PYSEC-2026-12

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue...

CVE-2026-24098

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue...

CVE-2026-24098 Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue...

CVE-2026-24098

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue...

CVE-2026-24098 Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue...

CVE-2026-24098

Apache Airflow versions 3.0.0 - 3.1.7 are vulnerable to an information disclosure flaw where authenticated UI users can view import errors for DAGs they are not authorized to access. The root cause is a failure to correctly filter errors based on granular DAG permissions, potentially exposing fil...

CVE-2026-24098 Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue...

firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component...

firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component...

CVE-2025-66594

CVE-2025-66594 affects Yokogawa FAST/TOOLS packages (RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) from R9.01 to R10.04. The public description notes that detailed messages on the error page could be exploited by an attacker for other attacks, indicating information leakage or error handling weaknesses;...

firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component...

ROS-20260209-73-0010

Vulnerability in python-xmltodict related to errors in xml query processing. Exploitation of the vulnerability could allow a remote attacker to execute arbitrary code...

PT-2026-7103

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.1.7 Description Authenticated users of the Airflow user interface, with permissions to specific Dags, could view import errors generated by other Dags they were not authorized to access. Recommendations Upgra...

Apache Airflow 安全漏洞

Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. This platform features scalability and dynamic monitoring capabilities. Prior to Apache Airflow 3.1.7, there were security...

The vulnerability of the gfs2_show_options() function in the fs/gfs2/super.c file of the GFS2 file system in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the gfs2showoptions function in the fs/gfs2/super.c file of the GFS2 file system in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the f2fs_abort_atomic_write() function in the fs/f2fs/segment.c module of the F2FS file system in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the f2fsabortatomicwrite function in the fs/f2fs/segment.c module of the F2FS file system in the Linux operating system is related to synchronization errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-24098: Exposure of Sensitive Information to an Unauthorized Actor

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue...

The vulnerability of the scrub_submit_extent_sector_read() function in the fs/btrfs/scrub.c module of the Linux kernel’s file system support module allows a attacker to cause a service failure.

The vulnerability of the scrubsubmitextentsectorread function in the fs/btrfs/scrub.c module of the Linux file system support module is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the nwl_dsi_bridge_mode_set() function in the drivers/gpu/drm/bridge/nwl-dsi.c driver module allows a attacker to cause a service failure.

The vulnerability of the nwldsibridgemodeset function in the drivers/gpu/drm/bridge/nwl-dsi.c driver module is related to security configuration errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-25934: Improper Validation of Integrity Check Value

go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would like...