CVE-2026-100288: Cleartext Storage of Sensitive Information

Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records...

CVE-2026-102877: Server-Side Request Forgery (SSRF)

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

PT-2026-102500

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...

PT-2026-102497

Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. S3ToTeradataOperator and AzureBlobStorageToTeradataOperator interpolate the source bucket's credentials as plain string literals into the CREATE MULTISET TABLE ... LOCATION statement whenever the...

PT-2026-102643

Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records...

PT-2026-102640

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset...

PT-2026-102499

Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...

CVE-2026-81914: Improper Neutralization of Special Elements in Data Query Logic

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

Summary A java.nio.file.Path field bound from untrusted JSON reaches JDKFromStringDeserializer.NioPathHelper.deserialize. The attacker string flows through new URIvalue → Path.ofuri, then on FileSystemNotFoundException into a ServiceLoader enumeration that calls provider.getPathuri on the first...

GHSA-WJGM-6HV5-3CVF jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

Summary A java.nio.file.Path field bound from untrusted JSON reaches JDKFromStringDeserializer.NioPathHelper.deserialize. The attacker string flows through new URIvalue → Path.ofuri, then on FileSystemNotFoundException into a ServiceLoader enumeration that calls provider.getPathuri on the first...

CVE-2026-101333

A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using...

UBUNTU-CVE-2026-101333

A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using...

SUSE-SU-2026:4373-1 Security update for gnome-shell

This update for gnome-shell fixes the following issue: - CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to an out-of-bounds read bsc1280619...

Introducing the Wiz Partner Alliance Managed Service Provider Program

Empowering managed services partners to deliver world-class cloud and AI security at scale...

PT-2026-99908

A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using...

PT-2026-102338

Name of the Vulnerable Software and Affected Versions LiteLLM affected versions not specified Description A weak authentication issue exists in the JWT authentication flow. An attacker with a valid JSON Web Token JWT from the configured identity provider can authenticate as any existing user by...

CVE-2026-101042 Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity

Parse Server is an open-source backend server. In versions = 9.0.0 = 8.0.2 8.6.91, the code-based authentication adapters GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo verify the client's authorization code with the external provider on signup and on...

CVE-2026-101042 Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity

Parse Server is an open-source backend server. In versions = 9.0.0 = 8.0.2 8.6.91, the code-based authentication adapters GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo verify the client's authorization code with the external provider on signup and on...

Insertion of Sensitive Information into Log File

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the memory embedding failover logic, where the primary embedding provider's configured API key is reused when a request is redirected ...

CVE-2026-100556

OpenClaw npm package openclaw versions = 2026.5.2 and command to reset the shared group session and persist a provider and model override. This allows a command-denied group member to select a provider and model already permitted by the operator for subsequent turns in the shared group session,...