602 matches found
CVE-2025-62402
Summary: The issue CVE-2025-62402 affects Apache Airflow’s API endpoint /api/v2/dagReports. The root cause is that API users could execute Dag Python code in the API server context when the server has access to DAG files, enabling potential arbitrary code execution on the API server. This is desc...
CVE-2025-62402 Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API
API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...
CVE-2025-62402 Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API
API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...
CVE-2025-62402 Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API
API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...
Apache Airflow 安全漏洞
Apache Airflow is a set of open source platforms with the ability to create, manage and monitor workflows from the US Apache Apache Foundation. The platform is characterized by scalability and dynamic monitoring. A security vulnerability exists in Apache Airflow, which stems from the...
PT-2025-44367
Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.0.5 Description A parameter in the example dag decorator dag was not properly validated, potentially allowing a user of the Airflow UI to redirect the example to a malicious server and execute code on a worke...
PT-2025-44368
Name of the Vulnerable Software and Affected Versions API users affected versions not specified Description The API allows code execution within the context of the api-server through the /api/v2/dagReports endpoint. This occurs when the api-server is deployed in an environment where Dag files are...
EUVD-2023-0022
Malicious code in bioql PyPI...
EUVD-2024-0540
Malicious code in bioql PyPI...
EUVD-2022-7573
Malicious code in bioql PyPI...
EUVD-2023-0438
Malicious code in bioql PyPI...
EUVD-2022-0012
Malicious code in bioql PyPI...
EUVD-2023-0018
Malicious code in bioql PyPI...
EUVD-2022-0007
Malicious code in bioql PyPI...
GHSA-GWRF-JF3H-W649 vulnerabilities
Vulnerabilities for packages: k8sgpt-operator, checksec, dagdotdev, nats, bank-vaults, custom-pod-autoscaler-operator, secrets-store-csi-driver-provider-aws, vault-k8s, gostatsd, vault-benchmark, container-object-storage-interface, cloud-provider-aws, mongodb-kubernetes-operator,...
Malicious code in xs-js-ipld-dag-cbor (npm)
The package xs-js-ipld-dag-cbor was found to contain malicious code...
MAL-2025-39993 Malicious code in xs-js-ipld-dag-cbor (npm)
The package xs-js-ipld-dag-cbor was found to contain malicious code...
CVE-2025-54415
dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files. In versions 0.23.0a8 and below, a high-severity vulnerability has been identified in the cicd.yml workflow within the astronomer/dag-factory GitHub repository. The workflow, specifically when...
CVE-2025-54415
dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files. In versions 0.23.0a8 and below, a high-severity vulnerability has been identified in the cicd.yml workflow within the astronomer/dag-factory GitHub repository. The workflow, specifically when...
CVE-2025-54415 dag-factory's CI/CD Workflow Allows for Repository Takeover and Secret Exfiltration
dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files. In versions 0.23.0a8 and below, a high-severity vulnerability has been identified in the cicd.yml workflow within the astronomer/dag-factory GitHub repository. The workflow, specifically when...