CLEANSTART-2026-ZG38480 Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope

Security vulnerability affects the airflow-3 package. Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope...

CLEANSTART-2026-XI09971 Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET...

Security vulnerability affects the airflow-3 package. The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in...

PT-2026-109648

Name of the Vulnerable Software and Affected Versions Pingvin Share X versions prior to 1.22.0 Description An issue exists where the application unconditionally trusts proxy headers in backend/src/main.ts, allowing unauthenticated remote attackers to bypass per-IP rate limiting. By rotating spoof...

CVE-2026-107848

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUESTTOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute...

CVE-2026-107851

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by...

GHSA-9FF2-P842-45WQ Contao: Cross-site request forgery in custom backend actions

RequestTokenListener is the only generic REQUESTTOKEN validator in Contao and it only runs on POST. On the GET side the guard is local and declarative, and it only fires when an act parameter is present. Every back end action dispatched through a different parameter therefore has no CSRF protecti...

CVE-2026-107848 Contao: Cross-site request forgery in custom backend actions

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUESTTOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute...

EUVD-2026-95979

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUESTTOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute...

CVE-2026-107848 Contao: Cross-site request forgery in custom backend actions

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUESTTOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute...

CVE-2026-107845

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments in comments-bundle/contao/dca/tlcomments.php. When a backend user ope...

CVE-2026-107845 Contao: Cross-site scripting in the comments bundle

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments in comments-bundle/contao/dca/tlcomments.php. When a backend user ope...

CVE-2026-107845

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments in comments-bundle/contao/dca/tlcomments.php. When a backend user ope...

CVE-2026-107845

The Contao Open Source CMS is vulnerable to Cross-site scripting (XSS) in the comments bundle (versions 4.0.0 through 5.3.50 and 5.7.12). The root cause is insufficient attribute and URL encoding of email or website metadata within the listComments() function in comments-bundle/contao/dca/tl_comm...

@aws-amplify/backend (>=0.0.0-test-20240319203855, <=0.13.2), @aws-amplify/backend-data (>=0.0.0-test-20240319203855, <=0.11.0) potentially affected by CVE-2026-108096 via @aws-amplify/data-construct (>=1.7.0-gen2-release.0, <=1.12.0-gen2-migration-1015.0)

@aws-amplify/data-construct NPM version =1.7.0-gen2-release.0, =0.0.0-test-20240319203855, =0.0.0-test-20240319203855, =0.11.0 Source cves: CVE-2026-108096 Source advisory: MEND:CVE-2026-108096...

@aws-amplify/backend (>=0.0.0-test-20240319203855, <=0.13.2), @aws-amplify/backend-data (>=0.0.0-test-20240319203855, <=0.11.0) +2 more potentially affected by CVE-2026-108096 via @aws-amplify/graphql-api-construct (>=1.4.0, <=1.20.2)

@aws-amplify/graphql-api-construct NPM version =1.4.0, =0.0.0-test-20240319203855, =0.0.0-test-20240319203855, =1.4.0, =1.0.0, =1.1.111 Source cves: CVE-2026-108096 Source advisory: MEND:CVE-2026-108096...

CVE-2026-106488

A flaw was found in plugin-auth-backend-module-oidc-provider. In deployments using email-based identity resolution with an OpenID Connect OIDC provider that allows unverified email addresses, an authenticated attacker can achieve privilege escalation by assuming another catalog identity. This...

Linux xen-netfront: backend can crash guest via malformed RX packets

ISSUE DESCRIPTION If a RX packet sent from the networking backend to the Linux xen-netfront driver is split into multiple slots and the first slot is shorter than an Ethernet header, a BUG will crash the guest. This is a backend induced Denial of Service DoS. IMPACT A malicious network backend ca...

CVE-2026-106491

A flaw was found in the Backstage plugin-proxy-backend component. An authenticated remote attacker can exploit improper input validation by submitting a specially crafted request URL to the proxy backend. This causes the proxy service to forward requests to endpoints outside the configured base...

CVE-2026-19571

The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...

CVE-2026-106506

A flaw was found in plugin-scaffolder-backend. This vulnerability allows an authenticated user with permission to create and view tasks to access confidential task secrets, resulting in information disclosure. Due to improper input validation in task list ordering, an attacker can submit repeated...