Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under camelCase keys such as `privateKey`, `connectionString`, `webhookUrl` or `accessKey` — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template fields or API responses. A user who can read task logs or rendered templates, but is not meant to see those credentials, could read them in cleartext. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress asset-triggered runs of Dags they cannot edit. This is an incomplete fix for CVE-2026-75157: users who upgraded to apache-airflow 3.3.2 for that fix are still affected and should upgrade to apache-airflow 3.4.0 or later.
Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
CVE-2026-111455 is an authorization vulnerability in Apache Airflow affecting versions 3.3.0 up to but not including 3.4.0. The flaw occurs when the asynchronous connection test feature is enabled (a non-default setting). A user with permission to create connections but not edit them can overwrite an existing connection if it was created by someone else during the test process. This is due to improper permission checks during the commit phase of the test. The issue is fixed in Apache Airflow version 3.4.0.
CVE-2026-124585 is a critical OS command injection vulnerability in the Web Administration Interface of Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. The flaw exists in the add_expmac function of the var/html/webserver component, where manipulation of the mac argument allows remote attackers to execute arbitrary OS commands. The vulnerability has a high CVSS 4.0 score of 9.4, indicating severe impact. The vendor was notified but has not responded or issued a fix. Public exploit code is available, increasing the risk of exploitation.
CVE-2026-123870 is a critical vulnerability in the Eclipse Foundation's otterdog web application. The vulnerability arises because the application uses Python's eval() function to process a format-string constructed from incoming GitHub webhook JSON data. If the GITHUB_WEBHOOK_SECRET configuration is unset or empty, the application skips the HMAC signature verification, allowing unauthenticated attackers to send malicious input that is evaluated by Python, leading to arbitrary code execution on the host.
CVE-2026-116337 is a low-severity vulnerability in the Qt Framework affecting the HTTP response handling functionality of the Qt Network module. It involves uncontrolled resource consumption due to allocation of resources without limits or throttling. This flaw can lead to resource exhaustion under certain conditions. The issue affects Qt Framework versions from 4.5.0 up to but not including 6.8.10 and from 6.9.0 up to but not including 6.12.1. Fixed versions are 6.8.10 and 6.12.1.
A vulnerability has been found in wummel patool 4.1.0. This vulnerability affects the function extract_gzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads to symlink following. Local access is required to approach this attack. The researcher claims to have submitted a GHSA on the repository of the project.
A time-of-check time-of-use (TOCTOU) race condition vulnerability exists in TÜBİTAK BİLGEM Software Technologies Research Institute's Pardus MyComputer software versions from 0.8.0 up to but not including 0.8.1. This flaw allows an attacker to leverage the timing window between checking a condition and using a resource, potentially leading to unauthorized modification or interference. The issue is fixed in version 0.8.1.
Google DeepMind's AI agents, in collaboration with cryptographers, have developed methods that reduce the computational cost of attacking 1024-bit RSA keys. These advances include a more efficient forgery attack on RSA-1024 signatures using PKCS#1 v1.5 padding and a theoretical algorithm that lowers the cost of factoring multiple 1024-bit RSA keys. The findings affect only legacy 1024-bit RSA systems, which are considered obsolete, while modern encryption protocols using 2048-bit or larger keys remain secure.
CVE-2026-124582 is a path traversal vulnerability in WebTorrent affecting versions 2.8.0 through 2.8.5 and 3.0.0 through 3.0.13. The flaw exists in the getFileModtimes function of the torrent.js file within the File Path Handler component. This vulnerability allows remote attackers to manipulate file.path arguments to perform path traversal attacks. The issue was publicly disclosed with an available exploit, but the related GitHub issue was closed as "not planned" for a fix. The CVSS 4.0 base score is 5.3, indicating medium severity.
Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Privilege Abuse.
This issue affects Liderahenk: before 2.0.3.
The logger-libs package on PyPI contains malicious code in versions 0.4.1, 0.4.2, 0.4.3, 0.4.5, and 0.4.6. The malware is obfuscated and spreads its payload across multiple files, reconstructing it at runtime. It downloads and executes remote malicious scripts and includes code to execute remote commands on the victim's machine, likely limited to specific commands.
CVE-2026-124581 is a SQL injection vulnerability in itsourcecode Airline Reservation System version 1.0. The flaw exists in an unspecified function within the /admin/manage_flight.php file, where manipulation of the ID parameter allows remote attackers to execute SQL injection attacks. The vulnerability has been publicly disclosed and exploit code is available, but no evidence of exploitation in the wild has been reported. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.
The u-chan-secrets npm package version 5.2.1 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it, as full control of the system may have been given to an attacker.
A buffer overflow vulnerability exists in the libgd library when processing specially crafted GIF files. This vulnerability is identified as CVE-2026-9672 and affects the GD open source code library used for dynamic image creation. The issue has been addressed in an update provided by Red Hat for their Extended Life Cycle Support Extension 6. The vulnerability is rated as having an important security impact by Red Hat.
CVE-2026-124580 is a critical OS command injection vulnerability in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. It affects the handle_wechat_cn_wifi function in the Weixin Auth Endpoint component, allowing remote attackers to execute arbitrary OS commands by manipulating the 'extend' argument. The vulnerability has a CVSS 4.0 base score of 10.0, indicating maximum severity. Exploit code has been publicly disclosed, but the vendor has not responded or provided a fix.
CVE-2026-113437 is a path traversal vulnerability in DOS Co., Ltd.'s SS1 and SS1 Cloud products, as well as the ODM product rocoeyes by Rococo Co. Ltd. This flaw allows an attacker to delete arbitrary files by improperly limiting pathname access to restricted directories. The vulnerability has a CVSS 3.0 base score of 5.3, indicating a medium severity level. No public exploits or known active exploitation have been reported. The affected version is specified as version 0. No patch or remediation information is provided.
CVE-2026-109582 is a medium severity vulnerability in DOS Co., Ltd.'s SS1 product involving insecure storage of sensitive information. This flaw allows sensitive data used by the product to potentially be obtained by unauthorized parties. The vulnerability has a CVSS 3.0 base score of 4.0, indicating limited impact primarily on confidentiality with no impact on integrity or availability. No known exploits or patches are currently reported.
CVE-2026-124579 is an injection vulnerability in aaPanel BillionMail versions 4.0 through 4.9. It affects the Relay Configuration API component, specifically the file core/api/relay/v1/relay.go. The issue arises from manipulation of the helo_name argument, which can be exploited remotely. The vulnerability has a medium severity with a CVSS score of 5.3. Public exploit code has been disclosed, but the vendor has not responded or provided a patch.