Apache Airflow 安全漏洞

Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. This platform features scalability and dynamic monitoring capabilities. There is a security vulnerability in Apache Airflow, whic...

Apache Airflow 安全漏洞

Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. This platform features scalability and dynamic monitoring capabilities. Prior to Apache Airflow 3.2.0, there were security...

Generation of Error Message Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Generation of Error Message Containing Sensitive Information due to exposing exception/stack trace of errors even if api/exposestacktraces was set to false. That could lead to exposing additional information to potential attacker...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to allowing users with asset materialize permissions to trigger DAGs outside of their permissions. Remediation Upgrade apache-airflow-core to version 3.2.0b2 or higher. References - Apache Mailing List - GitH...

CVE-2026-34197 vulnerabilities

Vulnerabilities for packages: geoserver, apache-activemq-fips, apache-activemq...

GHSA-RXPJ-7QVF-XV32 vulnerabilities

Vulnerabilities for packages: geoserver, apache-activemq-fips, apache-activemq...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Apache Tika Core and Parsers (CVE-2025-54988, CVE-2025-66516, CVE-2025-66516)

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in Apache Tika Core and Parsers CVE-2025-54988, CVE-2025-66516, CVE-2025-66516. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2025-54988 DESCRIPTION: Critical XXE in Apache Tika...

Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation

A recently disclosed high-severity security flaw in Apache ActiveMQ Classic has come under active exploitation in the wild, per the U.S. Cybersecurity and Infrastructure Security Agency CISA. To that end, the agency has added the vulnerability, tracked as CVE-2026-34197 CVSS score: 8.8, to its...

CVE-2026-2332 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator-fips, cloudwatch-exporter, druid, spark-kubernetes-operator, spark-kubernetes-operator-fips, apache-hop-fips, cruise-control, apache-pulsar-fips, reposilite, apache-tika, apache-tika-fips, zaproxy, pinot, apache-jena-fuseki, akhq, solr,...

GHSA-355H-QMC2-WPWF vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator-fips, cloudwatch-exporter, druid, spark-kubernetes-operator, spark-kubernetes-operator-fips, apache-hop-fips, cruise-control, apache-pulsar-fips, reposilite, apache-tika, apache-tika-fips, zaproxy, pinot, apache-jena-fuseki, akhq, solr,...

CLEANSTART-2026-CO09549 In libexpat before 2

Multiple security vulnerabilities affect the apache-zookeeper package. In libexpat before 2. See references for individual vulnerability details...

CLEANSTART-2026-RO70091 In libexpat before 2

Multiple security vulnerabilities affect the apache-zookeeper package. In libexpat before 2. See references for individual vulnerability details...

CLEANSTART-2026-KF53276 Security fixes for ghsa-72hv-8253-57qq, ghsa-qqpg-mvqg-649v applied in versions: 3.9.4-r0, 3.9.4-r6

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AK18460 Security fixes for ghsa-72hv-8253-57qq applied in versions: 3.6.4-r4

Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-GW37659 Security fixes for ghsa-72hv-8253-57qq applied in versions: 3.8.6-r0

Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...

The vulnerability of the Apache Tomcat application server, related to deficiencies in the error reporting mechanism, allows attackers to execute a type of attack known as Padding Oracle attack.

The vulnerability of the Apache Tomcat application server is related to deficiencies in the mechanism for generating error reports. Exploiting this vulnerability allows a malicious actor to carry out a type of attack known as Padding Oracle, which involves using “padding” to manipulate data...

Apache Tomcat 10.1.22 < 10.1.54 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 10.1.54. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat10.1.54security-10 advisory. - Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clusteri...

PT-2026-33633

Name of the Vulnerable Software and Affected Versions Apache Kafka versions 4.1.0 through 4.1.1 Description An authentication bypass exists in Apache Kafka due to the default configuration of the sasl.oauthbearer.jwt.validator.class property, which is set to...

The vulnerability of the Apache Tomcat application server, related to deficiencies in the encryption of confidential data, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Apache Tomcat application server is related to deficiencies in the encryption of confidential data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

BIT-AIRFLOW-2025-66236 Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not clear or explicit enough, even though...