Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden accordi…

▾ Midnightapache · airflowEPSS 1.7%via NVD

Tagged “osv”

Aim Stored Cross-site Scripting Vulnerability

twisted.web has disordered HTTP pipeline response

Shell expansion in custom commands

Malicious code in google-cloud-datacatalog-lineage-producer-client (PyPI)

snapd failed to properly check the destination of symbolic links when extracting a snap

snapd failed to properly check the file type when extracting a snap

snapd failed to restrict writes to the $HOME/bin path

The Argo CD web terminal session does not handle the revocation of user permissions properly

OpenStack Nova vulnerable to unauthorized access to potentially sensitive data

Sentry vulnerable to stored Cross-Site Scripting (XSS)

Anki Latex Incomplete Blocklist Vulnerability

Ankitects Anki LaTeX Blocklist Bypass vulnerability

ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command

Ankitects Anki arbitrary script execution vulnerability

Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference

LoLLMS vulnerable to Expected Behavior Violation

Woodpecker's custom environment variables allow to alter execution flow of plugins

[PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`

Calibre-Web Cross Site Scripting (XSS)

`UserIdentity::is_verified` not checking verification status of own user identity while performing the check

gix-path can use a fake program files location

Kubernetes sets incorrect permissions on Windows containers logs

1Panel has an SQL injection issue related to the orderBy clause

TorchServe vulnerable to bypass of allowed_urls configuration

TorchServe gRPC Port Exposure

Sentry's Python SDK unintentionally exposes environment variables to subprocesses

Usage of non-constant time base64 decoder could lead to leakage of secret key material

dbt has an implicit override for built-in materializations from installed packages

Apache Airflow Potential Cross-site Scripting Vulnerability

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden accordi…