-2026-9

In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed coremaxtemplatedfieldlength, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include...

abi-ds-utils (=1.0.1), acceldata-o2a (=1.0.0) +155 more potentially affected by CVE-2025-68675 via apache-airflow (>=1.8.2 <=3.1.5)

apache-airflow PYPI version =1.8.2, =0.8.44.4, =1.4.0.3.post4, =1.4.0.3.post3, =0.1.0rc3, =0.1.0, =0.2.1, =0.2.9b1, =0.4.0, =0.1.0a1, =0.6.0, =0.1.1, =0.6.4 and more Source cves: CVE-2025-68675 Source advisory: OSV:PYSEC-2026-10...

CVE-2025-68438

In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed core maxtemplatedfieldlength, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include...

CVE-2025-68675

In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result,...

EUVD-2026-2912

In Apache Airflow versions before 3.1.6, the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such...

CVE-2025-68675 Apache Airflow: proxy credentials for various providers might leak in task logs

In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result,...