OpenCTI May Bypass Introspection Restriction

Summary The regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed characters from the query. Details GraphQL Queries in OpenCTI can be validated using the secureIntrospectionPlugin. Impact Bypassing this restriction...

CVE-2026-8934

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

EUVD-2026-38262

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

CVE-2026-8934

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

CVE-2026-8934

The CVE-2026-8934 describes a Missing Authorization vulnerability in a GraphQL private API operation within Google App Engine Cloud Console, enabling an unauthenticated attacker to leak sensitive App Engine request logs from other projects via a crafted request. Affected component: Google Cloud C...

CVE-2026-8934 Cross-Project Information Leakage in Google App Engine UI

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

CVE-2026-8934 Cross-Project Information Leakage in Google App Engine UI

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

CVE-2026-8934: Missing Authorization

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

PT-2026-51347

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

org.http4k:http4k-api-graphql (5.42.0.0), org.http4k:http4k-api-jsonrpc (5.42.0.0) +178 more potentially affected by unknown CVE via org.http4k:http4k-core (5.42.0.0)

org.http4k:http4k-core MAVEN version 5.42.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-api-graphql 5.42.0.0 - org.http4k:http4k-api-jsonrpc 5.42.0.0 - org.http4k:http4k-api-jsonsche...

org.http4k:http4k-api-graphql (5.44.0.0), org.http4k:http4k-api-jsonrpc (5.44.0.0) +180 more potentially affected by unknown CVE via org.http4k:http4k-core (5.44.0.0)

org.http4k:http4k-core MAVEN version 5.44.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-api-graphql 5.44.0.0 - org.http4k:http4k-api-jsonrpc 5.44.0.0 - org.http4k:http4k-api-jsonsche...

org.http4k.pro:http4k-incubator-db (v6.3.0.0), org.http4k.pro:http4k-mcp-sdk (v6.3.0.0) +173 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (v6.3.0.0)

org.http4k:http4k-core MAVEN version v6.3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k.pro:http4k-incubator-db v6.3.0.0 - org.http4k.pro:http4k-mcp-sdk v6.3.0.0 -...

org.http4k.pro:http4k-incubator-db (v6.4.1.0), org.http4k.pro:http4k-mcp-sdk (v6.4.1.0) +173 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (v6.4.1.0)

org.http4k:http4k-core MAVEN version v6.4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k.pro:http4k-incubator-db v6.4.1.0 - org.http4k.pro:http4k-mcp-sdk v6.4.1.0 -...

GHSA-XM3X-9CFW-JHX4 NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

Summary The public GraphQL resolvers getFormDefinitionByObjectenApiUrlurl and the deprecated getFormDefinitionByIdid fetch a caller-supplied URL using the privileged Objecten-API token. Because the /graphql endpoint is permitAll and these resolvers do not declare a CommonGroundAuthentication...

NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

Summary The public GraphQL resolvers getFormDefinitionByObjectenApiUrlurl and the deprecated getFormDefinitionByIdid fetch a caller-supplied URL using the privileged Objecten-API token. Because the /graphql endpoint is permitAll and these resolvers do not declare a CommonGroundAuthentication...

Sentinel

Sentinel — Offensive Web & API Attack Framework Fingerpri...

PT-2026-51104

Name of the Vulnerable Software and Affected Versions @tinacms/app versions prior to 2.5.6 tinacms versions prior to 3.9.3 Description Cross-origin postMessage handlers allow for stored XSS and session takeover. The software registers window message listeners—specifically the useTina overlay...

PT-2026-50973

Name of the Vulnerable Software and Affected Versions NL Portal Backend Libraries versions 1.1.0 through 3.0.3 NL Portal Backend Libraries version 3.1.0 Description Unauthenticated users can access the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers...

NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)

Summary A previous advisory CVE-2026-49463 / GHSA-qpm9-h556-mwxm reported that any logged-in user could download any document by its identifier, and stated this was fixed in 3.0.1. For the document-content part that fix was incomplete: documents remained downloadable by any authenticated user in...

@tinacms/app (>=0.0.0-00aadfd-20260223215804, <=2.5.5), @tinacms/cli (>=0.0.0-00aadfd-20260223215804, <=2.5.0) +5 more potentially affected by CVE-2026-55661 via @tinacms/mdx (>=2.0.0, <=2.1.6)

@tinacms/mdx NPM version =2.0.0, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =3.9.2 Source cves: CVE-2026-55661 Source...