Security advisories

high2026-06-01

CVE-2026-49361-Apache Fluss: Unauthenticated remote attackers can exhaust JVM heap memory using crafted frame headers via TabletServer/CoordinatorServer

apache/fluss · GHSA-4c39-fwgj-4vq7

low2026-06-01

CVE-2026-45426-Apache Airflow has an Incorrect Authorization issue

apache/airflow · GHSA-x5wm-j6wh-2834

high2026-06-01

CVE-2026-42359-Apache Airflow has a Deserialization of Untrusted Data vulnerability

apache/airflow · GHSA-wr76-29cr-67w8

high2026-06-01

CVE-2026-45505-Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue

apache/activemq · GHSA-v853-w46p-fv2h

high2026-06-01

CVE-2026-44825-Apache Solr has hardcoded credentials in the Basic Authentication setup tool

apache/lucene-solr · GHSA-qhr7-h655-pw6r

high2026-06-01

CVE-2026-41084-Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key

apache/airflow · GHSA-mxq5-f9c5-w4p5

high2026-06-01

CVE-2026-42588-Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue

apache/activemq · GHSA-hg6c-8mvr-jqc9

medium2026-06-01

CVE-2026-42360-Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

apache/airflow · GHSA-cg3x-89rc-x9mw

critical2026-06-01

CVE-2026-42252-Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine

apache/airflow · GHSA-c85c-g9wv-pph2

medium2026-06-01

CVE-2026-42253-Apache ActiveMQ, Apache ActiveMQ Web have a Cross-site Scripting issue

apache/activemq · GHSA-8wm6-6fqh-phmc

medium2026-06-01

CVE-2026-42358-Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

apache/airflow · GHSA-33g2-gx67-c2h3

high2026-06-01

CVE-2026-45360-Apache Airflow Vulnerable to Deserialization of Untrusted Data

apache/airflow · GHSA-2r5m-76wx-56gx

medium2026-06-01

CVE-2026-41014-Apache Airflow has a Missing Authorization issue

apache/airflow · GHSA-x2x7-p37c-43cr

low2026-06-01

CVE-2026-40963-Apache Airflow has an Improper Authorization issue

apache/airflow · GHSA-gprj-xvq8-w53q

medium2026-06-01

CVE-2026-41017-Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

apache/airflow · GHSA-95v7-h9j5-gvjr

medium2026-06-01

CVE-2026-40861-Apache Airflow has a Link Following issue

apache/airflow · GHSA-89cj-xrpx-j79m

high2026-06-01

CVE-2026-40961-Apache Airflow: Authenticated users can bypass the `is_safe_url` check

apache/airflow · GHSA-6hcw-qqr8-pjj8

medium2026-06-01

CVE-2026-10517-Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints

quay/claircore · GHSA-698x-9w2p-7vvp

medium2026-06-01

CVE-2026-45192-Apache Airflow: Incomplete redaction allowlist exposes secrets in Connection `extra`  to read-permitted users

apache/airflow · GHSA-2883-wwh7-x57v

high2026-06-01

CVE-2026-35563-Apache Directory LDAP API lacks server certificate verification for LDAP hostnames

apache/directory-ldap-api · GHSA-85rw-g4f4-jprr