https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T05:29:39.345756+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-111453 fkie_cve-2026-111453 2026-11-10T05:29:39.347959+00:00

Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress asset-triggered runs of Dags they cannot edit. This is an incomplete fix for CVE-2026-75157: users who upgraded to apache-airflow 3.3.2 for that fix are still affected and should upgrade to apache-airflow 3.4.0 or later.

 https://db.gcve.eu/vuln/ghsa-pxh2-cvx5-8h2p GHSA-pxh2-cvx5-8h2p 2026-11-10T05:29:39.348018+00:00

Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress asset-triggered runs of Dags they cannot edit. This is an incomplete fix for CVE-2026-75157: users who upgraded to apache-airflow 3.3.2 for that fix are still affected and should upgrade to apache-airflow 3.4.0 or later.

 https://db.gcve.eu/vuln/wid-sec-w-2026-4401 WID-SEC-W-2026-4401 — Apache Airflow: Mehrere Schwachstellen 2026-11-10T05:29:39.348040+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen sowie Daten zu manipulieren oder offenzulegen.