CVE-2025-30473 Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Airflow Common SQL Provider. When using the partition clause in SQLTableCheckOperator as parameter which was a recommended pattern, Authenticated UI User could inject arbitrary SQL command...

CVE-2025-30473

CVE-2025-30473 affects the Apache Airflow Common SQL Provider (before 1.24.1). The issue is an SQL Injection in the use of the partition_clause parameter of SQLTableCheckOperator, enabling an authenticated UI user to inject arbitrary SQL commands when triggering DAGs that expose partition_clause....

ROS-20250403-11

Vulnerability in the OpenSearch software package related to calls that utilize an internal underlying Identity Provider IdP rather than other externally configured IdPs. Exploitation of the vulnerability could Allow an attacker to impact data integrity...

Helping Your Clients Achieve NIST Compliance: A Step by Step Guide for Service Providers

Introduction As the cybersecurity landscape evolves, service providers play an increasingly vital role in safeguarding sensitive data and maintaining compliance with industry regulations. The National Institute of Standards and Technology NIST offers a comprehensive set of frameworks that provide...

Malicious code in @nationalgeographicsociety/ngsui-header-auth-provider-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d38527cfd7590fab454ac20f3be069dae42b211700523eb5a58dfd421014d9be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-41717 vulnerabilities

Vulnerabilities for packages: kubeflow, terraform-provider-sendgrid, kubeflow-katib...

GHSA-XRJJ-MJ9H-534M vulnerabilities

Vulnerabilities for packages: kubeflow, terraform-provider-sendgrid, kubeflow-katib...

CVE-2022-41717 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, terraform-provider-sendgrid-fips, terraform-provider-sendgrid, kubeflow, kubeflow-fips...

GHSA-XRJJ-MJ9H-534M vulnerabilities

Vulnerabilities for packages: kubeflow-katib, terraform-provider-sendgrid-fips, terraform-provider-sendgrid, kubeflow, kubeflow-fips...

CVE-2025-29928

authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage which is a non-default setting, deleting sessions via the Web Interface or the API would not revoke the session and the session holder wou...

CVE-2025-29928

authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage which is a non-default setting, deleting sessions via the Web Interface or the API would not revoke the session and the session holder wou...

Malicious code in ethers-provider2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64291b6905fba089a2dada5e0215c20954bf12f15f76d27c5c341d2b91baa81b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2731 Malicious code in ethers-provider2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64291b6905fba089a2dada5e0215c20954bf12f15f76d27c5c341d2b91baa81b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Robotic Process Automation is vulnerable to disclosing sensitive information due to improper privilege management for storage provider types (CVE-2022-34338)

Summary IBM Robotic Process Automation is vulnerable to disclosing sensitive information due to improper privilege management for storage provider types CVE-2022-34338 Vulnerability Details CVEID:CVE-2022-34338 DESCRIPTION: IBM Robotic Process Automation could disclose sensitive information due t...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the Shiro-based RBAC mechanism. An attacker can execute privileged operations by sending a crafted request. Remediation There is no fixed version for org.opendaylight.sfc:sfc-provider. References - Vulnerabili...

org.opendaylight.faas:features4-faas (>=1.2.0-carbon, <=1.3.3), org.opendaylight.faas:odl-faas-all (>=1.2.0-carbon, <=1.3.3) +67 more potentially affected by CVE-2025-29315 via org.opendaylight.sfc:sfc-provider (>=0.0.1-helium, <=0.10.4)

org.opendaylight.sfc:sfc-provider MAVEN version =0.0.1-helium, =1.2.0-carbon, =1.2.0-carbon, =1.2.0-carbon, =1.0.0-beryllium, =0.6.0, =0.5.0-carbon, =0.5.0-carbon, =0.5.0-carbon, =0.5.0-carbon, =0.6.0, =0.9.0, =0.9.0, =0.11.4 and more Source cves: CVE-2025-29315 Source advisory:...

The vulnerability of the Apache Airflow Fab Provider software, which is used for creating, monitoring, and orchestrating data processing scenarios in Apache Airflow, stems from incorrect session duration settings. This allows attackers to maintain a session in the system.

The vulnerability of the Apache Airflow Fab Provider software, which is used for creating, monitoring, and orchestrating data processing scenarios, is related to incorrect session duration settings. Exploiting this vulnerability allows a malicious actor to maintain a session on the system...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, filebrowser, splunk-otel-collector, step-ca, rekor, rclone, ksops, flux-kustomize-controller, minio-operator, grafana-mimir, gomplate, xeol, k8sgpt, openbao, kots, falcoctl, docker, guac, boring-registry, flyte,...

GHSA-MH63-6H87-95CP vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, filebrowser, splunk-otel-collector, step-ca, rekor, rclone, ksops, flux-kustomize-controller, minio-operator, grafana-mimir, gomplate, xeol, k8sgpt, openbao, kots, falcoctl, docker, guac, boring-registry, flyte,...

AZL-77517 CVE-2025-30204 affecting package kube-vip-cloud-provider for versions less than 0.0.2-26

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...