CVE-2026-0863: Improper Neutralization of Directives in Dynamically Evaluated Code

Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python code in the underlying operating system. The vulnerability can be exploited via the Code block by an authenticated user with basic permissio...

Insertion of Sensitive Information into Log File

Overview apache-airflow-task-sdk is a The Apache Airflow Task SDK includes interfaces for Dag authors and Task execution logic for Python. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the proxies and proxy fields in a Connection. An...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plugin (1.5.0) +27 more potentially affected by CVE-2025-68675 via apache-airflow-task-sdk (>=1.0.0rc4, <=1.1.5)

apache-airflow-task-sdk PYPI version =1.0.0rc4, =0.7.0, =0.6.1, =1.10.7, =0.1.0, =1.4.3, =1.2.10, =3.0.0rc3, =3.0.0rc3, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0rc1, =3.12.0rc1, =0.0.4, =0.0.6 and more Source cves: CVE-2025-68675 Source advisory: SNYK:PYTHON-APACHEAIRFLOWTASKSDK-15032621...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview apache-airflow-task-sdk is a The Apache Airflow Task SDK includes interfaces for Dag authors and Task execution logic for Python. Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the serialization for rendered...

Apache Airflow proxy credentials for various providers might leak in task logs

In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result,...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plugin (1.5.0) +27 more potentially affected by CVE-2025-68438 via apache-airflow-task-sdk (>=1.0.0rc4, <=1.1.5)

apache-airflow-task-sdk PYPI version =1.0.0rc4, =0.7.0, =0.6.1, =1.10.7, =0.1.0, =1.4.3, =1.2.10, =3.0.0rc3, =3.0.0rc3, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0rc1, =3.12.0rc1, =0.0.4, =0.0.6 and more Source cves: CVE-2025-68438 Source advisory: SNYK:PYTHON-APACHEAIRFLOWTASKSDK-15032537...

CVE-2025-68675

Apache Airflow versions before 3.1.6 and 2.11.1 are vulnerable to an information disclosure flaw where proxy credentials can be leaked. The root cause is that proxies and proxy fields within a Connection were not treated as sensitive by default, causing them to be included in log outputs without ...

EUVD-2026-2912

In Apache Airflow versions before 3.1.6, the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004288)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004288 advisory. In the Linux kernel, the following vulnerability has been resolved: parisc: led: Fix potential null-ptr-deref in starttask starttask calls createsinglethreadworkqueu...

PT-2026-63626

Уязвимость системы планирования и оперативного управления полётами OpenSky связана с непринятием мер по защите структуры запроса SQL при обработке параметров confirm, task. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнять произвольные SQL-запросы...

PT-2026-63623

Уязвимость системы планирования и оперативного управления полётами OpenSky связана с непринятием мер по защите структуры запроса SQL при обработке параметров test id, task id. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнять произвольные SQL-запросы...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000811)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000811 advisory. drivers/infiniband/ulp/srpt/ibsrpt.c in the Linux kernel before 4.5.1 allows local users to cause a denial of service NULL pointer dereference and system crash by...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000853)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000853 advisory. The pagemapopen function in fs/proc/taskmmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sensitive...

scsi: target: Reset t_task_cdb pointer in error case

...

SUSE CVE-2025-68782

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Reset ttaskcdb pointer in error case If allocation of cmd-ttaskcdb fails, it remains NULL but is later dereferenced in the 'err' path. In case of error, reset NULL ttaskcdb value to point at the default fixed-size...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002839)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002839 advisory. drivers/infiniband/ulp/srpt/ibsrpt.c in the Linux kernel before 4.5.1 allows local users to cause a denial of service NULL pointer dereference and system crash by...

PT-2026-3231

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.1.6 Description When rendered template fields in a Dag exceed max templated field length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This is due to the serialization of these...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003110)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003110 advisory. Race condition in the gettaskioprio function in block/ioprio.c in the Linux kernel before 4.6.6 allows local users to gain privileges or cause a denial of service...

PT-2026-3232

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.1.6 Description Apache Airflow versions before 3.1.6 did not properly handle sensitive information within proxy URLs in Connection objects. Specifically, proxy credentials embedded in the proxies and proxy...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003312)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003312 advisory. An issue was discovered in the Linux kernel before 4.20. There is a race condition in smptasktimedout and smptaskdone in drivers/scsi/libsas/sasexpander.c, leading t...