Apache security advisories, September 2026

Apache advisories published in September 2026

1. Sep 30, 2026
   Critical [CVE-2026-89238] WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass

   Critical9.1

2. Sep 30, 2026
   Critical [CVE-2026-88920] authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key

   Critical9.8

3. Sep 30, 2026
   Critical [CVE-2026-87830] In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path

   Critical9.1

4. Sep 30, 2026
   Critical [CVE-2026-77185] Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server

   Critical9.1

5. Sep 30, 2026
   Critical [CVE-2026-94053] Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5

   Critical9.1

6. Sep 30, 2026
   Critical [CVE-2026-94052] missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks

   Critical9.1

7. Sep 30, 2026
   Critical [CVE-2026-102508] Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker in a network position between client and server to impersonate the OPC UA server and to read, forge or modify secure-channel traffic, including user credential ssent by the client

   Critical9.2

8. Sep 30, 2026
   High [CVE-2026-95616] integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation

   High7.5

9. Sep 30, 2026
   High [CVE-2026-92121] In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set

   High7.5

10. Sep 30, 2026
    High [CVE-2026-85532] Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds

    High7.5

11. Sep 30, 2026
    High [CVE-2026-93994] Apache MINA SSHD is a Java library for client-side and server-side SSH

    High8.1

12. Sep 30, 2026
    High [CVE-2026-94002] Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5

    High7.5

13. Sep 30, 2026
    High [CVE-2026-102511] Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address

    High8.5

14. Sep 30, 2026
    High [CVE-2026-102509 +1] Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache PLC4X (PLC4Go) allow a malicious device, or an attacker able to inject network traffic, to crash or exhaust the memory of the client application, causing a denial of service

    High8.7

15. Sep 30, 2026
    High [CVE-2026-102509 +1] Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X (PLC4J) allow a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service

    High8.7

16. Sep 30, 2026
    Medium [CVE-2026-92899] Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce

    Medium4.8

17. Sep 30, 2026
    Medium [CVE-2026-58624 +1] Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5

    Medium6.5

18. Sep 30, 2026
    Medium [CVE-2026-93996] Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5

    Medium6.5

19. Sep 30, 2026
    Medium [CVE-2026-94029] Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension

    Medium6.5

20. Sep 29, 2026
    Critical [CVE-2026-91048] The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg

    Critical9.8

21. Sep 29, 2026
    Critical [CVE-2026-91012] org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside ${karaf.etc}: * if the submitted property map contains a felix.fileinstall.filename entry, that value is turned directly into a File (getCfgFileFromProperty), so it can point to any absolute path the Karaf process can write to; * otherwise the configuration PID is concatenated verbatim into the target file name (generateConfigFilename: new File(karaf.etc, pid + ".cfg")), so a PID containing ".." segments resolves outside ${karaf.etc}

    Critical9.8

22. Sep 29, 2026
    High [CVE-2026-97395] Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata

    High8.1

23. Sep 29, 2026
    High [CVE-2026-82804] Apache DolphinScheduler: The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution

    High8.8

24. Sep 29, 2026
    High [CVE-2026-102497] The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups

    High7.5

25. Sep 29, 2026
    High [CVE-2026-102496] Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows

    High7.5

26. Sep 29, 2026
    High [CVE-2026-102495] Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows

    High7.5

27. Sep 29, 2026
    High [CVE-2026-92142] Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry/server, enabled by default on ports 1099 and 44444)

    High8.8

28. Sep 29, 2026
    Medium [CVE-2026-71897] improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions

    Medium4.3

29. Sep 29, 2026
    Medium [CVE-2026-71898] incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint

    Medium4.3

30. Sep 29, 2026
    Medium [CVE-2026-71899] missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler

    Medium6.5

31. Sep 29, 2026
    Medium [CVE-2026-78214] Apache DolphinScheduler: authentication bypass vulnerability exists in the protection of Actuator endpoints

