CGA-4F5Q-C77Q-QJJ3: airflow-3
Unknown
Published Date unknownLast modified Date unknown
Status not reported
The data service did not report a status for this record. Only the available sections are shown.Vulnerability summary
CGA-4F5Q-C77Q-QJJ3 is a vulnerability in airflow-3 with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
No timeline events recorded.
Description
No description has been published for this record.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in the CISA KEV catalog.
Not in the ENISA CNW catalog.
Not in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Chainguard200 products
- airbyte-server< 2.0.0-r3
- airbyte-server-fips< 2.0.0-r3
- airflow-3< 3.3.0-r3
- akhq< 0.27.1-r5
- apache-activemq-5.19< 5.19.8-r1
- apache-activemq-6.1< 6.1.8-r8
- apache-activemq-6.2< 6.2.7-r1
- apache-activemq-fips-5.19< 5.19.8-r1
- apache-activemq-fips-6.1< 6.1.8-r11
- apache-activemq-fips-6.2< 6.2.7-r1
- apache-camel-karavan-devmode< 4.18.1-r6
- apache-hop< 2.18.1-r2
- apache-hop-fips< 2.18.1-r2
- apache-pulsar-4.0< 4.0.11-r4
- apache-pulsar-4.2< 4.2.3-r1
- apache-pulsar-fips-4.0< 4.0.11-r4
- apache-pulsar-fips-4.2< 4.2.2-r4
- apache-tika-2.9< 2.9.4-r17
- apache-tika-3.0< 3.0.0-r27
- apache-tika-3.1< 3.1.0-r33
- apache-tika-3.2< 3.2.3-r13
- apache-tika-3.3< 3.3.1-r5
- apache-tika-fips-2.9< 2.9.4-r9
- apache-tika-fips-3.0< 3.0.0-r9
- apache-tika-fips-3.1< 3.1.0-r11
- apache-tika-fips-3.2< 3.2.3-r9
- apache-tika-fips-3.3< 3.3.1-r2
- apache-tomee-microprofile< 10.1.5-r1
- apache-tomee-plume< 10.1.5-r1
- apache-tomee-plus< 10.1.5-r1
- apicurio-registry< 3.3.0-r6
- cassandra-4.0< 4.0.20-r1
- cassandra-4.1< 4.1.11-r1
- cassandra-5.0< 5.0.8-r7
- cassandra-fips-4.0< 4.0.20-r3
- cassandra-fips-4.1< 4.1.11-r1
- cassandra-fips-5.0< 5.0.8-r2
- cassandra-reaper< 4.2.5-r3
- commercial-elasticsearch-8.19< 8.19.19-r0
- commercial-elasticsearch-9.3< 9.3.8-r0
- conductor< 3.31.0-r1
- conductor-fips< 3.31.0-r1
- confluent-common-docker< 7.6.9-r6
- confluent-kafka< 8.4.0.253-r2
- confluent-kafka-jre-bcfips< 8.4.0.253-r1
- dependency-track< 4.14.2-r3
- dependency-track-apiserver-5< 5.0.2-r1
- dependency-track-bundled< 4.14.2-r3
- dependency-track-v4-migrator< 5.0.2-r1
- elasticsearch-8.19< 8.19.17-r1
- elasticsearch-8.19-iamguarded< 8.19.17-r1
- elasticsearch-8.19-iamguarded-fips< 8.19.17-r1
- elasticsearch-9.2-iamguarded< 9.2.8-r13
- elasticsearch-9.3< 9.3.8-r0
- elasticsearch-9.3-iamguarded< 9.3.8-r0
- elasticsearch-9.4-iamguarded< 9.4.5-r3
- elasticsearch-9.5< 9.5.2-r6
- elasticsearch-9.5-iamguarded< 9.5.2-r6
- elasticsearch-9.5-iamguarded-fips< 9.5.2-r5
- elasticsearch-fips-8.19< 8.19.17-r1
- elasticsearch-fips-9.5< 9.5.2-r5
- flyway< 13.0.0-r1
- flyway-fips< 12.9.0-r1
- geoserver-2.27< 2.27.5-r14
- geoserver-2.27-community< 2.27.5-r14
- geoserver-2.28< 2.28.4-r3
- geoserver-2.28-community< 2.28.4-r3
- geoserver-3.0< 3.0.0-r1
- gradle-8< 8.14.5-r1
- gradle-9< 9.6.1-r1
- guacamole-client< 1.6.0-r10
- guacamole-client-extensions< 1.6.0-r10
- hadoop-client-modules< 3.3.6-r14
- hono-adapter-mqtt< 2.7.0-r26
- hono-cli< 2.7.0-r26
- hono-service-auth< 2.7.0-r26
- hono-service-command-router< 2.7.0-r26
- hono-service-device-registry-jdbc< 2.7.0-r26
- infinispan-15.0< 15.0.22-r13
- infinispan-15.1< 15.1.7-r24
- infinispan-15.2< 15.2.6-r22
- infinispan-16.0< 16.0.13-r2
- infinispan-16.1< 16.1.4-r5
- jenkins-2-openjdk-21< 2.572-r0
- jenkins-2-openjdk-25< 2.572-r0
- jenkins-2.555< 2.555.3-r2
- jenkins-2.555-openjdk-21< 2.555.3-r2
- jenkins-2.555-openjdk-25< 2.555.3-r2
- jenkins-2.568< 2.568.1-r2
- jenkins-2.568-openjdk-21< 2.568.1-r2
- jenkins-2.568-openjdk-25< 2.568.1-r2
- jenkins-plugin-manager< 2.15.0-r4
- jmeter< 5.6.3-r2
- kafbat-ui< 1.5.0-r3
- kafbat-ui-fips< 1.5.0-r2
- kafka-3.7< 3.7.2-r57
- kafka-3.8< 3.8.1-r57
