GHSA-38GX-CFQF-F652 vulnerabilities

Vulnerabilities for packages: kibana, langfuse-fips, lerna, jitsucom-jitsu, wazuh-dashboard-fips, langfuse, kubeflow-centraldashboard, nextcloud-server, redisinsight, opensearch-dashboards-fips, wazuh-dashboard, opensearch-dashboards, librechat, prism, awx, semaphore...

CVE-2026-67314 vulnerabilities

Vulnerabilities for packages: kibana, langfuse-fips, lerna, jitsucom-jitsu, wazuh-dashboard-fips, langfuse, kubeflow-centraldashboard, nextcloud-server, redisinsight, opensearch-dashboards-fips, wazuh-dashboard, opensearch-dashboards, librechat, prism, awx, semaphore...

EUVD-2026-47629

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumeraccess function jobevents, workflowevents, adhoccommandevents. Three event groups - inventoryupdateevents, projectupdateevents, and systemjobevents — are n...

CVE-2026-12726

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pullrequest webhooks, the controller stores the pullrequest.statusesurl value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub...

CVE-2026-12726

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pullrequest webhooks, the controller stores the pullrequest.statusesurl value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub...

CVE-2026-12726

AWX/AUTOMATION-CONTROLLER GitHub webhook integration vulnerability (CVE-2026-12726): processing of GitHub pull_request webhooks stores statuses_url from the payload without validating it points to a trusted GitHub API endpoint. If a job template uses a GitHub Personal Access Token as the webhook ...

CVE-2026-12726 Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pullrequest webhooks, the controller stores the pullrequest.statusesurl value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub...

PT-2026-51010

Name of the Vulnerable Software and Affected Versions AWX affected versions not specified Description A flaw exists in the GitHub webhook integration where the controller stores the pull request.statuses url value from a pull request webhook payload without validating if it points to a trusted...

CVE-2026-52902

CVE-2026-52902 affects awxkit (AWX CLI). The YAML !include directive permits path traversal, enabling an attacker to craft a YAML file that reads arbitrary local YAML files when a user imports it via awx --conf.format yaml import. This is a client-side vulnerability requiring user interaction. Mi...

GHSA-MV93-W799-CJ2W vulnerabilities

Vulnerabilities for packages: mlflow-fips, datahub-ingestion-fips, mlflow, jupyter-all-spark-notebook, opal, awx, nemo...

GHSA-9F5J-8JWJ-X28G vulnerabilities

Vulnerabilities for packages: awx, airflow...

CVE-2026-33936 vulnerabilities

Vulnerabilities for packages: awx, airflow...

GHSA-PXRR-HQ57-Q35P vulnerabilities

Vulnerabilities for packages: awx...

CVE-2026-33154 vulnerabilities

Vulnerabilities for packages: awx...

CVE-2025-69534 vulnerabilities

Vulnerabilities for packages: awx, superset...

GHSA-5WMX-573V-2QWQ vulnerabilities

Vulnerabilities for packages: awx, superset...

GHSA-6MQ8-RVHQ-8WGG vulnerabilities

Vulnerabilities for packages: airflow, checkov, kubeflow-pipelines-visualization-server, apache-beam-python-3.11-sdk, dask-kubernetes, gitlab-cng, open-webui, kserve, authentik, request-1276, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, awx, py3-cassandra-medusa...

CVE-2025-69229 vulnerabilities

Vulnerabilities for packages: airflow, checkov, kubeflow-pipelines-visualization-server, apache-beam-python-3.11-sdk, dask-kubernetes, gitlab-cng, open-webui, kserve, authentik, request-1276, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, awx, py3-cassandra-medusa...

CVE-2025-69227 vulnerabilities

Vulnerabilities for packages: airflow, checkov, kubeflow-pipelines-visualization-server, apache-beam-python-3.11-sdk, dask-kubernetes, gitlab-cng, open-webui, kserve, authentik, request-1276, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, awx, py3-cassandra-medusa...

GHSA-6JHG-HG63-JVVF vulnerabilities

Vulnerabilities for packages: airflow, checkov, kubeflow-pipelines-visualization-server, apache-beam-python-3.11-sdk, dask-kubernetes, gitlab-cng, open-webui, kserve, authentik, request-1276, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, awx, py3-cassandra-medusa...