30
30
60
50
30
30
60
42
35
CVE-2026-82310: Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access
Apache Airflow FAB provider 2.0.0-3.8.x lets deactivated users keep unexpired Core API JWTs and mint replacements indefinitely.
CVE-2026-82310 affects apache-airflow-providers-fab versions 2.0.0 before 3.9.0. Deactivating a user account does not stop tokens issued before deactivation. While password authentication correctly rejects the disabled account, the Core API continues to accept an existing unexpired token naming it and lets that token mint a replacement. Severity is rated moderate.
30
60
42
60
60
55
30
30
30
30
60
30
42
CVE-2026-75015: Apache Syncope: Nested secrets leak cleartext into audit records readable
Apache Syncope leaks nested secrets in cleartext into audit records readable by unauthorized users; affects 3.0.x, 4.0.x, and 4.1.x versions.
CVE-2026-75015 is an insufficiently protected credentials vulnerability in Apache Syncope where audit events expose nested secrets in cleartext to users able to read those records. Affected component is syncope-core-provisioning-java 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Apache rates the issue moderate severity, and users should upgrade to fixed releases.
18
n8n security advisory (AV26-880)
Canada's Cyber Centre flagged multiple n8n vulnerabilities in versions prior to 1.123.76 and several 2.x releases, urging users to update.
The Canadian Centre for Cyber Security issued advisory AV26-880 stating that n8n is affected by vulnerabilities in versions prior to 1.123.76 and prior to 2.35.4, 2.36.2, 2.37.7, and 2.38.2. The advisory links to the n8n-io GitHub repository for details. Users and administrators are encouraged to review the advisory and apply the necessary updates.
22
55
Sam Altman calls GPT-6 Astra rollout ‘messy’ as enterprise users wait for access
OpenAI's GPT-6 Astra launch hit access problems; Sam Altman apologized as availability gradually expanded from Daybreak partners to Pro, Enterprise, and API users.
GPT-6 Astra, launched September 4 as OpenAI's most advanced model, was initially accessible only to organizations enrolled in its Daybreak cybersecurity program, leaving Plus, Pro, Business, Enterprise, and API users waiting. Altman called the rollout 'messy'; by September 5 access had extended to Pro, Enterprise, and Business Premium users in ChatGPT's Work and Codex products plus the API. Analysts from Gartner and Greyhound Research said the staged rollout highlights the gap between announcement and production availability, urging enterprises to verify actual access levels and strengthen governance, security, and cost controls before adopting Astra's autonomous workflows.
75
42
30
60
30
42
57
42
55
45
30
60
30
30
45