Most recent entries from all

Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 22:32:40 +0000 bdu:2024-03288 https://cve.radiocsirt.org/vuln/bdu:2024-03288 bdu:2024-03288 https://cve.radiocsirt.org/vuln/bdu:2024-03288 BIT-airflow-2024-31869 — Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used https://cve.radiocsirt.org/vuln/bit-airflow-2024-31869 <p><strong>Affected:</strong> Bitnami: airflow</p> <p>Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.</p> <p><strong>Affected:</strong> Bitnami: airflow</p> <p>Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.</p> https://cve.radiocsirt.org/vuln/bit-airflow-2024-31869 cnvd-2024-20804 https://cve.radiocsirt.org/vuln/cnvd-2024-20804 cnvd-2024-20804 https://cve.radiocsirt.org/vuln/cnvd-2024-20804 EUVD-2026-222471 https://cve.radiocsirt.org/vuln/euvd-2026-222471 EUVD-2026-222471 https://cve.radiocsirt.org/vuln/euvd-2026-222471 fkie_cve-2024-31869 https://cve.radiocsirt.org/vuln/fkie_cve-2024-31869 <p>Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.</p> <p>Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-31869 GHSA-2522-mrjc-m688 — Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used https://cve.radiocsirt.org/vuln/ghsa-2522-mrjc-m688 <p><strong>Affected:</strong> PyPI: apache-airflow</p> <p>Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.</p> <p><strong>Affected:</strong> PyPI: apache-airflow</p> <p>Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.</p> https://cve.radiocsirt.org/vuln/ghsa-2522-mrjc-m688 gsd-2024-31869 https://cve.radiocsirt.org/vuln/gsd-2024-31869 gsd-2024-31869 https://cve.radiocsirt.org/vuln/gsd-2024-31869 PYSEC-2026-1128 — Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used https://cve.radiocsirt.org/vuln/pysec-2026-1128 <p><strong>Affected:</strong> PyPI: apache-airflow</p> <p>Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.</p> <p><strong>Affected:</strong> PyPI: apache-airflow</p> <p>Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1128