CVE Уведомления

Мониторинг уязвимостей, аналитика угроз и оперативные CVE-оповещения. База данных актуальных уязвимостей (Common Vulnerabilities and Exposures) с подробным описанием рисков, оценкой критичности по шкале CVSS и официальными рекомендациями по устранению.

  • CVE-2026-105967

    🚨 CVE-2026-105967 The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform...

  • CVE-2026-105993

    🚨 CVE-2026-105993 The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers...

  • CVE-2026-106004

    🚨 CVE-2026-106004 The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing...

  • CVE-2026-115205

    🚨 CVE-2026-115205 The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting...

  • CVE-2025-54831

    🚨 CVE-2025-54831 Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access...

  • CVE-2025-54941

    🚨 CVE-2025-54941 An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a...

  • CVE-2025-66388

    🚨 CVE-2025-66388 A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not...

  • CVE-2025-68438

    🚨 CVE-2025-68438 In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length...

  • CVE-2026-22922

    🚨 CVE-2026-22922 Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom...

  • CVE-2026-24098

    🚨 CVE-2026-24098 Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more...

  • CVE-2025-65995

    🚨 CVE-2025-65995 When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If...

  • CVE-2026-26929

    🚨 CVE-2026-26929 Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when...

  • CVE-2026-28563

    🚨 CVE-2026-28563 Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by...

  • CVE-2026-28779

    🚨 CVE-2026-28779 Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured...

  • CVE-2025-68675

    🚨 CVE-2025-68675 In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs...

  • CVE-2025-62402

    🚨 CVE-2025-62402 API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was...

  • CVE-2026-30911

    🚨 CVE-2026-30911 Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL)...

  • CVE-2026-34538

    🚨 CVE-2026-34538 Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run...

Статистика статей

Статьи
53,092
Просмотры
273,024
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.
Назад
Сверху