EUVD-2025-36994

Apache Airflow /api/v2/dagReports executes DAG Python in API...

CVE-2025-62402

API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...

PT-2021-16642

Name of the Vulnerable Software and Affected Versions: DSP driver versions prior to SMR Sep-2021 Release 1 Description: The issue is related to an improper input validation vulnerability in the loading of graph files in the DSP driver. This vulnerability allows attackers to perform a permanent...

Code injection

The Old Charts implementation in Bugzilla 2.12 through 3.2.8, 3.4.8, 3.6.2, 3.7.3, and 4.1 creates graph files with predictable names in graphs/, which allows remote attackers to obtain sensitive information via a modified URL...