CVE-2026-81862

Apache Airflow's Teradata provider contains a vulnerability where the S3ToTeradataOperator and AzureBlobStorageToTeradataOperator embed cloud storage credentials as plain string literals into CREATE MULTISET TABLE ... LOCATION statements. This occurs when using a private bucket/container without ...

CVE-2026-81862 Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs

Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. S3ToTeradataOperator and AzureBlobStorageToTeradataOperator interpolate the source bucket's credentials as plain string literals into the CREATE MULTISET TABLE ... LOCATION statement whenever the...

EUVD-2026-88694

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

CVE-2026-81914 Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

CVE-2026-81914 Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

CVE-2026-81914

The Apache Airflow Google provider is vulnerable to Google Drive query injection because it interpolates file and folder names directly into single-quoted string literals without escaping quote characters. An attacker can use an apostrophe in a filename to terminate the literal and append malicio...

CVE-2026-81914 Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

EUVD-2026-88605

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

PT-2026-102497

Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. S3ToTeradataOperator and AzureBlobStorageToTeradataOperator interpolate the source bucket's credentials as plain string literals into the CREATE MULTISET TABLE ... LOCATION statement whenever the...

CVE-2026-81930: Insufficiently Protected Credentials

Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...

PT-2026-102499

Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...

CVE-2026-86843: Improper Neutralization of Special Elements used in an SQL Command

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...

PT-2026-102640

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset...

CVE-2026-100288: Cleartext Storage of Sensitive Information

Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records...

CVE-2026-81862: Insertion of Sensitive Information into Log File

Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. S3ToTeradataOperator and AzureBlobStorageToTeradataOperator interpolate the source bucket's credentials as plain string literals into the CREATE MULTISET TABLE ... LOCATION statement whenever the...

CVE-2026-93330: Incorrect Behavior Order

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset...

CVE-2026-102877: Server-Side Request Forgery (SSRF)

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

CVE-2026-72897: Out-of-bounds Write

Issue summary: A TLS server that calls SSLsetSSLCTX to switch a connection to a different SSLCTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created...

PT-2026-102498

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

PT-2026-102500

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...