EUVD-2026-83846

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication 2FA setup, through a client policy. A user can bypass this...

CVE-2026-90860

Canva Mobile App for HarmonyOS prior to v1.15.1 failed to restrict HTTP headers returned to an external origin running in a privileged WebView . The underlying cause is an insufficient origin check on WebView responses, allowing a threat actor with control of the WebView to read a user's session ...

EUVD-2026-83843

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-90860

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-90860

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

Malicious code in pflag14570 (npm)

Source: amazon-inspector 2b7164c1405ab2587c562b3b9eb8cdad8258aab8f25b829da64c83d7185eab6c index.js is an IIFE that executes at module load, reads document.cookie, fetches a list of authenticated application paths /profile, /admin, /api/me, /settings, and similar, extracts a flag-shaped substring...

CVE-2026-94218

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication 2FA setup, through a client policy. A user can bypass this...

Malicious code in pflag14570 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b7164c1405ab2587c562b3b9eb8cdad8258aab8f25b829da64c83d7185eab6c index.js is an IIFE that executes at module load, reads document.cookie, fetches a list of authenticated application paths /profile, /admin, /api/me,...

Malicious code in npmscript_tesstalert_unpkg (npm)

Source: amazon-inspector 5fa1adfe349e0a6092589e90bf38184b5769148bf42b4216fc714ad446ea747b The package ships a single browser JavaScript file declared as both main and unpkg, so any page embedding the package via the unpkg CDN loads this script. The script calls alert11 and then executes...

MAL-2026-16309 Malicious code in npmscript_tesstalert_unpkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c84336bfcd8d43d3f97942ded74e5a049c05e024f5a4b79dbee66acff1e1627 The package ships a single script exposed via the unpkg field for CDN loading into web pages. When executed in a browser, the script reads...

Malicious code in npmscript_tesstalert_unpkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c84336bfcd8d43d3f97942ded74e5a049c05e024f5a4b79dbee66acff1e1627 The package ships a single script exposed via the unpkg field for CDN loading into web pages. When executed in a browser, the script reads...

CVE-2026-86473: Insufficient Session Expiration

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

PT-2026-96159

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.2.7 Description The OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java fails to compare stateToken and cookieToken when IS GAE is false, impacting self-hosted Docker and WAR deployments. This...

PT-2026-96091

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description A DOM-based cross-site scripting XSS issue exists in the contextual menu JavaScript component. The ContextualMenu class populates HTML elements by assigning user-controllable values to the innerHTML...

PT-2026-96121

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.2 Description The Core API logout endpoint only revokes session tokens provided via the token cookie. If a client uses an Authorization bearer header for authentication during logout, the endpoint returns a...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

CVE-2026-94373: Improper Neutralization of Input During Web Page Generation

MISP contains a DOM-based cross-site scripting XSS vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string...

CVE-2026-90860: Improper Removal of Sensitive Information Before Storage or Transfer

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-46649: Improper Restriction of Excessive Authentication Attempts

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/loginwithcode/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An...

CVE-2026-94372: Improper Neutralization of Input During Web Page Generation

MISP contains a stored cross-site scripting XSS vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the...