CVE-2026-68969 Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...

PT-2026-71131

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description Sensitive data, including Variable values and Connection extra contents, are written to the audit log in cleartext when submitted via the bulk endpoints PATCH /api/v2/variables and PATCH...

PT-2026-71237

SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from password-protected, hidden, or forbidden documents without...

PT-2026-71196

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

CVE-2026-73245

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

CVE-2026-73245

Kestra, an open-source event-driven orchestration platform, prior to 2.0.0-rc6 exposed Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env to disclose resolved configuration and POST /loggers/{...

CVE-2026-66340

CVE-2026-66340 affects the Mira ecosystem where the cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. This enables brute-force login attempts that can lead to unauthorized access to user accounts. T...

EUVD-2026-56903

Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/id endpoints. The GitHubTokenHTTPAuth...

CVE-2026-69119 Taubyte Tau v1.1.10 Missing Authorization via POST /projects/{id}

Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/id endpoints. The GitHubTokenHTTPAuth...

CVE-2026-69115 OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/getusers, /user/getallusersuid, and /group/getgroups. Attackers can exploit th...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via referrer enforcement in the ReferrerEnforcer code used by the backend and Install Tool. An attacker can invoke protected backend or Install Tool endpoints with an authenticated victim’s session by sending...

EUVD-2026-55992

Affected versions of cti-transmute contain an SSRF vulnerability in the /fetchmispevent and /mispsearchevents endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain...

CVE-2026-73160 cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP Addresses

Affected versions of cti-transmute contain an SSRF vulnerability in the /fetchmispevent and /mispsearchevents endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain...

CVE-2026-19418

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...

PT-2026-70935

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

EUVD-2026-55817

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the featureviews field, an attacker can bypass intended permission checks. This allows an unauthenticated remote...

CVE-2026-18947 Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materialization

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the featureviews field, an attacker can bypass intended permission checks. This allows an unauthenticated remote...

Malicious code in postcss-initial-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e88db5eb44ddcfa3cd22d46e8b6e6a1cd2e7da25a5942d35550d50f2cbbb9ea3 index.js contains a unicode-escape-obfuscated block that runs when the package is required. It queries public Ethereum RPC endpoints 1rpc.io/eth,...

CVE-2026-72567 deepwiki-open - Unauthenticated Path Traversal Leading to Arbitrary File Write and Delete

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...

EUVD-2026-55240

A server-side request forgery SSRF vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action...