    Medium5.3

32. Sep 29, 2026
    Medium [CVE-2026-81569] Apache DolphinScheduler: improper authorization vulnerability exists in the handling of sub-workflow tasks

    Medium4.3

33. Sep 29, 2026
    Medium [CVE-2026-66083] Apache DolphinScheduler: The /datasources/unauth-datasource endpoint does not properly enforce data source authorization

    Medium6.5

34. Sep 29, 2026
    Medium [CVE-2026-86843] The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL

    Medium6.3

35. Sep 29, 2026
    Medium [CVE-2026-81930] Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs

    Medium6.3

36. Sep 29, 2026
    Medium [CVE-2026-81862] Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements

    Medium6.5

37. Sep 29, 2026
    Medium [CVE-2026-81914] Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them

    Medium4.3

38. Sep 29, 2026
    Medium [CVE-2026-91085] Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg)

    Medium6.3

39. Sep 28, 2026
    Critical [CVE-2026-82384] Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication

    Critical9.8

40. Sep 28, 2026
    Critical [CVE-2026-82377] Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the weblog or entry actually affected

    Critical9.9

41. Sep 28, 2026
    Critical [CVE-2026-82378] Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer to bind that token to an arbitrary user account, including an administrator, by submitting an unsigned authorization request

    Critical9.0

42. Sep 28, 2026
    High [CVE-2026-91006] Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows)

    High8.8

43. Sep 28, 2026
    High [CVE-2026-90979] LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login name, the resolved user DN, and its fully qualified namespace form) into administrator-configured filter templates (userFilter, roleFilter)

    High7.3

44. Sep 28, 2026
    High [CVE-2026-82379] Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness

    High7.7

45. Sep 28, 2026
    High [CVE-2026-82380] Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a value the server itself generated for the request

    High8.1

46. Sep 28, 2026
    High [CVE-2026-82383] Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance, because the setup action remains anonymously reachable after installation and persists configuration without an authorization check

    High8.2

47. Sep 28, 2026
    High [CVE-2026-82375] Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling

    High7.4

48. Sep 28, 2026
    High [CVE-2026-82376] Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse an attacker-influenced trackback response with an XML parser that does not disable external entity resolution, leading to disclosure of files readable by the Roller process

    High7.7

49. Sep 28, 2026
    High [CVE-2026-82386] Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity resolution

    High7.7

50. Sep 28, 2026
    High [CVE-2026-82348] Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog through unscoped identifier-based lookups

    High7.7

51. Sep 28, 2026
    Medium [CVE-2026-86507] Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed

    Medium6.1

52. Sep 28, 2026
    Medium [CVE-2026-82381] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding, causing the stored script to execute in another author's or administrator's browser

    Medium5.4

53. Sep 28, 2026
    Medium [CVE-2026-82382] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage theme, by supplying a crafted blog-directory parameter that the directory page reflects without proper escaping

    Medium6.1

54. Sep 28, 2026
    Medium [CVE-2026-82385] Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath resource outside the theme namespace

    Medium6.5

55. Sep 28, 2026
    Medium [CVE-2026-82387] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the media upload feature trusts the upload-supplied content type and serves the stored file back with that type

    Medium5.4

56. Sep 28, 2026
    Medium [CVE-2026-82546] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks

    Medium6.1

57. Sep 28, 2026
    Medium [CVE-2026-91204] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it

    Medium6.1

58. Sep 28, 2026
    Medium [CVE-2026-91206] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping

    Medium6.1

59. Sep 25, 2026
    Critical [CVE-2026-92609] Apache Qpid Broker-J: Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication

    Critical9.8

60. Sep 25, 2026
    High [CVE-2026-92550] Apache Qpid Broker-J: pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service

    High7.5

61. Sep 25, 2026
    High [CVE-2026-92564] Apache Qpid Broker-J: pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service

    High7.5

62. Sep 25, 2026
    High [CVE-2026-92608] Apache Qpid Broker-J: Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly

    High7.5

63. Sep 25, 2026
    Medium [CVE-2026-92573] Apache Qpid Broker-J: Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit

