393 matches found
apache__dolphinscheduler_CVE-2023-51770_3_2_1_fixed
Apache Dolphinscheduler About Apache DolphinScheduler is the modern data orchestration platform. Agile to create high performance workflow with low-code. It is also provided powerful user interface, dedicated to solving complex task dependencies in the data pipeline and providing various types of...
CVE-2022-24706
CVE-2022-24706 Apache CouchDB 3.2.1 - Remote Code Execution RCE Checker Usage: nmap -p 4369 --script CVE-2022-24706.nse --script-args cookie=monster,timeout=5000...
EUVD-2026-63316
Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...
CLSA-2026-1784164088 TuxCare security update for jquery (2 CVEs)
TuxCare rebuilt jquery to address 2 CVEs. Fixed in 3.2.1-tuxcare.1...
CLSA-2025-1766362094 TuxCare security update for org.apache.maven.shared:maven-shared-utils (1 CVE)
TuxCare rebuilt org.apache.maven.shared:maven-shared-utils to address 1 CVE. Fixed in 3.2.1-tuxcare.1...
Veeam Backup for Salesforce Backend Service Fails to Start After Upgrading to Version 3.2.1 or Later
Challenge After Veeam Backup for Salesforce is upgraded from version 2.1.1 or earlier to version 3.2.1 or later, the vbsf-backend service fails to start. The state of the service can be confirmed with the following command: sudo systemctl status vbsf-backend Copy The output shows that the service...
CLEANSTART-2026-PZ43099 Security fixes in airflow-3 3.2.1-r4
Package airflow-3 version 3.2.1-r4 fixes 16 vulnerabilities: ghsa-4m7w-qmgq-4wj5, ghsa-9x8q-7h8h-wcw9, ghsa-537c-gmf6-5ccf, ghsa-4xpc-pv4p-pm3w, ghsa-5rvq-cxj2-64vf...
CVE-2026-48758
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature...
EUVD-2026-44501
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature...
CVE-2026-48758
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature...
CVE-2026-48758 sigstore-js: DSSE payloadType type-binding failure
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature...
Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record
The authenticated /ui/dagsendpoint did not enforce per-DAG access control on embedded Human-in-the-Loop HITL and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts including their request parameters and full TaskInstance details for DAG...
PYSEC-2026-2356 Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions
The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope. Users are...
Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions
The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope.Users are...
PT-2026-59037
The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope. Users are...
PT-2026-57831
These are all security issues fixed in the libopenbabel8-3.2.1-1.1 package on the GA media of openSUSE Tumbleweed...
SUSE CVE-2026-59926
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, renderadmonition in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even...
PYSEC-2026-2214
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, renderadmonition in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even...
PYSEC-2026-2214
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, renderadmonition in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even...
DEBIAN-CVE-2026-59926
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, renderadmonition in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even...