Threats affecting pkg:pypi/apache/airflow

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	7.5	EPSS 0.7%	CVE-2026-31987Apache Airflow · Sensitive Data in Logs High7.5EPSS 0.7%2026-04-16CVE Database V5CVE-2026-31987 JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue. EPSS 0.7%Vulnerability Apache Software Foundation CWE-532	CVE Database V5	2026-04-16
Medium	5.4	EPSS 0.5%	CVE-2025-62402Apache Airflow · Execution with Unnecessary Privileges Medium5.4EPSS 0.5%2025-10-30CVE Database V5CVE-2025-62402 API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available. EPSS 0.5%Vulnerability Apache Software Foundation CWE-250	CVE Database V5	2025-10-30

Page 1 of 1