CVE-2026-108742: Missing Authorization

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen...

opencti v7.261008.0

Note: THREAD 2026 — 15 October, Paris. Our community conference for threat intelligence and cyber defense practitioners. Talks, labs, workshops, and an evening social. Join us → Introduction OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence...

CVE-2026-108261

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the // admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while...

CVE-2026-108261 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the // admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while...

CVE-2026-108261

Tina, a headless content management system, is vulnerable to an origin validation error in versions prior to tinacms 3.14.0 and @tinacms/app 2.5.14 . The vulnerability exists because the /~/* admin preview route can convert an attacker-controlled hash-router splat into an off-origin iframe URL vi...

CVE-2026-108261 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the // admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while...

CVE-2026-108261 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the // admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while...

CVE-2026-108261

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the // admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while...

CVE-2026-108096

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...

CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...

CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...

@aws-amplify/amplify-category-api (>=5.8.0, <=5.15.7), @aws-amplify/amplify-container-hosting (>=2.6.0-ampgenconfig.0, <=2.8.27) +13 more potentially affected by CVE-2026-108096 via @aws-amplify/graphql-index-transformer (>=2.2.0, <=3.1.1)

@aws-amplify/graphql-index-transformer NPM version =2.2.0, =5.8.0, =2.6.0-ampgenconfig.0, =1.8.4-rc.2def814808.0, =11.0.0-ampgenconfig.0, =3.2.0, =0.1.1-raven.0, =2.2.0, =1.3.0, =0.1.0-alpha.0, =3.1.13-stack-limits.3, =2.5.4-beta.0, =2.5.4-cdkv2.3 - testtransformerlambda 1.0.0 Source cves:...

CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...

EUVD-2026-95936

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...

CVE-2026-108096

The AWS Amplify API Category contains an improper authorization vulnerability in the query resolvers generated by the @aws-amplify/graphql-index-transformer component. This flaw exists in versions prior to 3.1.2 and allows an authenticated remote user to read records owned by other users within t...

@aws-amplify/backend (>=0.0.0-test-20240319203855, <=0.13.2), @aws-amplify/backend-data (>=0.0.0-test-20240319203855, <=0.11.0) +2 more potentially affected by CVE-2026-108096 via @aws-amplify/graphql-api-construct (>=1.4.0, <=1.20.2)

@aws-amplify/graphql-api-construct NPM version =1.4.0, =0.0.0-test-20240319203855, =0.0.0-test-20240319203855, =1.4.0, =1.0.0, =1.1.111 Source cves: CVE-2026-108096 Source advisory: MEND:CVE-2026-108096...

CVE-2026-108096

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +36 more potentially affected by CVE-2026-107727 via strawberry-graphql (>=0.312.4, <=0.327.1)

strawberry-graphql PYPI version =0.312.4, =2025.4.0, =2025.4.0, =1.0.0, =0.9.0, =26.4.0rc1, =0.1.0a1, =0.2.0, =1.0.1, =0.1.0, =1.17.0, =0.1.0, =0.0.246, =2.0.0, =0.0.1a0, =0.1.26, =0.1.32 and more Source cves: CVE-2026-107727 Source advisory: OSV:GHSA-M952-2W3F-6R8H...

Strawberry legacy graphql-ws retains naturally completed subscription slots

Summary Strawberry's legacy graphql-ws subscription handler can retain task and subscription bookkeeping after a one-shot subscription has naturally sent its complete message. When the application configures maxsubscriptionsperconnection, the handler counts those completed operations in...

Allocation of Resources Without Limits or Throttling

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the legacy graphql-ws protocol handler in strawberry/subscriptions/protocols/graphqlws/handlers.py, where completed or...