    Medium6.5

64. Sep 24, 2026
    High [CVE-2026-57590] missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler

    High8.1

65. Sep 24, 2026
    Medium [CVE-2026-68870 +4] Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key

    Medium6.5

66. Sep 23, 2026
    Critical [CVE-2026-86246] Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX

    Critical9.1

67. Sep 23, 2026
    Critical [CVE-2026-41293 +1] Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up

    Critical9.1

68. Sep 23, 2026
    Critical [CVE-2026-34500 +1] CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat

    Critical9.8

69. Sep 23, 2026
    Critical [CVE-2026-76183] Apache Tomcat: Bypass of security constraints for WebSocket endpoints

    Critical9.8

70. Sep 23, 2026
    Critical [CVE-2026-82331] Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Python < 3.12 allows malicious source tarballs to write files on the host, with the privileges of the user running BuildStream, via symlinks as part of source fetching

    Critical9.8

71. Sep 23, 2026
    High [CVE-2026-86247] Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations

    High7.4

72. Sep 23, 2026
    High [CVE-2026-86243] Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash

    High7.5

73. Sep 23, 2026
    High [CVE-2026-87022] Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used

    High7.5

74. Sep 23, 2026
    High [CVE-2026-79677] Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes

    High7.5

75. Sep 23, 2026
    High [CVE-2026-78437] Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail

    High7.3

76. Sep 23, 2026
    High [CVE-2026-78383] Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service

    High7.5

77. Sep 23, 2026
    High [CVE-2026-77791] Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack

    High7.5

78. Sep 23, 2026
    High [CVE-2026-77762] Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request

    High8.1

79. Sep 23, 2026
    High [CVE-2026-75973] Improper Authentication vulnerability in Apache Tomcat

    High7.3

80. Sep 23, 2026
    High [CVE-2026-94243] vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence

    High7.3

81. Sep 23, 2026
    High [CVE-2026-31377] Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints

    High7.5

82. Sep 23, 2026
    Medium [CVE-2026-73581] Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore

    Medium6.5

83. Sep 23, 2026
    Medium [CVE-2026-94251] vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue affects Apache Sling Security Bundle: before 1.3.12

    Medium6.5

84. Sep 23, 2026
    Medium [CVE-2026-91928] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS

    Medium6.1

85. Sep 23, 2026
    Medium [CVE-2026-96443] Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE

    Medium6.5

86. Sep 23, 2026
    Medium [CVE-2026-92001] Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS

    Medium6.1

87. Sep 23, 2026
    Medium [CVE-2026-73192] improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method

    Medium6.1

88. Sep 23, 2026
    Low [CVE-2026-77756] Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy

    Low3.7

89. Sep 22, 2026
    High [CVE-2026-70410] Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica

    High8.8

90. Sep 21, 2026
    Critical [CVE-2026-47065 +1] The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only

    Critical9.8

91. Sep 21, 2026
    Critical [CVE-2026-86473] Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

    Critical9.1

92. Sep 21, 2026
    High [CVE-2026-91866] specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service)

    High7.5

93. Sep 21, 2026
    High [CVE-2026-91865] small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service)

    High7.5

94. Sep 21, 2026
    High [CVE-2026-91864] specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service)

    High7.5

95. Sep 21, 2026
    High [CVE-2026-91863] specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service)

    High7.5

96. Sep 21, 2026
    High [CVE-2026-47321] Apache MINA: The CompressionFilter class uses ZLib to deflate and inflate data sent and received

    High7.5

97. Sep 21, 2026
    Medium [CVE-2026-75158] Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

    Medium4.3

98. Sep 21, 2026
    Medium [CVE-2026-82355] Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

    Medium4.2

99. Sep 21, 2026
    Medium [CVE-2026-91867] When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service)

    Medium4.3

100. Sep 18, 2026
     High [CVE-2026-75157] Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

     High7.5

Page 1 of 2 · 100 of 192