https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:51:29 +0000 https://cve.radiocsirt.org/vuln/cleanstart-2026-az09261 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Multiple security vulnerabilities affect the airflow-3 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Multiple security vulnerabilities affect the airflow-3 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-az09261 https://cve.radiocsirt.org/vuln/euvd-2026-308075 EUVD-2026-308075 https://cve.radiocsirt.org/vuln/euvd-2026-308075 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41016 <p>Apache Airflow&#39;s SMTP provider `SmtpHook` called Python&#39;s `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade to the `apache-airflow-providers-smtp` version that contains the fix.</p> <p>Apache Airflow&#39;s SMTP provider `SmtpHook` called Python&#39;s `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade to the `apache-airflow-providers-smtp` version that contains the fix.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41016 https://cve.radiocsirt.org/vuln/ghsa-x8mh-94wc-33gv <p><strong>Affected:</strong> PyPI: apache-airflow-providers-smtp</p> <p>Apache Airflow&#39;s SMTP provider `SmtpHook` called Python&#39;s `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade to the `apache-airflow-providers-smtp` version that contains the fix.</p> <p><strong>Affected:</strong> PyPI: apache-airflow-providers-smtp</p> <p>Apache Airflow&#39;s SMTP provider `SmtpHook` called Python&#39;s `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade to the `apache-airflow-providers-smtp` version that contains the fix.</p> https://cve.radiocsirt.org/vuln/ghsa-x8mh-94wc-33gv https://cve.radiocsirt.org/vuln/pysec-2026-24 <p><strong>Affected:</strong> PyPI: apache-airflow-providers-smtp</p> <p>Apache Airflow&#39;s SMTP provider `SmtpHook` called Python&#39;s `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade to the `apache-airflow-providers-smtp` version that contains the fix.</p> <p><strong>Affected:</strong> PyPI: apache-airflow-providers-smtp</p> <p>Apache Airflow&#39;s SMTP provider `SmtpHook` called Python&#39;s `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade to the `apache-airflow-providers-smtp` version that contains the fix.</p> https://cve.radiocsirt.org/vuln/pysec-2026-24