https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:05:59.926282+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-az09261 Withdrawn: CLEANSTART-2026-AZ09261 — Security fixes for CVE-2023-46136, CVE-2024-12797, CVE-2024-34069, CVE-2024-49766, CVE-2024-49767, CVE-2025-62727, CVE-… 2026-10-03T03:05:59.936795+00:00

Withdrawn by the publisher.

Affected: CleanStart: airflow-3

Multiple security vulnerabilities affect the airflow-3 package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-309402 EUVD-2026-309402 2026-10-03T03:05:59.936875+00:00 EUVD-2026-309402 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41018 fkie_cve-2026-41018 2026-10-03T03:05:59.936898+00:00

The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.

 https://cve.radiocsirt.org/vuln/ghsa-g3jr-4jrm-jvqv GHSA-g3jr-4jrm-jvqv — Apache Airflow Providers Elasticsearch: Elasticsearch task-log handlers leak credentials embedded in the host URL 2026-10-03T03:05:59.936936+00:00

Affected: PyPI: apache-airflow-providers-elasticsearch

The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.

 https://cve.radiocsirt.org/vuln/pysec-2026-22 PYSEC-2026-22 2026-10-03T03:05:59.936977+00:00

Affected: PyPI: apache-airflow-providers-elasticsearch

The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41018 UBUNTU-CVE-2026-41018 2026-10-03T03:05:59.937010+00:00

Affected: Ubuntu:16.04:LTS: elasticsearch

The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1452 WID-SEC-W-2026-1452 — Apache Airflow Providers OpenSearch und Elasticsearch: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen 2026-10-03T03:05:59.937040+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Airflow Providers OpenSearch und Elasticsearch ausnutzen, um Informationen offenzulegen.