- kafka-3.9< 3.9.2-r8
- kafka-4.0< 4.0.2-r4
- kafka-4.1< 4.1.2-r3
- kafka-4.2< 4.2.1-r3
- kafka-4.3-openjdk-17< 4.3.1-r1
- kafka-4.3-openjdk-21< 4.3.1-r1
- kafka-4.3-openjdk-25< 4.3.1-r1
- kafka-bridge< 1.0.0-r7
- kafka-bridge-fips< 1.0.0-r4
- kafka-fips-4.1< 4.1.2-r4
- kafka-fips-4.2< 4.2.1-r3
- kafka-fips-4.3< 4.3.1-r1
- kayenta-fips-2025.4< 2025.4.6-r1
- keycloak-26.6< 26.6.4-r1
- keycloak-26.6-iamguarded-compat< 26.6.4-r1
- keycloak-26.6-operator< 26.6.4-r1
- keycloak-config-cli< 6.5.1-r5
- keycloak-config-cli-iamguarded-compat< 6.5.1-r5
- keycloak-fips-26.6< 26.6.4-r1
- keycloak-fips-26.6-iamguarded-fips< 26.6.4-r1
- keycloak-fips-26.6-operator< 26.6.4-r1
- knative-kafka-broker-1.21-dispatcher-loom< 1.21.4-r9
- knative-kafka-broker-1.21-receiver-loom< 1.21.4-r9
- knative-kafka-broker-1.22-dispatcher-loom< 1.22.1-r10
- knative-kafka-broker-1.22-receiver-loom< 1.22.1-r10
- knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.4-r2
- knative-kafka-broker-fips-1.21-receiver-loom< 1.21.4-r2
- knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.1-r6
- knative-kafka-broker-fips-1.22-receiver-loom< 1.22.1-r6
- kserve-modelmesh< 0.12.0-r36
- lmcache-cuda-12.8< 0.5.4-r0
- localstack< 4.14.0-r16
- logstash-8.19< 8.19.17-r1
- logstash-8.19-iamguarded-compat< 8.19.17-r1
- logstash-8.19-with-output-opensearch< 8.19.17-r1
- logstash-9.4< 9.4.2-r7
- logstash-9.4-iamguarded-compat< 9.4.2-r7
- logstash-fips-9.4< 9.4.2-r6
- logstash-fips-9.4-iamguarded-compat< 9.4.2-r6
- management-api-for-apache-cassandra-4.0< 0.1.122-r1
- management-api-for-apache-cassandra-4.1< 0.1.122-r1
- management-api-for-apache-cassandra-5.0< 0.1.122-r1
- nacos< 3.2.2-r3
- nacos-docker< 3.2.2-r1
- neo4j-2026.05< 2026.05.0-r6
- neo4j-5.26< 5.26.27-r3
- nextflow< 26.04.4-r1
- nuxeo-2023< 2023.40-r8
- ontop< 5.5.0-r11
- ontop-fips< 5.5.0-r7
- opensearch-2< 2.19.6-r0
- opensearch-2-anomaly-detection< 2.19.6-r2
- opensearch-2-crypto-kms< 2.19.6-r0
- opensearch-2-discovery-ec2< 2.19.6-r0
- opensearch-2-ml-commons< 2.19.6-r0
- opensearch-2-neural-search< 2.19.6-r0
- opensearch-2-notifications< 2.19.6-r0
- opensearch-2-observability< 2.19.6-r2
- opensearch-2-performance-analyzer< 2.19.6-r0
- opensearch-2-reporting< 2.19.6-r2
- opensearch-2-repository-azure< 2.19.6-r0
- opensearch-2-repository-s3< 2.19.6-r0
- opensearch-2-security< 2.19.6-r0
- opensearch-2-sql< 2.19.6-r0
- opensearch-3< 3.7.0-r2
- opensearch-3-alerting< 3.7.0-r2
- opensearch-3-anomaly-detection< 3.7.0-r2
- opensearch-3-crypto-kms< 3.7.0-r2
- opensearch-3-discovery-ec2< 3.7.0-r2
- opensearch-3-ml-commons< 3.7.0-r2
- opensearch-3-neural-search< 3.7.0-r2
- opensearch-3-notifications< 3.7.0-r2
- opensearch-3-observability< 3.7.0-r2
- opensearch-3-performance-analyzer< 3.7.0-r2
- opensearch-3-reporting< 3.7.0-r2
- opensearch-3-repository-azure< 3.7.0-r2
- opensearch-3-repository-s3< 3.7.0-r2
- opensearch-3-security< 3.7.0-r13
- opensearch-3-sql< 3.7.0-r2
- opensearch-fips-3< 3.7.0-r2
- opensearch-fips-3-alerting< 3.7.0-r2
- opensearch-fips-3-anomaly-detection< 3.7.0-r2
- opensearch-fips-3-crypto-kms< 3.7.0-r2
- opensearch-fips-3-discovery-ec2< 3.7.0-r2
- opensearch-fips-3-ml-commons< 3.7.0-r2
- opensearch-fips-3-neural-search< 3.7.0-r2
- opensearch-fips-3-notifications< 3.7.0-r2
- opensearch-fips-3-observability< 3.7.0-r2
- opensearch-fips-3-performance-analyzer< 3.7.0-r2
- opensearch-fips-3-reporting< 3.7.0-r2
- opensearch-fips-3-repository-azure< 3.7.0-r2
- opensearch-fips-3-repository-s3< 3.7.0-r2
- opensearch-fips-3-security< 3.7.0-r12
- opensearch-fips-3-sql< 3.7.0-r2
- reposilite< 3.5.28-r5
- request-9047-keycloak-fips-26.4< 26.4.7-r19
- request-9047-keycloak-fips-26.4-iamguarded-fips< 26.4.7-r19
- request-9047-keycloak-fips-26.4-operator< 26.4.7-r19
- request-9047-keycloak-fips-26.5< 26.5.7-r9
