Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-66388 | medium | 6.5 | No | A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being proper... | 2026-11-03 |
| CVE-2025-66236 | high | 7.5 | No | Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay atte... | 2026-11-03 |
| CVE-2025-65995 | medium | 6.5 | No | When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs... | 2026-11-03 |
| CVE-2025-62402 | medium | 5.4 | No | API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the e... | 2026-11-03 |
| CVE-2025-57735 | critical | 9.1 | No | When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it... | 2026-11-03 |
| CVE-2025-54941 | medium | 4.6 | No | An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server an... | 2026-11-03 |
| CVE-2025-54831 | medium | 6.5 | No | Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive... | 2026-11-03 |
| CVE-2025-54550 | high | 8.1 | No | The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that co... | 2026-11-03 |
| CVE-2026-94290 | critical | 9.1 | No | SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster... | 2026-11-03 |
| CVE-2026-94349 | high | 8.0 | No | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Comm... | 2026-11-03 |
| CVE-2026-88811 | critical | 9.1 | No | Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This aff... | 2026-11-03 |
| CVE-2026-88810 | high | 7.2 | No | A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRo... | 2026-11-03 |
| CVE-2026-8923 | high | 8.7 | No | Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution... | 2026-11-03 |
| CVE-2026-68591 | medium | 6.7 | No | In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if... | 2026-11-03 |
| CVE-2026-68589 | medium | 6.7 | No | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malic... | 2026-11-03 |
| CVE-2026-20599 | medium | 6.7 | No | In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if... | 2026-11-03 |
| CVE-2026-20595 | medium | 6.7 | No | In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a... | 2026-11-03 |
| CVE-2026-20591 | high | 8.4 | No | In GPU pdma, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege... | 2026-11-03 |
| CVE-2026-20585 | high | 7.5 | No | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE... | 2026-11-03 |
| CVE-2026-20584 | medium | 6.7 | No | In usb, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege if a malicious... | 2026-11-03 |