{"metadata": {"vulnerability": "CVE-2026-33264", "count": 26, "kinds": {"milestone": 7, "sighting": 7, "kev": 0, "other": 12}, "linked_omitted": 0}, "data": [{"timestamp": "2026-03-18T10:53:38.405Z", "date_only": false, "value": "2026-03-18T10:53:38.405Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-33264", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-07T00:00:00Z", "date_only": false, "value": "2026-07-07T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-33264", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2026-07-07T00:00:00Z", "date_only": false, "value": "2026-07-07T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-33264", "record": "FKIE_CVE-2026-33264", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-07-07T09:20:18.518Z", "date_only": false, "value": "2026-07-07T09:20:18.518Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-33264", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-07T10:16:40Z", "date_only": false, "value": "2026-07-07T10:16:40Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2943-9672-R45W", "record": "GHSA-2943-9672-R45W", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-07-07T10:16:40.443Z", "date_only": false, "value": "2026-07-07T10:16:40.443", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-33264", "record": "FKIE_CVE-2026-33264", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-07T10:16:40.443Z", "date_only": false, "value": "2026-07-07T10:16:40.443Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-2082", "record": "PYSEC-2026-2082", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-07T10:30:26.100Z", "date_only": false, "value": "2026-07-07T10:30:26.100516Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/116878227880912732", "record": "cve-2026-33264", "field": "creation_timestamp", "uuid": "40625e39-10fd-4ea9-862c-e87809332be5", "content": "CVE-2026-33264: Apache Airflow <3.3.0 has a CRITICAL deserialization flaw. DAG authors can trigger remote code execution on Scheduler/API Server. Upgrade to 3.3.0+ and restrict allowed_deserialization_classes. Details: https://radar.offseq.com/threat/cve-2026-33264-cwe-502-deserialization-of-untruste-8bbc1aa55d6c3415 #OffSeq #Airflow #Infosec #CVE202633264", "url": "https://infosec.exchange/users/offseq/statuses/116878227880912732"}, {"timestamp": "2026-07-07T10:30:27.679Z", "date_only": false, "value": "2026-07-07T10:30:27.679495Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mq2fkleckz23", "record": "cve-2026-33264", "field": "creation_timestamp", "uuid": "f726afa5-65ce-4b64-bdc6-25b05107873e", "content": "CVE-2026-33264: Apache Airflow <3.3.0 has a CRITICAL deserialization bug \u2014 DAG authors could trigger RCE on Scheduler/API Server. Upgrade to 3.3.0+ and restrict deserialization classes now. https://radar.offseq.com/threat/cve-2026-33264-cwe-502-deserialization-of-untruste-8bbc1aa55d6c3415 #OffSeq...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mq2fkleckz23"}, {"timestamp": "2026-07-07T11:38:55.238Z", "date_only": false, "value": "2026-07-07T11:38:55.238434Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2jez5o4b27", "record": "CVE-2026-33264", "field": "creation_timestamp", "uuid": "f9bc7807-3cae-4760-a1f7-838499005021", "content": "CVE-2026-33264: Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2jez5o4b27"}, {"timestamp": "2026-07-07T11:52:06.860Z", "date_only": false, "value": "2026-07-07T11:52:06.860608Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq2k4insdp2w", "record": "CVE-2026-33264", "field": "creation_timestamp", "uuid": "0ec945df-5467-4913-a299-a1ccd45ef6da", "content": "CVE-2026-33264 - Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()\nCVE ID : CVE-2026-33264\n \n Published : July 7, 2026, 10:16 a.m. | 1\u00a0hour, 31\u00a0minutes ago\n \n Description : A bug in `BaseSerialization.deserialize()`...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq2k4insdp2w"}, {"timestamp": "2026-07-07T12:31:35Z", "date_only": false, "value": "2026-07-07T12:31:35Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2943-9672-R45W", "record": "GHSA-2943-9672-R45W", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-07T12:48:06.041Z", "date_only": false, "value": "2026-07-07T12:48:06.041Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2026-33264", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-07T16:22:04.705Z", "date_only": false, "value": "2026-07-07T16:22:04.705363Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq2z7dj6b22i", "record": "CVE-2026-33264", "field": "creation_timestamp", "uuid": "7438ba62-ee7e-4528-ab45-a6e84892da7b", "content": "CVE-2026-33264 - apache airflow\nA bug in Apache Airflow allowed malicious DAG authors to execute code on the Airflow server, potentially leading to unauthorized access or data breaches. To\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apacheairflow #apachefoundation #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mq2z7dj6b22i"}, {"timestamp": "2026-07-08T03:56:40.205Z", "date_only": false, "value": "2026-07-08T03:56:40.205Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-33264", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-09T03:37:06.086Z", "date_only": false, "value": "2026-07-09T03:37:06.086667Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mq6pfc77f32f", "record": "CVE-2026-33264", "field": "creation_timestamp", "uuid": "6f4b5eaa-3eb9-478e-9155-410d75ff205b", "content": "\ud83d\udccc CVE-2026-33264 - A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server l... https://www.cyberhub.blog/cves/CVE-2026-33264", "url": "https://bsky.app/profile/cyberhub.blog/post/3mq6pfc77f32f"}, {"timestamp": "2026-07-09T08:41:48.718Z", "date_only": false, "value": "2026-07-09T08:41:48.718Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-AIRFLOW-2026-33264", "record": "BIT-AIRFLOW-2026-33264", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-09T10:35:31.607Z", "date_only": false, "value": "2026-07-09T10:35:31.607691Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-2082", "record": "PYSEC-2026-2082", "field": "modified", "linked_record": true}, {"timestamp": "2026-07-09T13:02:03.652Z", "date_only": false, "value": "2026-07-09T13:02:03.652598Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq7oxjbz6v2d", "record": "CVE-2026-33264", "field": "creation_timestamp", "uuid": "82e6fe94-42d0-4bc7-a137-9114c747b4ce", "content": "CVE-2026-33264\nA bug in Apache Airflow allows a malicious DAG author to execute code on the Airflow server. This happens when the server loads a DAG that contains a malicious trigger. To fix this, users should upgrade to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mq7oxjbz6v2d"}, {"timestamp": "2026-09-04T19:23:01Z", "date_only": false, "value": "2026-09-04T19:23:01Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2943-9672-R45W", "record": "GHSA-2943-9672-R45W", "field": "modified", "linked_record": true}, {"timestamp": "2026-09-08T08:34:36.952Z", "date_only": false, "value": "2026-09-08T08:34:36.952Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-AIRFLOW-2026-33264", "record": "BIT-AIRFLOW-2026-33264", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-09T07:45:14Z", "date_only": false, "value": "2026-10-09T07:45:14Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-VP80273", "record": "CLEANSTART-2026-VP80273", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-10T00:41:46.501Z", "date_only": false, "value": "2026-10-10T00:41:46.501884Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-VP80273", "record": "CLEANSTART-2026-VP80273", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T06:53:53.359Z", "date_only": false, "value": "2026-11-03T06:53:53.359Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-33264", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-03T06:53:53.359Z", "date_only": false, "value": "2026-11-03T06:53:53.359Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-33264", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-03T07:19:34.410Z", "date_only": false, "value": "2026-11-03T07:19:34.410", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-33264", "record": "FKIE_CVE-2026-33264", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-15T23:13:35.905Z", "anchors": {"origin": {"timestamp": "2026-07-07T09:20:18.518Z", "date_only": false, "value": "2026-07-07T09:20:18.518Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-33264", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-07-07T09:20:18.518Z", "date_only": false, "value": "2026-07-07T09:20:18.518Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-33264", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 11368397.387521, "hours": 3157.888163200278, "days": 131.57867346667825, "min_seconds": 11368397.387521, "max_seconds": 11368397.387521, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-07T09:20:18.518Z", "date_only": false, "value": "2026-07-07T09:20:18.518Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-33264", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-15T23:13:35.905Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}