Apache Airflow before 3.4.0 allows unauthenticated RCE via Celery
A public proof of concept shows a broker message can invoke any importable Python function without Airflow credentials.
Stories per day · 30 days
2 RSS
Relatedmissing-authentication2apache-airflow1camera1celery1cisa1ics1remote-code-execution1rtsp1swann1
6 stories, newest first · one card per story
Stories tagged #cwe-306
Swann Communications SWIFI-SE2KIC
Swann SWIFI-SE2KIC firmware through 2.0.22 can expose live video without authentication on the local network.
[0day-rubbish] StreamSets Transformer 3.17.0 auth-mode none fallback and un-sandboxed ScalaDTransform execution to container root (8.1 primary)
Researchers disclose StreamSets Transformer 3.17.0 auth fail-open and unsandboxed code execution as container root.
Critical Microsoft Azure AI Foundry Vulnerability Allows Attackers to Escalate Privileges
Microsoft patched CVE-2026-85889 (CVSS 10.0), a missing-auth flaw in Azure AI Foundry enabling unauthenticated network privilege escalation; no exploitation observed.
1
[0day-rubbish] DBxtra .NET 13.1.1.0 Unauthenticated SOAP API to xp_cmdshell code execution (9.8)
0day Rubbish disclosed an unauthenticated SOAP API flaw in DBxtra .NET 13.1.1.0 enabling xp_cmdshell command execution, rated CVSS 9.8.
ASUS Control Center Critical Flaw Allows Unauthenticated Attackers to Gain Root Access
ASUS patched CVE-2026-19397 (CVSS 7.7) in Control Center Express Agent, letting unauthenticated nearby attackers with an active session take over the host.
1