unknown

CVE-2026-101031

The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Pytho…

Description

The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded (`load_examples` enabled), a user who can trigger that Dag with a custom `url` parameter could point it at a server whose response injects shell commands run on the worker. This is an incomplete fix for CVE-2025-54941; users who upgraded for CVE-2025-54941 should upgrade again. Users are advised to upgrade to apache-airflow 3.4.0 or later, or to disable example Dags (`load_examples = False`), which is recommended for production.

Scores

Severity
unknown
CVSS v2
—
CVSS v3
—
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

unknown

CVE-2026-120988

billboard.js before 4.1.3 is vulnerable to cross‑site scripting due to improper sanitization of series ids during legend template rendering. An attacker can inject malicious JavaScript when the chart is rendered, potentially compromising the web application. The flaw affects any site that uses billboard.js for data visualization.

View analysis

unknown

CVE-2026-119341

Tesseract OCR engine before 5.5.4 can suffer memory corruption when processing a pre‑adapted template file, leading to a denial‑of‑service. The flaw occurs in ReadAdaptedClass when legacy mode is enabled and attacker‑controlled .a files are parsed. It affects all Tesseract 5.x releases that allow pre‑adapted templates.

View analysis

unknown

CVE-2026-99188

A vulnerability in the Linux kernel's stmmac network driver causes an interrupt storm during system resume from sleep states. This occurs because the RGMII status interrupt is not cleared, leading to CPU starvation and potential system hangs or watchdog resets on affected hardware.

View analysis

unknown

CVE-2026-99206

A race condition in the Linux kernel's iSCSI target discovery module allows concurrent configfs operations to trigger a double-free vulnerability. This flaw occurs when multiple processes simultaneously update the discovery AuthMethod parameter without proper synchronization. It poses a stability and security risk to systems exposing iSCSI targets via the kernel's target subsystem.

View analysis