https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T22:56:02.164559+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-airflow-2025-65995 BIT-airflow-2025-65995 — Apache Airflow: Disclosure of secrets to UI via kwargs 2026-10-06T22:56:02.168372+00:00

Affected: Bitnami: airflow

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG.

The issue has been fixed in Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0500 certfr-2026-avi-0500 — De multiples vulnérabilités ont été découvertes dans VMware Tanzu. Elles permettent à un attaquant de provoquer un prob… 2026-10-06T22:56:02.168437+00:00 certfr-2026-avi-0500 https://cve.radiocsirt.org/vuln/euvd-2026-274896 EUVD-2026-274896 2026-10-06T22:56:02.168459+00:00 EUVD-2026-274896 https://cve.radiocsirt.org/vuln/fkie_cve-2025-65995 fkie_cve-2025-65995 2026-10-06T22:56:02.168473+00:00

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG.

The issue has been fixed in Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.

 https://cve.radiocsirt.org/vuln/ghsa-gfw7-2v73-69wg GHSA-gfw7-2v73-69wg — Apache Airflow error reporting may expose full kwargs 2026-10-06T22:56:02.168498+00:00

Affected: PyPI: apache-airflow

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG.

The issue has been fixed in Airflow 3.1.5rc1 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.

 https://cve.radiocsirt.org/vuln/pysec-2026-2348 PYSEC-2026-2348 — Apache Airflow error reporting may expose full kwargs 2026-10-06T22:56:02.168523+00:00

Affected: PyPI: apache-airflow

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG.

The issue has been fixed in Airflow 3.1.5rc1 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.