CVE-2026-46645: Missing Authorization

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajaxlookup endpoint in application.py bypasses the isaccessible access control check that all other endpoints enforce. If a developer restricts model access by overriding isaccessible, an authenticated user...

SQLAlchemy Admin security vulnerabilities

SQLAlchemy Admin is an open-source SQLAlchemy model management interface tool developed by Smithy HQ. Versions of SQLAlchemy Admin prior to 0.25.1 contained a security vulnerability. This vulnerability stemmed from the ajaxlookup endpoint in the application.py file, which bypassed the isaccessibl...

BIT-AIRFLOW-2026-45360 Apache Airflow: Arbitrary import in custom deadline-reference deserialization

Apache Airflow's scheduler-side deadline-reference decoder SerializedCustomReference.deserializereference imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — t...

CVE-2026-45360

Apache Airflow's scheduler-side deadline-reference decoder "SerializedCustomReference.deserializereference" imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler —...

CVE-2026-45360

The Apache Airflow scheduler-side deadline-reference decoder, specifically the SerializedCustomReference.deserialize_reference function, is vulnerable to arbitrary class instantiation. The root cause is the lack of an allowlist or plugin-registry gate when importing and dispatching class paths dr...

PT-2026-45374

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2 Description The scheduler-side deadline-reference decoder SerializedCustomReference.deserialize reference imports and dispatches arbitrary class paths from serialized state controlled by a DAG author...

EUVD-2026-29081

Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules. Multiple endpoints fetched user-owned objects without filtering by the requesting user's identity. An authenticated user could access another user's...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-sqlalchemy (UTSA-2026-017470)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017470 advisory. SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the orderby parameter. Tenable has extracted the preceding description block directly fr...

Mako path traversal vulnerability

Mako is an open-source template library written in Python by SQLAlchemy. It offers a familiar non-XML syntax, which can be compiled into Python modules for optimal performance. Prior to Mako 1.3.11, there was a path traversal vulnerability; this vulnerability stemmed from TemplateLookup.gettempla...

blind-sqli-lab

🔬 Blind SQL Injection Lab — Time-Based PostgreSQL + FastAPI...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python-sentry-sdk: python3-sentry-sdk+aiohttp-2.48.0-4.1.hum1 noarch python3-sentry-sdk+asyncpg-2.48.0-4.1.hum1 noarch python3-sentry-sdk+bottle-2.48.0-4.1.hum1 noarch...

gcloud-connectors (>=0.1.58b10, <=0.1.62), spsdk (>=1.3.0, <=1.5.0) +1 more potentially affected by CVE-2026-34073 via cryptography (3.4.3)

cryptography PYPI version 3.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - gcloud-connectors =0.1.58b10, =1.3.0, =0.1.29, =0.1.32 Source cves: CVE-2026-34073 Source advisory: OSV:PYSEC-2026-35...

gcloud-connectors (>=0.1.58b10, <=0.1.62), spsdk (>=1.3.0, <=1.5.0) +1 more potentially affected by CVE-2026-34073 via cryptography (3.4.3)

cryptography PYPI version 3.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - gcloud-connectors =0.1.58b10, =1.3.0, =0.1.29, =0.1.32 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

AZL-79404 CVE-2026-27601 affecting package python-sqlalchemy 1.4.32-2

Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the .flatten and .isEqual functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial of Service DoS attack by triggering a stack overflow...

superset-sqlalchemy-gizmosql-adbc-dialect (>=0.0.3, <=0.0.9) potentially affected by CVE-2026-23980 via apache-superset (5.0.0)

apache-superset PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-superset and may be impacted: - superset-sqlalchemy-gizmosql-adbc-dialect =0.0.3, =0.0.9 Source cves: CVE-2026-23980 Source advisory: OSV:GHSA-GVXG-9HQX-F4RG...

superset-sqlalchemy-gizmosql-adbc-dialect (>=0.0.3, <=0.0.9) potentially affected by CVE-2026-23982 via apache-superset (5.0.0)

apache-superset PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-superset and may be impacted: - superset-sqlalchemy-gizmosql-adbc-dialect =0.0.3, =0.0.9 Source cves: CVE-2026-23982 Source advisory: OSV:GHSA-3M2G-V7JF-7FXC...

superset-sqlalchemy-gizmosql-adbc-dialect (>=0.0.3, <=0.0.9) potentially affected by CVE-2026-23984 via apache-superset (5.0.0)

apache-superset PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-superset and may be impacted: - superset-sqlalchemy-gizmosql-adbc-dialect =0.0.3, =0.0.9 Source cves: CVE-2026-23984 Source advisory: OSV:GHSA-MWF2-QR4V-94H2...

superset-sqlalchemy-gizmosql-adbc-dialect (>=0.0.3, <=0.0.9) potentially affected by CVE-2026-23983 via apache-superset (5.0.0)

apache-superset PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-superset and may be impacted: - superset-sqlalchemy-gizmosql-adbc-dialect =0.0.3, =0.0.9 Source cves: CVE-2026-23983 Source advisory: OSV:GHSA-H294-8FXM-M2PJ...

quantguard (>=0.1.37, <=0.1.38), superset-sqlalchemy-gizmosql-adbc-dialect (>=0.0.3, <=0.0.9) potentially affected by CVE-2026-23982 via apache-superset (>=4.1.4, <=5.0.0)

apache-superset PYPI version =4.1.4, =0.1.37, =0.0.3, =0.0.9 Source cves: CVE-2026-23982 Source advisory: MEND:CVE-2026-23982...

quantguard (>=0.1.37, <=0.1.38), superset-sqlalchemy-gizmosql-adbc-dialect (>=0.0.3, <=0.0.9) potentially affected by CVE-2026-23984 via apache-superset (>=4.1.4, <=5.0.0)

apache-superset PYPI version =4.1.4, =0.1.37, =0.0.3, =0.0.9 Source cves: CVE-2026-23984 Source advisory: MEND:CVE-2026-23984...