https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T12:16:20.128226+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-airflow-2026-25917 BIT-airflow-2026-25917 — Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5) 2026-10-05T12:16:20.132651+00:00

Affected: Bitnami: airflow

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.

Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-292453 EUVD-2026-292453 2026-10-05T12:16:20.132713+00:00 EUVD-2026-292453 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25917 fkie_cve-2026-25917 2026-10-05T12:16:20.132730+00:00

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.

Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-6ffj-2wg2-w45j GHSA-6ffj-2wg2-w45j — Apache Airflow allows code execution through crafted XCom payloads 2026-10-05T12:16:20.132756+00:00

Affected: PyPI: apache-airflow-core

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/pysec-2026-13 PYSEC-2026-13 2026-10-05T12:16:20.132779+00:00

Affected: PyPI: apache-airflow

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.

Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1168 WID-SEC-W-2026-1168 — Apache Airflow und Apache Airflow Keycloak Provider: Mehrere Schwachstellen 2026-10-05T12:16:20.132798+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Airflow und dem Airflow Keycloak Provider ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.