Security advisories

medium2026-08-12

CVE-2026-68971-Apache Airflow missing team context permits cross-team Dag actions and XCom reads

View chart →

apache/airflow · GHSA-5247-m8w9-2v4m

high2026-08-12

CVE-2026-67260-Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargs

View chart →

apache/airflow · GHSA-q4c3-7575-55j2

high2026-08-12

CVE-2026-68968-Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass

View chart →

apache/airflow · GHSA-j4jc-cq9h-xrhr

medium2026-08-12

CVE-2026-54183-Apache Airflow Variables UI fails to mask sensitive values in deeply nested iterables

View chart →

apache/airflow · GHSA-g4qj-5vxv-wggf

medium2026-08-12

CVE-2026-59242-Apache Airflow XCom API permits unsafe deserialization through JSON string literals

View chart →

apache/airflow · GHSA-fcmm-42r9-mmmm

medium2026-08-12

CVE-2026-65017-Apache Airflow Config API exposes team-scoped sensitive configuration values

View chart →

apache/airflow · GHSA-c56v-8w4g-3mfm

medium2026-08-12

CVE-2026-68076-Apache Airflow environment-variable secrets backend permits cross-team credential use

View chart →

apache/airflow · GHSA-75mg-c62r-v95g

high2026-08-12

CVE-2026-67587-Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the scheduler

View chart →

apache/airflow · GHSA-2qjv-p2gc-mjg2

medium2026-08-12

CVE-2026-59244-Apache Airflow exposes dict-valued var.json secrets in Rendered Templates

View chart →

apache/airflow · GHSA-f643-3rc2-j27w

high2026-08-12

CVE-2026-58076-Apache Airflow exception-node deserialization permits arbitrary callable execution

View chart →

apache/airflow · GHSA-8prw-8m6x-8w6f

high2026-08-12

CVE-2026-52776-compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

View chart →

oscal-compass/compliance-trestle · GHSA-h47f-gmjp-m7rr

high2026-08-12

CVE-2026-48798-SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

View chart →

sshnet/ssh.net · GHSA-q939-rpr3-3284

medium2026-08-12

CVE-2026-48786-Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

View chart →

fleetdm/fleet · GHSA-88p2-jj8w-j8qg

medium2026-08-12

CVE-2026-47132-phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

View chart →

thorsten/phpmyfaq · GHSA-6pvm-2vjj-rx4w

high2026-08-12

CVE-2026-46369-nimiq-blockchain: Validity store off by one error

View chart →

nimiq/core-rs-albatross · GHSA-3763-qp59-59vf

medium2026-08-12

CVE-2026-45694-LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment

View chart →

librenms/librenms · GHSA-jmqm-f8q4-v7wx

high2026-08-12

CVE-2026-35445-Winter: Authenticated backend users can bypass Users controller permission checks

View chart →

wintercms/winter · GHSA-j5jq-cr68-v2xx

medium2026-08-12

CVE-2026-32639-Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

View chart →

wintercms/winter · GHSA-5c4f-9pq9-6c77

medium2026-08-12

CVE-2026-32593-Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax

View chart →

wintercms/winter · GHSA-m7jc-g4rc-jmvh

high2026-08-12

CVE-2026-32258-Winter: Stored XSS through Editor Settings custom styles

View chart →

wintercms/winter · GHSA-vgp4-2fc4-qff2