{"vulnerability": "cve-2026-4929", "sightings": [{"uuid": "4224fd12-9f1a-4c26-80bd-07b875e1d39b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49298", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mn5o73vqfo2o", "content": "CVE-2026-49298: Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments", "creation_timestamp": "2026-05-31T13:27:29.824600Z"}, {"uuid": "caadd3ca-6459-42d1-8493-0d0b4112142a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49295", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moodmsmybf2i", "content": "CVE-2026-49295 - libde265 has an out-of-bounds write in process_reference_picture_set via predicted short-term RPS\nCVE ID : CVE-2026-49295\n \n Published : June 19, 2026, 8:09 p.m. | 1\u00a0hour, 33\u00a0minutes ago\n \n Description : libde265 is an open source implementation of the h.265 v...", "creation_timestamp": "2026-06-19T21:58:46.510536Z"}, {"uuid": "98f3eacd-4a05-4c38-9ea4-da24ac257255", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49293", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mou4vxh2ex2c", "content": "CVE-2026-49293 - High severity DoS in js-toml parser. O(n\u00b2) BigInt operations allow resource exhaustion via crafted TOML input. CVSS 7.5. No patch yet. Update or monitor usage. #CVE #infosec #javascript\n\nhttps://www.valtersit.com/cve/CVE-2026-49293/", "creation_timestamp": "2026-06-22T05:14:35.394347Z"}, {"uuid": "a4b82604-99ca-49f4-89a6-2878f871eada", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-49291", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-2r68-g678-7qr3", "content": "", "creation_timestamp": "2026-06-26T22:35:27.339225Z"}, {"uuid": "8b4ab1d8-8476-4050-b3fb-75ee08feb585", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-49293", "type": "published-proof-of-concept", "source": "https://github.com/sunnyadn/js-toml/security/advisories/GHSA-wp3c-266w-4qfq", "content": "", "creation_timestamp": "2026-06-27T00:35:47.219530Z"}, {"uuid": "fd373a75-7cc6-49b9-b804-55ec53128f4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49297", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpsjoi25k323", "content": "CVE-2026-49297: Apache Airflow Google provider: Path traversal via GCS object names \u2192 local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)", "creation_timestamp": "2026-07-04T07:22:55.036637Z"}, {"uuid": "ebb69180-b815-41dd-bd5c-30ce5614065c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49297", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpxzq23idw2v", "content": "CVE-2026-49297 - Apache Airflow Google provider: Path traversal via GCS object names \u2192 local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)\nCVE ID : CVE-2026-49297\n \n Published : July 6, 2026, 11:16 a.m. | 31\u00a0minutes ago\n \n Description : Apache Airflow'...", "creation_timestamp": "2026-07-06T11:53:39.149620Z"}, {"uuid": "6b559ab9-1183-407b-bfdc-8311b88b4c4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49296", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2k7ufu2n2p", "content": "CVE-2026-49296: Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}", "creation_timestamp": "2026-07-07T11:53:56.449297Z"}, {"uuid": "1c59d366-f8aa-4f28-87ab-18611911fd21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49296", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq2kn7e5lt2w", "content": "CVE-2026-49296 - Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}\nCVE ID : CVE-2026-49296\n \n Published : July 7, 2026, 10:16 a.m. | 1\u00a0hour, 31\u00a0minutes ago\n \n Description : Before apache-airflow 3.3.0, a user authorized t...", "creation_timestamp": "2026-07-07T12:01:24.063161Z"}, {"uuid": "6b251def-df3e-4d35-9d7d-bcb48eade8f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49297", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mr6y24fnvu23", "content": "\ud83d\udccc CVE-2026-49297 - Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket l... https://www.cyberhub.blog/cves/CVE-2026-49297", "creation_timestamp": "2026-07-21T23:37:06.724339Z"}]}