202 matches found
dataflow-airflow (2.10.3) potentially affected by CVE-2026-49487 via apache-airflow (2.10.3)
apache-airflow PYPI version 2.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dataflow-airflow 2.10.3 Source cves: CVE-2026-49487 Source advisory: OSV:PYSEC-2026-2088...
dataflow-airflow (2.10.3) potentially affected by CVE-2026-49296 via apache-airflow (2.10.3)
apache-airflow PYPI version 2.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dataflow-airflow 2.10.3 Source cves: CVE-2026-49296 Source advisory: OSV:PYSEC-2026-2083...
dataflow-airflow (2.10.3) potentially affected by CVE-2026-28563 +1 more via apache-airflow (2.10.3)
apache-airflow PYPI version 2.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dataflow-airflow 2.10.3 Source cves: CVE-2026-28563, CVE-2026-48891 Source advisory: OSV:PYSEC-2026-2086...
dataflow-airflow (2.10.3) potentially affected by CVE-2026-48892 via apache-airflow (2.10.3)
apache-airflow PYPI version 2.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dataflow-airflow 2.10.3 Source cves: CVE-2026-48892 Source advisory: OSV:PYSEC-2026-2087...
dataflow-airflow (2.10.3) potentially affected by CVE-2026-33264 via apache-airflow (2.10.3)
apache-airflow PYPI version 2.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dataflow-airflow 2.10.3 Source cves: CVE-2026-33264 Source advisory: OSV:PYSEC-2026-2082...
dataflow-airflow (2.10.10) potentially affected by CVE-2026-49297 via apache-airflow-providers-google (19.0.0)
apache-airflow-providers-google PYPI version 19.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - dataflow-airflow 2.10.10 Source cves: CVE-2026-49297 Source advisory: OSV:GHSA-V3MH-27QJ-W836...
dataflow-airflow (2.10.10) potentially affected by CVE-2026-49297 via apache-airflow-providers-google (19.0.0)
apache-airflow-providers-google PYPI version 19.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - dataflow-airflow 2.10.10 Source cves: CVE-2026-49297 Source advisory: OSV:PYSEC-2026-2084...
CVE-2026-58579
RAGFlow before 0.26.3 stores an agent pipeline DSL node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalizedsl, which only performs JSON serialization validation and preserves the node name verbatim. The dataflow-result web UI then renders that name int...
CVE-2026-58579 RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name
RAGFlow before 0.26.3 stores an agent pipeline DSL node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalizedsl, which only performs JSON serialization validation and preserves the node name verbatim. The dataflow-result web UI then renders that name int...
CVE-2026-58579
RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization. The update endpoint normalizes DSL via JSON serialization but preserves the node name, and the dataflow-result UI renders it with dangerouslySetInnerHTML while i18next escapeValue is false, allowing an authentica...
com.themodernway:themodernway-server-integration (>=1.3.6-release, <=1.3.7-release), org.springframework.cloud:spring-cloud-dataflow-server-cloudfoundry (>=1.5.0.release, <=1.5.1.release) +4 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.15.release)
org.springframework.integration:spring-integration-file MAVEN version 4.3.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...
com.ahome-it:ahome-tooling-server-core (1.1.14-release), com.ahome-it:ahome-tooling-server-hazelcast (1.1.14-release) +18 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.2.release)
org.springframework.integration:spring-integration-file MAVEN version 4.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.ahome-it:ahome-tooling-server-core...
com.themodernway:themodernway-server-integration (1.3.8-release), org.springframework.cloud:spring-cloud-dataflow-classic-docs (>=1.6.0.release, <=1.7.4.release) +18 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.17.release)
org.springframework.integration:spring-integration-file MAVEN version 4.3.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...
com.themodernway:themodernway-server-integration (1.3.5-release), org.springframework.cloud:spring-cloud-dataflow-docs (>=1.5.0.release, <=1.5.2.release) +10 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.14.release)
org.springframework.integration:spring-integration-file MAVEN version 4.3.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...
org.springframework.cloud:spring-cloud-dataflow-server-local (>=1.5.0.release, <=1.5.2.release), org.springframework.integration:spring-integration-ftp (4.3.16.release) +1 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.16.release)
org.springframework.integration:spring-integration-file MAVEN version 4.3.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...
org.springframework.boot:spring-boot-starter-data-redis (1.4.4.release), org.springframework.boot:spring-boot-starter-redis (1.4.4.release) +2 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.7.release)
org.springframework.data:spring-data-keyvalue MAVEN version 1.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.boot:spring-boot-starter-data-redis...
CVE-2026-42458
Magento Long Term Support LTS is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, there is a reflected XSS vulnerability under admin panel - System - Import/Export -...
dataflow-421 (>=0.1.8, <=0.2.12), easyroutine (>=1.1.1, <=1.1.5) +2 more potentially affected by CVE-2026-5241 via transformers (4.51.1)
transformers PYPI version 4.51.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - dataflow-421 =0.1.8, =1.1.1, =1.0.10, =1.18.0, =1.27.0 Source cves: CVE-2026-5241 Source advisory: OSV:PYSEC-2026-2290...
dataflow-airflow (2.10.3) potentially affected by CVE-2026-46764 via apache-airflow (2.10.3)
apache-airflow PYPI version 2.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dataflow-airflow 2.10.3 Source cves: CVE-2026-46764 Source advisory: OSV:GHSA-QPHR-3MVQ-V466...
dataflow-airflow (2.10.3) potentially affected by CVE-2025-57735 +1 more via apache-airflow (2.10.3)
apache-airflow PYPI version 2.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dataflow-airflow 2.10.3 Source cves: CVE-2025-57735, CVE-2026-48726 Source advisory: OSV:GHSA-VR7M-C6V4-8CX8...