今日共收录 1881 条安全情报，包含 959 个 CVE，493 篇安全通告，以及 113 篇研究论文。
← 返回归档列表CVE-2026-68970
Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that
CVE-2026-68969
Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submit
CVE-2026-68968
Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` pa
CVE-2026-68759
A holder of a valid integration credential may impersonate other users under specific conditions.
CVE-2026-68758
A low-privileged authenticated user may access restricted support information under specific conditions.
CVE-2026-67587
Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports
CVE-2026-67260
Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the
CVE-2026-66384
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
CVE-2026-66016
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessi
CVE-2026-65941
In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affecte
CVE-2026-65940
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible l
CVE-2026-65939
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arb
CVE-2026-65938
In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API
CVE-2026-65937
In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject per
CVE-2026-65926
An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release B
CVE-2026-65017
Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an a
CVE-2026-64639
Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (cu
CVE-2026-59244
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates
CVE-2026-59242
Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload th
CVE-2026-58076
Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken fr