https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 23:37:19 +0000 https://cve.radiocsirt.org/vuln/cve-2024-31869 <p><strong>Affected:</strong> Apache Software Foundation Apache Airflow</p> <p>Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the &#34;configuration&#34; UI page when &#34;non-sensitive-only&#34; was set as &#34;webserver.expose_config&#34; configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your &#34;expose_config&#34; configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Airflow</p> <p>Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the &#34;configuration&#34; UI page when &#34;non-sensitive-only&#34; was set as &#34;webserver.expose_config&#34; configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your &#34;expose_config&#34; configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.</p> https://cve.radiocsirt.org/vuln/cve-2024-31869