https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T08:51:37.670344+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-ee96892 CLEANSTART-2026-EE96892 — Security fix for CVE-2026-50203 applied in: airflow-3 3.0.6-r1, airflow-3 3.1.8-r5, airflow-3 3.2.1-r5 2026-10-15T08:51:37.674895+00:00

Affected: CleanStart: airflow-3

CVE-2026-50203 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-328126 EUVD-2026-328126 2026-10-15T08:51:37.674939+00:00 EUVD-2026-328126 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50203 fkie_cve-2026-50203 2026-10-15T08:51:37.674955+00:00

A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade `apache-airflow-providers-sftp` to 5.8.1 or later.

 https://cve.radiocsirt.org/vuln/ghsa-qf38-jq28-3ccq GHSA-qf38-jq28-3ccq — Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory 2026-10-15T08:51:37.674980+00:00

Affected: PyPI: apache-airflow-providers-sftp

A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade `apache-airflow-providers-sftp` to 5.8.1 or later.

 https://cve.radiocsirt.org/vuln/pysec-2026-218 PYSEC-2026-218 2026-10-15T08:51:37.675003+00:00

Affected: PyPI: apache-airflow-providers-sftp

A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade `apache-airflow-providers-sftp` to 5.8.1 or later.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1969 WID-SEC-W-2026-1969 — Apache Airflow: Schwachstelle ermöglicht Manipulation von Dateien 2026-10-15T08:51:37.675023+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Airflow ausnutzen, um Dateien zu manipulieren.