NIXPKGS-2026-1850

GitHub issue published 1 week, 4 days ago

Permalink CVE-2026-10565

1.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 week, 4 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 4 days ago
• @LeSuisse ignored package open5gs-webui 1 week, 4 days ago
• @LeSuisse ignored
  4 references

  • VDB-367672 | CTI Indicators (IOB, IOC, …
  • Submit #818938 | open5gs v2.7.6 Race Co…
  • CVE-2026-10565 | CVE Analysis and Report
  • https://github.com/open5gs/open5gs/
  1 week, 4 days ago
• @LeSuisse accepted 1 week, 4 days ago
• @LeSuisse published on GitHub 1 week, 4 days ago

Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition

• VDB-367672 | Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition technical-descriptionvdb-entry
• https://github.com/open5gs/open5gs/issues/4497 issue-tracking
• https://github.com/open5gs/open5gs/pull/4501 issue-trackingpatch
• https://github.com/user-attachments/files/27111025/N2-SMC-Concurrent.zip exploit

Ignored references (4)

• VDB-367672 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• CVE-2026-10565 | CVE Analysis and Report third-party-advisory
• Submit #818938 | open5gs v2.7.6 Race Condition third-party-advisory
• https://github.com/open5gs/open5gs/ product

---

Open5GS

• ==2.7.1
• ==2.7.4
• ==2.7.0
• ==2.7.3
• ==2.7.5
• ==2.7.6
• ==2.7.2

NIXPKGS-2026-1849

GitHub issue published 1 week, 4 days ago

Permalink CVE-2026-49443

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 week, 4 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 4 days ago
• @LeSuisse ignored
  3 packages

  • authentik-outposts.ldap
  • authentik-outposts.proxy
  • authentik-outposts.radius
  1 week, 4 days ago
• @LeSuisse accepted 1 week, 4 days ago
• @LeSuisse published on GitHub 1 week, 4 days ago

authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API

• https://github.com/goauthentik/authentik/security/advisories/GHSA-wr38-7xg8-fqxr x_refsource_CONFIRM

---

authentik

• ==< 2026.2.4
• ==< 2025.12.6
• ==< 2026.5.1

NIXPKGS-2026-1848

GitHub issue published 1 week, 4 days ago

Permalink CVE-2026-10650

5.5 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 week, 4 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 4 days ago
• @LeSuisse ignored
  4 references

  • VDB-367955 | CTI Indicators (IOB, IOC, …
  • CVE-2026-10650 | CVE Analysis and Report
  • Submit #830261 | warmcat libwebsockets …
  • https://github.com/warmcat/libwebsocket…
  1 week, 4 days ago
• @LeSuisse accepted 1 week, 4 days ago
• @LeSuisse published on GitHub 1 week, 4 days ago

warmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumption

• VDB-367955 | warmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumption technical-descriptionvdb-entry
• https://github.com/biniamf/pocs/tree/main/libwebsockets_sshd-parse-ic-unbounded… exploit
• https://github.com/biniamf/pocs/blob/main/libwebsockets_sshd-parse-ic-unbounded… exploit
• https://github.com/warmcat/libwebsockets/commit/3f9f0c6ecaf0e6f3f219d30632c5d1f… patch

Ignored references (4)

• VDB-367955 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• CVE-2026-10650 | CVE Analysis and Report third-party-advisory
• Submit #830261 | warmcat libwebsockets 4.5.99-v4.5.0-382-g4a63b9333 Uncontrolled Memory Allocation third-party-advisory
• https://github.com/warmcat/libwebsockets/ product

---

libwebsockets

• ==4.5.6
• ==4.5.2
• ==4.5.3
• ==4.5.0
• ==4.5.5
• ==4.5.1
• ==4.5.7
• ==4.5.8
• ==4.5.4

NIXPKGS-2026-1847

GitHub issue published 1 week, 4 days ago

Permalink CVE-2026-44654

5.7 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 week, 4 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 4 days ago
• @LeSuisse accepted 1 week, 4 days ago
• @LeSuisse published on GitHub 1 week, 4 days ago

LibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agents

• https://github.com/danny-avila/LibreChat/security/advisories/GHSA-f8jg-v856-mf6q x_refsource_CONFIRM

---

LibreChat

• ==< 0.8.5

NIXPKGS-2026-1846

GitHub issue published 1 week, 5 days ago

Permalink CVE-2026-46764

updated 1 week, 5 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 5 days ago
• @LeSuisse accepted 1 week, 5 days ago
• @LeSuisse published on GitHub 1 week, 5 days ago

Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter

• https://github.com/apache/airflow/pull/67112 patch
• https://lists.apache.org/thread/ctrbj7q3m86g4qxmo9ponojgmzrcoqpv vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/05/31/14

---

apache-airflow

• <3.2.2

NIXPKGS-2026-1845

GitHub issue published 1 week, 5 days ago

Permalink CVE-2026-48559

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 5 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 5 days ago
• @LeSuisse ignored
  2 packages

  • flmsg
  • helmsman
  1 week, 5 days ago
• @LeSuisse ignored reference https://w… 1 week, 5 days ago
• @LeSuisse ignored
  24 packages

  • llmserve
  • lmstudio
  • python312Packages.calmsize
  • python313Packages.calmsize
  • python313Packages.lmstudio
  • python314Packages.calmsize
  • python314Packages.lmstudio
  • python312Packages.llama-index-llms-ollama
  • python312Packages.llama-index-llms-openai
  • python313Packages.llama-index-llms-ollama
  • python313Packages.llama-index-llms-openai
  • python312Packages.llama-index-llms-openai-like
  • python313Packages.llm-lmstudio
  • python314Packages.llm-lmstudio
  • pkgsRocm.python3Packages.llama-index-llms-ollama
  • pkgsRocm.python3Packages.llama-index-llms-openai
  • pkgsRocm.python3Packages.llama-index-llms-openai-like
  • python312Packages.llama-index-multi-modal-llms-openai
  • python313Packages.llama-index-multi-modal-llms-openai
  • pkgsRocm.python3Packages.llama-index-multi-modal-llms-openai
  • python313Packages.llama-index-llms-openai-like
  • python314Packages.dlms-cosem
  • python312Packages.dlms-cosem
  • python313Packages.dlms-cosem
  1 week, 5 days ago
• @LeSuisse accepted 1 week, 5 days ago
• @LeSuisse published on GitHub 1 week, 5 days ago

Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags

• https://www.zeroscience.mk/#/advisories/ZSL-2026-5987 exploittechnical-description
• https://github.com/epoupon/lms/issues/844
• https://github.com/epoupon/lms/milestone/94

Ignored references (1)

• https://www.vulncheck.com/advisories/lightweight-music-server-stored-xss-via-me… third-party-advisory

---

lms

• =<3.76.0

NIXPKGS-2026-1843

GitHub issue published 1 week, 5 days ago

Permalink CVE-2026-42359

updated 1 week, 5 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 5 days ago
• @LeSuisse accepted 1 week, 5 days ago
• @LeSuisse published on GitHub 1 week, 5 days ago

Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator

• https://github.com/apache/airflow/pull/65915 patch
• https://lists.apache.org/thread/g8dqykpf1p90tysq8tln4qtkqwb1038s vendor-advisory
• https://www.cve.org/CVERecord?id=CVE-2026-33858 related

---

apache-airflow

• <3.2.2

NIXPKGS-2026-1844

GitHub issue published 1 week, 5 days ago

Permalink CVE-2026-10267

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 week, 5 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 5 days ago
• @LeSuisse ignored
  3 references

  • https://github.com/janet-lang/janet/
  • VDB-367546 | CTI Indicators (IOB, IOC, …
  • CVE-2026-10267 | CVE Analysis and Report
  1 week, 5 days ago
• @LeSuisse ignored
  6 packages

