Skip to content
OpenAdvisories

Package · Wolfi

airflow-3

141 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.5
    CVE-2026-49468 Public exploit Scanner template

    LiteLLM: Authentication Bypass via Host Header Injection

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth laye…

    BerriAI litellm airflow-3 litellm Wolfi PyPI
  • Critical 9.8
    CVE-2026-8838 Public exploit

    Remote Code Execution via eval() Injection in amazon-redshift-python-driver

    Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2.1.14 allows a rogue server or man-in-the-middle actor to execute arbitrary code on the client. To remediate this issue, users should up…

    AWS Amazon Redshift connector for Python airflow-3 redshift-connector Wolfi PyPI
  • Critical 9.3
    CVE-2026-42208 Exploited Public exploit Scanner template EPSS 89%

    LiteLLM: SQL injection in Proxy API key verification

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing i…

    BerriAI litellm airflow-3 litellm Wolfi PyPI
    KEV May 8, 2026
  • Critical 9.4
    CVE-2026-35030 Public exploit

    LiteLLM has an authentication bypass via OIDC userinfo cache key collision

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt_auth: true), the OIDC userinfo cache uses token[:20] as the cache key. JWT headers produced by the same signi…

    BerriAI litellm airflow-3 litellm Wolfi PyPI
  • Critical 9.4
    CVE-2025-62593 Exploited Public exploit Scanner template EPSS 60%

    Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack

    Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-ba…

    ray-project ray airflow-3 ray Wolfi PyPI
    KEV Aug 17, 2026