Known vulnerabilities in Apache Airflow - page 3

Software CPE: cpe:2.3:a:apache_foundation:apache_airflow:*:*:*:*:*:*:*:*
Total vulnerabilities: 110
Public exploits: 4
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Apache Airflow Apache Airflow is affected by 110 known vulnerabilities: 8 high, 28 medium, 74 low Critical High Medium Low

Vulnerabilities (110)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU144865 - Improper Access Control
CVE-2026-48828
CWE-284 Low
No
No
3.2.2, 3.3.0 24.08.2026 SB2026060498
#VU133390 - Exposure of sensitive information to an unauthorized actor
CVE-2026-49298
CWE-200 Medium
No
No
3.2.2 04.06.2026 SB2026060498
#VU133389 - Insufficient Session Expiration
CVE-2026-48726
CWE-613 Low
No
No
3.2.2 04.06.2026 SB2026060498
#VU133388 - Exposure of sensitive information to an unauthorized actor
CVE-2026-45192
CWE-200 Low
No
No
3.2.2 04.06.2026 SB2026060498
#VU133387 - Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CVE-2026-41017
CWE-614 High
No
No
3.2.2 04.06.2026 SB2026060498
#VU133386 - Improper input validation
CVE-2026-42359
CWE-20 Medium
No
No
3.2.2 04.06.2026 SB2026060498
#VU133385 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-45360
CWE-94 Medium
No
No
3.2.2 04.06.2026 SB2026060498
#VU133384 - Improper Authorization
CVE-2026-45426
CWE-285 Low
No
No
3.2.2 04.06.2026 SB2026060498
#VU121616 - Exposure of sensitive information to an unauthorized actor
CVE-2025-68438
CWE-200 Medium
No
No
3.1.6 16.01.2026 SB2026011618
#VU121615 - Information Exposure Through Log Files
CVE-2025-68675
CWE-532 Low
No
No
3.1.6 16.01.2026 SB2026011618
#VU120169 - Unprotected Storage of Credentials
CVE-2025-66388
CWE-256 Medium
No
No
3.1.4 17.12.2025 SB2025121728
#VU120168 - Externally-generated error message containing sensitive information
CVE-2025-65995
CWE-211 Medium
No
No
3.1.4 17.12.2025 SB2025121728
#VU100568 - Information Exposure Through Log Files
CVE-2024-45784
CWE-532 Low
No
No
2.10.3 15.11.2024 SB2024111110
#VU100210 - Information Exposure Through Log Files
CVE-2024-50378
CWE-532 Low
No
No
2.10.3 11.11.2024 SB2024111110
#VU96967 - Permissions, Privileges, and Access Controls
CVE-2024-45034
CWE-264 Medium
No
No
2.10.1 10.09.2024 SB2024091005
#VU96966 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-45498
CWE-78 Low
No
No
2.10.1 10.09.2024 SB2024091005
#VU96463 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-41937
CWE-79 Low
No
No
2.10.0 22.08.2024 SB2024082283
#VU92129 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-32077
CWE-79 Low
No
No
2.9.1 14.06.2024 SB2024061425
#VU92128 - Use of Web Browser Cache Containing Sensitive Information
CVE-2024-25142
CWE-525 Medium
No
No
2.9.2 14.06.2024 SB2024061423
#VU87569 - Improper Access Control
CVE-2024-28746
CWE-284 Low
No
No
2.8.3 15.03.2024 SB2024031532


Showing elements 41 - 60 out of 110