PT-2026-105523

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfill id path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-73406: Exposure of Sensitive Information to an Unauthorized Actor

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLICENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier,...

CVE-2026-73293: Improper Privilege Management

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/id/roles to create a custom manager role with permission bitmask 15, overridin...

PT-2026-70980

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description The Intel ALH digital-audio-interface driver contains an issue where the dai alh get properties function in drivers/dai/intel/alh/alh.c fails to validate the range of the caller-supplied strea...

PT-2026-71247

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient publish-access checks on the 'getBlockBreadcrumb', 'getRefText', and 'getBlockTreeInfos' endpoints allow the disclosure of protected document content and metadata. Anonymous readers or...

CVE-2026-18687

creationtimestamp| type| source ---|---|--- 2026-08-11 22:05:35+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mstmpsif6p25 2026-08-13 04:45:05+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813 2026-08-13 14:13:46+00:00| seen|...

CVE-2026-73219

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines...

CVE-2026-69113

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-69113 Cap v0.3.1 Broken Access Control via video comment endpoint

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

EUVD-2026-56853

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-69113 Cap v0.3.1 Broken Access Control via video comment endpoint

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-73219

CVAT vulnerability CVE-2026-73219 affects versions 2.17.0 through 2.72.0. A user with write access can submit a batch automatic annotation request to RequestViewSet.create using inconsistent task and job IDs. The task ID determines the single active request slot, which can block automatic annotat...

CVE-2026-73219 CVAT: Denial of service with regards to automatic annotation

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines...

CVE-2026-62869

Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network...

CVE-2026-62869 Azure Entra ID Spoofing Vulnerability

...

CVE-2026-62869

CVE-2026-62869 affects Azure Entra ID and related services (Azure Active Directory, Entra ID, Entra Provisioning Service, SRE Agent, etc.). The root cause is insufficient verification of data authenticity, enabling an authorized attacker to perform network spoofing. Affected components include Az...

CVE-2026-62869 Azure Entra ID Spoofing Vulnerability

...

EUVD-2026-56779

Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network...

CVE-2026-56720

CVE-2026-56720 — CamaleonCMS

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the id column filter in the DataObject grid. An attacker can execute arbitrary SQL commands by submitting crafted input, potentially exfiltrating or modifying all database contents. This is only exploitable if the...