EUVD-2026-96728

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

CVE-2026-18418: Out-of-bounds Read

The zbus proxy agent IPC backend in subsys/zbus/proxyagent/zbusproxyagentipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbusproxymsg carries a fixed-size channelname array as its last member, and nothing in the transport guarantees...

CVE-2026-108162 Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn,...

CVE-2026-108162 Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn,...

CLEANSTART-2026-ZG38480 Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope

Security vulnerability affects the airflow-3 package. Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope...

CLEANSTART-2026-XI09971 Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET...

Security vulnerability affects the airflow-3 package. The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in...

PT-2026-109648

Name of the Vulnerable Software and Affected Versions Pingvin Share X versions prior to 1.22.0 Description An issue exists where the application unconditionally trusts proxy headers in backend/src/main.ts, allowing unauthenticated remote attackers to bypass per-IP rate limiting. By rotating spoof...

CVE-2026-107848

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUESTTOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute...

CVE-2026-107851

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by...

GHSA-9FF2-P842-45WQ Contao: Cross-site request forgery in custom backend actions

RequestTokenListener is the only generic REQUESTTOKEN validator in Contao and it only runs on POST. On the GET side the guard is local and declarative, and it only fires when an act parameter is present. Every back end action dispatched through a different parameter therefore has no CSRF protecti...

CVE-2026-107848 Contao: Cross-site request forgery in custom backend actions

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUESTTOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute...

EUVD-2026-95979

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUESTTOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute...

CVE-2026-107848 Contao: Cross-site request forgery in custom backend actions

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUESTTOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute...

CVE-2026-107845

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments in comments-bundle/contao/dca/tlcomments.php. When a backend user ope...

CVE-2026-107845 Contao: Cross-site scripting in the comments bundle

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments in comments-bundle/contao/dca/tlcomments.php. When a backend user ope...

CVE-2026-107845

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments in comments-bundle/contao/dca/tlcomments.php. When a backend user ope...

CVE-2026-107845

The Contao Open Source CMS is vulnerable to Cross-site scripting (XSS) in the comments bundle (versions 4.0.0 through 5.3.50 and 5.7.12). The root cause is insufficient attribute and URL encoding of email or website metadata within the listComments() function in comments-bundle/contao/dca/tl_comm...

@aws-amplify/backend (>=0.0.0-test-20240319203855, <=0.13.2), @aws-amplify/backend-data (>=0.0.0-test-20240319203855, <=0.11.0) potentially affected by CVE-2026-108096 via @aws-amplify/data-construct (>=1.7.0-gen2-release.0, <=1.12.0-gen2-migration-1015.0)

@aws-amplify/data-construct NPM version =1.7.0-gen2-release.0, =0.0.0-test-20240319203855, =0.0.0-test-20240319203855, =0.11.0 Source cves: CVE-2026-108096 Source advisory: MEND:CVE-2026-108096...

@aws-amplify/backend (>=0.0.0-test-20240319203855, <=0.13.2), @aws-amplify/backend-data (>=0.0.0-test-20240319203855, <=0.11.0) +2 more potentially affected by CVE-2026-108096 via @aws-amplify/graphql-api-construct (>=1.4.0, <=1.20.2)

@aws-amplify/graphql-api-construct NPM version =1.4.0, =0.0.0-test-20240319203855, =0.0.0-test-20240319203855, =1.4.0, =1.0.0, =1.1.111 Source cves: CVE-2026-108096 Source advisory: MEND:CVE-2026-108096...

CVE-2026-106488

A flaw was found in plugin-auth-backend-module-oidc-provider. In deployments using email-based identity resolution with an OpenID Connect OIDC provider that allows unverified email addresses, an authenticated attacker can achieve privilege escalation by assuming another catalog identity. This...