https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T05:29:42.090385+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-111454 fkie_cve-2026-111454 2026-11-10T05:29:42.648300+00:00

Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

 https://db.gcve.eu/vuln/ghsa-g36h-whch-ffmv GHSA-g36h-whch-ffmv 2026-11-10T05:29:42.648369+00:00

Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later.

 https://db.gcve.eu/vuln/wid-sec-w-2026-4401 WID-SEC-W-2026-4401 — Apache Airflow: Mehrere Schwachstellen 2026-11-10T05:29:42.648392+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen sowie Daten zu manipulieren oder offenzulegen.