Threat database

A high-severity security vulnerability (CVE-2026-111066) affects the apache-superset package, specifically related to the AIOHTTP asynchronous HTTP client/server framework for asyncio and Python. The vulnerability impacts versions prior to 2021.38.2-r0 and 2021.36.5-r0. A fix has been released in these versions to address the issue.

CVE-2024-30251 is a high-severity security vulnerability affecting the apache-superset package, related to the aiohttp asynchronous HTTP client/server framework used in Python. The flaw impacts versions prior to 2021.38.2-r0 and 2021.36.5-r0. It does not affect confidentiality or integrity but causes a high impact on availability. A patch is available in versions 2021.38.2-r0 and 2021.36.5-r0.

A high-severity security vulnerability (CVE-2026-111064) affects the apache-superset package, related to the AIOHTTP asynchronous HTTP client/server framework used in Python. The vulnerability impacts versions prior to 2021.38.2-r0 and 2021.36.5-r0. A fix is available in these versions.

CVE-2024-23334 is a high-severity security vulnerability affecting the apache-superset package, related to the aiohttp asynchronous HTTP client/server framework for asyncio and Python. The vulnerability allows remote network attackers to cause a high impact on confidentiality without requiring privileges or user interaction. Fixed versions 2021.36.5-r0 and 2021.38.2-r0 address this issue.

A high-severity security vulnerability (CVE-2025-69223) affects the apache-superset package, specifically related to the AIOHTTP asynchronous HTTP client/server framework for asyncio and Python. The vulnerability impacts availability without compromising confidentiality or integrity. Fixed versions 2021.38.2-r0 and 2021.36.5-r0 are available.

A critical security vulnerability (CVE-2026-96639) affects the apache-superset package due to an issue in the Pillow Python imaging library. The flaw impacts versions of apache-superset prior to 2021.36.5-r0 and 2021.38.2-r0. The vulnerability has a high CVSS score of 9.8, indicating severe potential impact on confidentiality, integrity, and availability. Fixed versions are available, and patches should be applied to mitigate the risk.

A high-severity security vulnerability (CVE-2026-114605) affects the apache-superset package due to an issue in dnspython, a DNS toolkit for Python. The vulnerability has an impact on availability but does not affect confidentiality or integrity. Fixed versions are available.

A high-severity security vulnerability (CVE-2026-69244) affects the apache-superset package, related to the AIOHTTP asynchronous HTTP client/server framework for asyncio and Python. Versions prior to 2021.36.5-r0 and 2021.38.2-r0 are impacted. A fix is available in these versions.

A critical security vulnerability (CVE-2026-112900) affects the apache-superset package due to an issue in the Pillow Python imaging library. The flaw has a CVSS score of 9.8, indicating high severity with network attack vector, no privileges required, and impacts confidentiality, integrity, and availability. Fixed versions are 2021.36.5-r0 and 2021.38.2-r0.

A critical security vulnerability (CVE-2026-112403) affects the apache-superset package due to an issue in the Pillow Python imaging library. The flaw has a CVSS score of 9.8, indicating high severity with network attack vector, no privileges required, and no user interaction needed. Fixed versions 2021.36.5-r0 and 2021.38.2-r0 address this vulnerability.

A critical security vulnerability (CVE-2026-112398) affects the apache-superset package due to an issue in the Pillow Python imaging library. The flaw has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. Fixed versions 2021.36.5-r0 and 2021.38.2-r0 are available to remediate the issue.

A high-severity security vulnerability (CVE-2026-112396) affects the apache-superset package due to an issue in the Pillow Python imaging library. The vulnerability impacts versions of apache-superset prior to 2021.38.2-r0 and can cause a denial of service condition. A patch is available in version 2021.38.2-r0 to address this issue.

A security vulnerability identified as CVE-2026-44903 affects the keda package, which integrates with Prometheus, an open-source monitoring system and time series database. The vulnerability impacts versions of keda prior to 2.18.3-r0. It has a medium severity rating with a CVSS score of 6.1. A fix is available in version 2.18.3-r0.

A high-severity security vulnerability (CVE-2026-42154) affects the keda package, which includes Prometheus, an open-source monitoring system and time series database. The vulnerability impacts versions prior to 2.18.3-r0 and can cause a denial of service (availability impact). A fix is available in version 2.18.3-r0.

A high-severity security vulnerability (CVE-2026-42151) affects the keda package, which integrates with Prometheus, an open-source monitoring system and time series database. Versions of keda prior to 2.18.3-r0 are vulnerable. The vulnerability has a CVSS score of 7.5, indicating a network attack vector with low complexity and no privileges or user interaction required. Confidentiality impact is high, but integrity and availability are not affected. A patch is available in version 2.18.3-r0.

A high-severity security vulnerability (CVE-2026-97689) affects the miniforge3 package's urllib3 HTTP client library for Python. Versions prior to 26.7.2.1-r0 are impacted. A fix is available in version 26.7.2.1-r0.

A security vulnerability identified as CVE-2026-97688 affects the miniforge3 package, specifically in the urllib3 HTTP client library for Python. The vulnerability impacts versions of miniforge3 prior to 26.7.2.1-r0. A fix has been released in version 26.7.2.1-r0. The vulnerability has a medium severity rating with a CVSS score of 6.9. There are no known exploits in the wild at this time.

A high-severity security vulnerability (CVE-2026-97687) affects the miniforge3 package due to an issue in urllib3, a Python HTTP client library. Versions of miniforge3 prior to 26.7.2.1-r0 are impacted. A fix is available in version 26.7.2.1-r0.

A high-severity security vulnerability affects the miniforge3 package versions prior to 26.7.2.1-r0. The vulnerability does not impact confidentiality or integrity but causes a significant availability impact. The issue has been resolved in version 26.7.2.1-r0.

A high-severity vulnerability (CVE-2026-57585) affects the miniforge3 package, specifically in the MessagePack serializer implementation for Python msgpack. The flaw impacts versions prior to 26.7.2.1-r0 and can cause a denial of service condition. A patch is available in version 26.7.2.1-r0 to address this issue.