CLEANSTART-2026-IX15108 Security fix for CVE-2024-6104 applied in: prometheus 2.47.2-r0, rekor-backfill-index 1.2.2-r0

CVE-2024-6104 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HZ27786 Security fixes in rekor-backfill-index 1.2.2-r0

Package rekor-backfill-index version 1.2.2-r0 fixes 7 vulnerabilities: CVE-2026-56864, CVE-2026-56865, CVE-2024-6104, ghsa-pmwq-pjrm-6p5r, CVE-2026-2303...

CLEANSTART-2026-QY94875 Security fixes in rekor-backfill-index 1.4.3-r0

Package rekor-backfill-index version 1.4.3-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

CLEANSTART-2026-EN93855 Security fixes in rekor-backfill-index 1.4.3-r2

Package rekor-backfill-index version 1.4.3-r2 fixes 3 vulnerabilities: ghsa-fw7p-63qq-7hpr, CVE-2026-26958, ghsa-mqqf-5wvp-8fh8...

CLEANSTART-2026-ME27346 Security fixes in rekor-backfill-index 1.4.3-r1

Package rekor-backfill-index version 1.4.3-r1 fixes 1 vulnerabilities: ghsa-fcv2-xgw5-pqxf...

BIT-AIRFLOW-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

PT-2026-73240

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfill id path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

PYSEC-2026-3710

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

PYSEC-2026-3710

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

EUVD-2026-57271

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968

Apache Airflow's Backfill API is vulnerable to an authorization bypass due to an interpretation conflict in how the backfill_id path segment is parsed. The authorization dependency uses int(), while the route handler uses pydantic's NonNegativeInt; this allows values like 1.0 (which coerces to 1 ...

CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

PT-2026-80678

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfill id path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968: Interpretation Conflict

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

BIT-MASTODON-2026-27468 Mastodon may allow unconfirmed FASP to make subscriptions

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, actions performed by a FASP to subscribe to account/content lifecycle events or to backfill content...

CVE-2026-27468

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, actions performed by a FASP to subscribe to account/content lifecycle events or to backfill content...