  • vscode-extensions.janet-lang.vscode-janet
  • tree-sitter-grammars.tree-sitter-janet-simple
  • vimPlugins.nvim-treesitter-parsers.janet_simple
  • python312Packages.tree-sitter-grammars.tree-sitter-janet-simple
  • python313Packages.tree-sitter-grammars.tree-sitter-janet-simple
  • python314Packages.tree-sitter-grammars.tree-sitter-janet-simple
  1 week, 5 days ago
• @LeSuisse accepted 1 week, 5 days ago
• @LeSuisse published on GitHub 1 week, 5 days ago

janet-lang janet debug.c doframe out-of-bounds

• VDB-367546 | janet-lang janet debug.c doframe out-of-bounds technical-descriptionvdb-entry
• Submit #825072 | janet-lang janet 1.41.0 Out-of-Bounds Read third-party-advisory
• https://github.com/janet-lang/janet/issues/1743 issue-tracking
• https://github.com/janet-lang/janet/issues/1743#issuecomment-4322129448 issue-tracking
• https://github.com/biniamf/pocs/tree/main/janet-debug-janet-doframe-env-data-oo… exploit
• https://github.com/janet-lang/janet/commit/ed17dd2c5913a23fb1107251e44a9410a3c3… patch

Ignored references (3)

• VDB-367546 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• CVE-2026-10267 | CVE Analysis and Report third-party-advisory
• https://github.com/janet-lang/janet/ product

---

janet

• ==1.14
• ==1.40
• ==1.0
• ==1.35
• ==1.20
• ==1.16
• ==1.27
• ==1.31
• ==1.37
• ==1.36
• ==1.23
• ==1.29
• ==1.25
• ==1.33
• ==1.28
• ==1.12
• ==1.22
• ==1.3
• ==1.9
• ==1.10
• ==1.17
• ==1.2
• ==1.8
• ==1.15
• ==1.6
• ==1.19
• ==1.32
• ==1.21
• ==1.18
• ==1.11
• ==1.38
• ==1.34
• ==1.7
• ==1.41.0
• ==1.5
• ==1.13
• ==1.4
• ==1.30
• ==1.24
• ==1.26
• ==1.39
• ==1.1

NIXPKGS-2026-1842

GitHub issue published 1 week, 5 days ago

Permalink CVE-2026-10233

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 week, 5 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 5 days ago
• @LeSuisse ignored
  4 references

  • https://github.com/assimp/assimp/
  • CVE-2026-10233 | CVE Analysis and Report
  • VDB-367512 | CTI Indicators (IOB, IOC, …
  • Submit #821196 | Assimp commit 17c12da …
  1 week, 5 days ago
• @LeSuisse accepted 1 week, 5 days ago
• @LeSuisse published on GitHub 1 week, 5 days ago

Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_sequence_infos out-of-bounds

• VDB-367512 | Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_sequence_infos out-of-bounds technical-descriptionvdb-entry
• https://github.com/assimp/assimp/issues/6619 issue-tracking
• https://github.com/user-attachments/files/27228962/poc.zip exploit

Ignored references (4)

• VDB-367512 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• CVE-2026-10233 | CVE Analysis and Report third-party-advisory
• Submit #821196 | Assimp commit 17c12da Buffer Overflow third-party-advisory
• https://github.com/assimp/assimp/ product

---

Assimp

• ==6.0.4
• ==6.0.3
• ==6.0.1
• ==6.0.2
• ==6.0.0

NIXPKGS-2026-1841

GitHub issue published 1 week, 5 days ago

Permalink CVE-2026-48726

updated 1 week, 5 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 5 days ago
• @LeSuisse accepted 1 week, 5 days ago
• @LeSuisse published on GitHub 1 week, 5 days ago

Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path

• https://github.com/apache/airflow/pull/67289 patch
• https://www.cve.org/CVERecord?id=CVE-2025-57735 related
• https://lists.apache.org/thread/630jg4z6cjkv4m2yv2ljgmf1zhdj1vqx vendor-advisory

---

apache-airflow

• <3.2.2