🚨 CVE-2026-67180
Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10.
🎖@cveNotify
Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10.
🎖@cveNotify
GitHub
Command injection (RCE) in worker tasks via evidence path interpolated into a shell=True command · Issue #1629 · google/turbinia
What steps will reproduce the bug? Summary Several Turbinia worker tasks build a shell command by string-formatting an evidence path (evidence.local_path / evidence.device_path) directly into the c...
🚨 CVE-2026-65789
Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-65795
No cwe for this issue in Windows DNS allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
No cwe for this issue in Windows DNS allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-65797
Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-65798
Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-69223
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
🎖@cveNotify
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
🎖@cveNotify
🚨 CVE-2026-70304
Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-70339
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-71290
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.
Please note the classic version of HttpClient is not affected by this vulnerability.
Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
🎖@cveNotify
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.
Please note the classic version of HttpClient is not affected by this vulnerability.
Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
🎖@cveNotify
🚨 CVE-2026-68868
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name.
🎖@cveNotify
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name.
🎖@cveNotify
GitHub
Apply the team scope in the Google Secret Manager backend by potiuk · Pull Request #70869 · apache/airflow
CloudSecretManagerBackend.get_conn_value and get_variable both accept a
team_name, but the helper they delegate to has no such parameter:
def get_conn_value(self, conn_id: str, team_name: str | Non...
team_name, but the helper they delegate to has no such parameter:
def get_conn_value(self, conn_id: str, team_name: str | Non...
🚨 CVE-2026-67260
Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally every 15 seconds, and the default `allowed_deserialization_classes` setting does not cover this code path. Versions before 3.3.0 are not affected, because human-in-the-loop tasks deferred onto the triggerer instead. This is a different code path from CVE-2026-58076, which covers the same unguarded exception-node deserialization reached elsewhere — deployments that applied that fix must upgrade for this issue as well. Users are advised to upgrade to apache-airflow 3.3.1 or later.
🎖@cveNotify
Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally every 15 seconds, and the default `allowed_deserialization_classes` setting does not cover this code path. Versions before 3.3.0 are not affected, because human-in-the-loop tasks deferred onto the triggerer instead. This is a different code path from CVE-2026-58076, which covers the same unguarded exception-node deserialization reached elsewhere — deployments that applied that fix must upgrade for this issue as well. Users are advised to upgrade to apache-airflow 3.3.1 or later.
🎖@cveNotify
GitHub
Fail task instances whose stored next_kwargs cannot be processed by potiuk · Pull Request #70685 · apache/airflow
handle_event_submit decoded a task instance's stored next_kwargs and then
assumed the result was a dict. The decode caught only four exception types, so
anything the BaseSerialization compa...
assumed the result was a dict. The decode caught only four exception types, so
anything the BaseSerialization compa...
🚨 CVE-2026-67587
Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does not help. A Dag author — who controls a task instance's `next_kwargs` through the task execution API — can therefore cause an arbitrary module to be imported inside the scheduler process, when the scheduler's `awaiting_input` timeout sweep deserializes that value. No non-default configuration is required; the sweep runs unconditionally. Versions before 3.3.0 are not affected: the class existed, but the scheduler sweep that reaches it did not. This is a separate code path from CVE-2026-58076 and CVE-2026-67260, which cover different gadgets reaching deserialization — applying either of those fixes does not address this one. Users are advised to upgrade to apache-airflow 3.3.1 or later.
🎖@cveNotify
Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does not help. A Dag author — who controls a task instance's `next_kwargs` through the task execution API — can therefore cause an arbitrary module to be imported inside the scheduler process, when the scheduler's `awaiting_input` timeout sweep deserializes that value. No non-default configuration is required; the sweep runs unconditionally. Versions before 3.3.0 are not affected: the class existed, but the scheduler sweep that reaches it did not. This is a separate code path from CVE-2026-58076 and CVE-2026-67260, which cover different gadgets reaching deserialization — applying either of those fixes does not address this one. Users are advised to upgrade to apache-airflow 3.3.1 or later.
🎖@cveNotify
GitHub
Do not import the stored path when rebuilding a Callback from serialized data by potiuk · Pull Request #70704 · apache/airflow
Callback.get_callback_path imports the module named by a dotted-path string in
order to check that it resolves to a callable. That check is deliberately best
effort — the ImportError is logged and ...
order to check that it resolves to a callable. That check is deliberately best
effort — the ImportError is logged and ...
🚨 CVE-2026-73237
XSS vulnerability in Markdown handling in Apache Allura.
This issue affects Apache Allura: from 1.10.0 before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
🎖@cveNotify
XSS vulnerability in Markdown handling in Apache Allura.
This issue affects Apache Allura: from 1.10.0 before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
🎖@cveNotify
🚨 CVE-2026-73238
XSS vulnerability in code display in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
🎖@cveNotify
XSS vulnerability in code display in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
🎖@cveNotify
🚨 CVE-2026-73239
Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
🎖@cveNotify
Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
🎖@cveNotify
🚨 CVE-2026-73240
Specifically crafted inputs may lead to git argument injection in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
🎖@cveNotify
Specifically crafted inputs may lead to git argument injection in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
🎖@cveNotify
🚨 CVE-2026-16929
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a buffer overflow.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a buffer overflow.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Host Servers
IBM i is vulnerable to multiple vulnerabilities [CVE-2026-17223, CVE-2026-17206, CVE-2026-17208, CVE-2026-16929, CVE-2026-17004, CVE-2026-18846, CVE-2026-17197, CVE-2026-17217, CVE-2026-17199, CVE-2026-17229, CVE-2026-16982] in host servers, and a buffer…
🚨 CVE-2026-17045
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager
IBM i is vulnerable to multiple vulnerabilities [CVE-2026-17088, CVE-2026-17075, CVE-2026-17071, CVE-2026-17069, CVE-2026-17045, CVE-2026-17043] in Digital Certificate Manager (DCM) as described in the vulnerability details section.
🚨 CVE-2026-73669
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens on all network interfaces with anonymous access enabled and no firewall restriction. An attacker with access to the Bridge's network can read device data and control connected lights.
🎖@cveNotify
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens on all network interfaces with anonymous access enabled and no firewall restriction. An attacker with access to the Bridge's network can read device data and control connected lights.
🎖@cveNotify
🚨 CVE-2026-17077
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitialized variable.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitialized variable.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM
IBM i is vulnerable to multiple vulnerabilities [CVE-2026-17216, CVE-2026-17076, CVE-2026-17077, CVE-2026-17074] in Distributed Relational Database Architecture (DRDA) / Distributed Data Management (DDM) as described in the vulnerability details section.
🚨 CVE-2026-17212
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i is vulnerable to multiple vulnerabilities [CVE-2026-16858, CVE-2026-16867, CVE-2026-16868, CVE-2026-16853, CVE-2026-17226, CVE-2026-16859, CVE-2026-16878, CVE-2026-16861, CVE-2026-17212, CVE-2026-18020, CVE-2026-17649, CVE-2026-16871, CVE-2026-18671…