Data Management and Analytics

In CKAN versions prior to 2.10.10 and 2.11.5 a critical severity vulnerability CVE-2026-42031 was detected. This vulnerability allows unauthenticated attackers to inject SQL in order to gain access to private resources and PostgreSQL system information due to a flaw in the datastore_search_sql function. To address this issue, users should upgrade CKAN to versions 2.10.10 or 2.11.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42031.

In CKAN versions prior to 2.10.10 and 2.11.5 a critical severity vulnerability CVE-2026-42032 was detected. This vulnerability allows unauthenticated attackers to bypass authorization and gain unauthorized access to private resources and PostgreSQL system information due to a flaw in the datastore_search_sql function. To address this issue, users should upgrade CKAN to versions 2.10.10 or 2.11.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42032.

In Fluentd versions 0.12.29 through 0.12.40 a high severity vulnerability CVE-2017-10906 was detected. This vulnerability allows an attacker to change the terminal UI or execute arbitrary commands on the device via an escape sequence injection through unspecified vectors. To address this issue, users should upgrade Fluentd to version 0.12.41 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2017-10906.

In Grafana versions prior to 12.4.1 a low severity vulnerability CVE-2026-21725 was detected. This vulnerability allows an attacker to bypass authorization and delete a recently recreated data source without permission due to a time-of-check to time-of-use (TOCTOU) race condition. The exploit requires highly stringent conditions, including prior admin access to the originally deleted data source, the new data source having the exact same UID, and the attack occurring on the same pod within a narrow 30-second window. To address this issue, users should upgrade Grafana to versions 13.0.0 and above. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-21725.

In Elasticsearch versions before 1.4.5 and 1.5.x before 1.5.2 a medium severity vulnerability CVE-2015-3337 was detected. This vulnerability allows remote attackers to read arbitrary files via unspecified vectors when a site plugin is enabled, due to a directory traversal flaw. To address this issue, users should upgrade Elasticsearch to versions 1.4.5 or 1.5.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2015-3337.

In Prometheus versions prior to 3.5.3 and 3.11.3 a high severity vulnerability CVE-2026-42154 was detected. This vulnerability allows unauthenticated attackers to send a small, specially crafted snappy-compressed payload to the remote read endpoint (/api/v1/read) that causes a massive heap allocation, leading to memory exhaustion and crashing the Prometheus process (Denial of Service). To address this issue, users should upgrade Prometheus to versions 3.5.3 or 3.11.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42154.

In vLLM versions up to 0.19.0 a medium severity vulnerability CVE-2026-7141 was detected. This vulnerability allows attackers to trigger use of an uninitialized resource by manipulating the has_mamba_layers function in the KV cache interface, potentially leading to unexpected behavior. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7141.

In Apache Airflow versions prior to 3.2.1 medium severity vulnerability CVE-2026-40690 was detected. This vulnerability allows attackers to bypass DAG-level access control via the asset graph view, enabling unauthorized users to view unrelated topologies, asset names, and the existence of DAGs outside their authorized scope. To address this issue users must upgrade to 3.2.1 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-40690.

In Apache Airflow versions prior to 3.2.1 medium severity vulnerability CVE-2026-38743 was detected. This vulnerability allows attackers to retrieve Human-in-the-Loop (HITL) prompts and TaskInstance details for DAGs outside their authorized scope by exploiting a lack of per-DAG access control on the authenticated /ui/dags endpoint. To address this issue users must upgrade to 3.2.1 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-38743.