EUVD-2026-102854

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...

Linux Distros Unpatched Vulnerability : CVE-2026-62322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the...

PT-2026-116119

🚨 CVE-2026-111720 fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopbac...

PT-2026-115603

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 5 through 5.0.4 Description An issue involving missing authentication for critical functions and improper neutralization of special elements used in SQL commands allows for SQL Injection. This occurs when certain backend...

PT-2026-116041

FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token...

GHSA-3XR5-8W6C-P5GW Backstage: Improper access control in backend action invocation

Impact An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. Patches Patched in @backstage/backend-defaults version 0.17.8 Workarounds Limit access to action invocation...

EUVD-2026-97833

Backstage: Improper access control in backend action invocation...

DEBIAN-CVE-2026-62322

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-62322

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-62322

The Python Social Auth library is vulnerable to a Login CSRF attack in the LINE backend (LineOAuth2) prior to version 5.0.2 . The root cause is a failure to validate the returned OAuth state during the authorization code exchange. An attacker can initiate authorization for a controlled LINE accou...

CVE-2026-62322 Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

EUVD-2026-102323

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-55414

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL...

CVE-2026-54683

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/documentapi/documentapi/document/documentId/content REST route...

EUVD-2026-102226

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL...

CVE-2026-55414 NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL...

CVE-2026-55414

The NL Portal Backend Libraries are vulnerable to a Server-Side Request Forgery (SSRF) due to unauthenticated GraphQL resolvers, getFormDefinitionByObjectenApiUrl and getFormDefinitionById, forwarding a caller-influenced URL. These resolvers lack CommonGroundAuthentication and forward the privile...

CVE-2026-55414 NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL...

CVE-2026-54683 NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user until 3.0.3 (incomplete fix of CVE-2026-49463)

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/documentapi/documentapi/document/documentId/content REST route...

CVE-2026-54683

The NL Portal Backend Libraries are vulnerable to an authorization bypass in the nl.nl-portal:documenten-api component (versions prior to 3.0.3 ). The flaw allows any authenticated user to retrieve the contents of any document without verifying ownership or an authorized relationship. This occurs...