PT-2026-51347

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

CVE-2026-8934: Missing Authorization

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

org.http4k:http4k-api-graphql (5.44.0.0), org.http4k:http4k-api-jsonrpc (5.44.0.0) +180 more potentially affected by unknown CVE via org.http4k:http4k-core (5.44.0.0)

org.http4k:http4k-core MAVEN version 5.44.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-api-graphql 5.44.0.0 - org.http4k:http4k-api-jsonrpc 5.44.0.0 - org.http4k:http4k-api-jsonsche...

org.http4k:http4k-api-graphql (5.42.0.0), org.http4k:http4k-api-jsonrpc (5.42.0.0) +178 more potentially affected by unknown CVE via org.http4k:http4k-core (5.42.0.0)

org.http4k:http4k-core MAVEN version 5.42.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-api-graphql 5.42.0.0 - org.http4k:http4k-api-jsonrpc 5.42.0.0 - org.http4k:http4k-api-jsonsche...

org.http4k.pro:http4k-incubator-db (v6.3.0.0), org.http4k.pro:http4k-mcp-sdk (v6.3.0.0) +173 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (v6.3.0.0)

org.http4k:http4k-core MAVEN version v6.3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k.pro:http4k-incubator-db v6.3.0.0 - org.http4k.pro:http4k-mcp-sdk v6.3.0.0 -...

org.http4k.pro:http4k-incubator-db (v6.4.1.0), org.http4k.pro:http4k-mcp-sdk (v6.4.1.0) +173 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (v6.4.1.0)

org.http4k:http4k-core MAVEN version v6.4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k.pro:http4k-incubator-db v6.4.1.0 - org.http4k.pro:http4k-mcp-sdk v6.4.1.0 -...

GHSA-XM3X-9CFW-JHX4 NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

Summary The public GraphQL resolvers getFormDefinitionByObjectenApiUrlurl and the deprecated getFormDefinitionByIdid fetch a caller-supplied URL using the privileged Objecten-API token. Because the /graphql endpoint is permitAll and these resolvers do not declare a CommonGroundAuthentication...

NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

Summary The public GraphQL resolvers getFormDefinitionByObjectenApiUrlurl and the deprecated getFormDefinitionByIdid fetch a caller-supplied URL using the privileged Objecten-API token. Because the /graphql endpoint is permitAll and these resolvers do not declare a CommonGroundAuthentication...

Sentinel

Sentinel — Offensive Web & API Attack Framework Fingerpri...

PT-2026-51104

Name of the Vulnerable Software and Affected Versions @tinacms/app versions prior to 2.5.6 tinacms versions prior to 3.9.3 Description Cross-origin postMessage handlers allow for stored XSS and session takeover. The software registers window message listeners—specifically the useTina overlay...

PT-2026-50973

Name of the Vulnerable Software and Affected Versions NL Portal Backend Libraries versions 1.1.0 through 3.0.3 NL Portal Backend Libraries version 3.1.0 Description Unauthenticated users can access the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers...

NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)

Summary A previous advisory CVE-2026-49463 / GHSA-qpm9-h556-mwxm reported that any logged-in user could download any document by its identifier, and stated this was fixed in 3.0.1. For the document-content part that fix was incomplete: documents remained downloadable by any authenticated user in...

@tinacms/app (>=0.0.0-00aadfd-20260223215804, <=2.5.5), @tinacms/cli (>=0.0.0-00aadfd-20260223215804, <=2.5.0) +5 more potentially affected by CVE-2026-55661 via @tinacms/mdx (>=2.0.0, <=2.1.6)

@tinacms/mdx NPM version =2.0.0, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =3.9.2 Source cves: CVE-2026-55661 Source...

balto (>=0.1.5, <=0.3.0), fastapi (>=0.34.0, <=0.37.0) +3 more potentially affected by CVE-2026-48817 via starlette (0.12.7)

starlette PYPI version 0.12.7 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - balto =0.1.5, =0.34.0, =0.1.7, =0.14.0, =0.14.3 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

strawberry-graphql (>=0.13.2, <=0.13.4) potentially affected by CVE-2026-48817 via starlette (0.12.4)

starlette PYPI version 0.12.4 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - strawberry-graphql =0.13.2, =0.13.4 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

aiida-graphql (>=0.0.1, <=0.0.2), postblog (>=0.4.1, <=0.5.2) +1 more potentially affected by CVE-2026-48817 via starlette (0.12.10)

starlette PYPI version 0.12.10 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - aiida-graphql =0.0.1, =0.4.1, =0.16.5, =0.18.1 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

bocadillo (>=0.12.3, <=0.14.2), starlette-jsonrpc (>=0.1.0, <=0.2.0) +2 more potentially affected by CVE-2026-48817 via starlette (0.11.4)

starlette PYPI version 0.11.4 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - bocadillo =0.12.3, =0.1.0, =0.1.0, =0.11.0 - termpair 0.0.0.2 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

strawberry-graphql (>=0.13.0, <=0.13.1) potentially affected by CVE-2026-48817 via starlette (0.12.1)

starlette PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - strawberry-graphql =0.13.0, =0.13.1 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

aioboot (0.3.0), dms (0.0.3) +3 more potentially affected by CVE-2026-48817 via starlette (0.13.0)

starlette PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - aioboot 0.3.0 - dms 0.0.3 - piccolo-admin =0.3.1, =0.4.2, =0.18.2, =0.21.1 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

piccolo-admin (0.6.0), piccolo-api (0.7.0) +2 more potentially affected by CVE-2026-48817 via starlette (0.13.3)

starlette PYPI version 0.13.3 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - piccolo-admin 0.6.0 - piccolo-api 0.7.0 - starlette-graphql-zifulu =0.0.1a3, =0.22.0, =0.24.1 Source cves: CVE-2026-48817 Source advisory:...