- request-9047-keycloak-fips-26.5-iamguarded-fips< 26.5.7-r9
- request-9047-keycloak-fips-26.5-operator< 26.5.7-r9
- request-9047-keycloak-fips-26.6< 26.6.4-r1
- request-9047-keycloak-fips-26.6-iamguarded-fips< 26.6.4-r1
1 vendor · 200 products · Showing 200 of 441
References
0 linksNo references have been published for this record.
Related vulnerabilities
RoutineCVE-2026-55858mariadb-corporation · mariadb-connector-j +46 moreMariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-clientMariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The server can report a mid-session change to character_set_client through OK-packet session-state tracking, including a change caused by SET NAMES, a stored routine or trigger, server configuration, or a hostile server. If character_set_client changes to a non-UTF-8 value, the driver continues to read and write UTF-8 while the server interprets the same bytes under another encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value causes SQLException with SQLState 08000 and closes the connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.CVSS5.9MediumEPSS0.87%RoutineCVE-2026-55857mariadb-corporation · mariadb-connector-j +46 moreMariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected CredentialsMariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysql_clear_password plugin is gated behind a secure transport, but the sibling PAM handler SendPamAuthPacketFactory, named dialog by the server, does not declare that requirement and inherits the default secure-required value false; older branches implement the same affected behavior in SendPamAuthPacket. A hostile or man-in-the-middle server can send an Authentication Switch Request for dialog over plain TCP, causing the driver to return the user's password in cleartext when sslMode=DISABLE and restrictedAuth=null, which is the default configuration. Properly verified TLS and local Unix sockets are not exposed to this transport vector. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.CVSS5.9MediumEPSS0.39%RoutineCVE-2026-55856mariadb-corporation · mariadb-connector-j +46 moreMariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshakeMariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore, Connector/J can accept an untrusted self-signed certificate through the fallbackToSystemTrustStore=true ephemeral trust manager and record its certFingerprint for later identity binding. The OK-packet and authentication-switch paths enforce the certificate fingerprint, but the initial-handshake path does not. HandshakeResponse.encode() can therefore build and send a mysql_clear_password response before checking certFingerprint != null && !isMitMProof(), sslMode, or whether the authentication plugin is resistant to a man-in-the-middle, and the initial path also bypasses restrictedAuth. An active man-in-the-middle or hostile server can present a self-signed certificate, claim to be MariaDB, select mysql_clear_password as the initial authentication plugin, and receive the full database password before the connection is rejected. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.CVSS5.9MediumEPSS0.44%RoutineCVE-2026-59903netty +360 moreNetty: Cache Poisoning and Information Disclosure via CORS Vary Header OverwriteNetty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.CVSS7.5HighEPSS0.32%PrioritiseCVE-2026-54284andialbrecht · sqlparse +67 moresqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps triggersqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token limits terminate processing. This issue is fixed in version 0.6.0.CVSS8.7HighEPSS0.33%PrioritiseCVE-2026-59893andialbrecht · sqlparse +67 moresqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.CVSS7.5HighEPSS0.34%