🚨 CVE-2026-54481
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
🎖@cveNotify
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
🎖@cveNotify
🚨 CVE-2026-55982
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
🎖@cveNotify
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
🎖@cveNotify
🚨 CVE-2026-55984
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
🎖@cveNotify
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
🎖@cveNotify
🚨 CVE-2026-57886
Cross-repository issue/comment attachment re-linking can expose private attachment content
🎖@cveNotify
Cross-repository issue/comment attachment re-linking can expose private attachment content
🎖@cveNotify
🚨 CVE-2026-57894
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
🎖@cveNotify
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
🎖@cveNotify
🚨 CVE-2026-58417
REST API exposes organization membership of private organizations to public
🎖@cveNotify
REST API exposes organization membership of private organizations to public
🎖@cveNotify
🚨 CVE-2026-58425
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
🎖@cveNotify
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
🎖@cveNotify
🚨 CVE-2026-58427
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
🎖@cveNotify
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
🎖@cveNotify
🚨 CVE-2026-58428
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
🎖@cveNotify
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
🎖@cveNotify
🚨 CVE-2026-58429
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
🎖@cveNotify
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
🎖@cveNotify
🚨 CVE-2026-58436
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
🎖@cveNotify
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
🎖@cveNotify
🚨 CVE-2026-59109
SQL injection in the Zalktis accounting application via
trading-partner-controlled text fields in received electronic invoices. When
importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis
concatenates partner-controlled values directly into SQL statement text using
string concatenation, with neither parameterised queries nor escaping. The
application's own escaping helper, Dazadi.sql_txt(),
is not invoked on these code paths, so a party that sends an invoice can break
out of the string literal and alter the query logic.
This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.
🎖@cveNotify
SQL injection in the Zalktis accounting application via
trading-partner-controlled text fields in received electronic invoices. When
importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis
concatenates partner-controlled values directly into SQL statement text using
string concatenation, with neither parameterised queries nor escaping. The
application's own escaping helper, Dazadi.sql_txt(),
is not invoked on these code paths, so a party that sends an invoice can break
out of the string literal and alter the query logic.
This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.
🎖@cveNotify
🚨 CVE-2026-73408
Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.
🎖@cveNotify
Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.
🎖@cveNotify
GitHub
adjust mysql handling · Budibase/budibase@d232bd9
AI agents, automations and apps that run your operations. Model agnostic. - adjust mysql handling · Budibase/budibase@d232bd9
🚨 CVE-2026-73428
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span>` with an empty `data-trix-attachment="{}"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.
🎖@cveNotify
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span>` with an empty `data-trix-attachment="{}"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.
🎖@cveNotify
GitHub
Fix XSS via javascript: URI in JSON drag-drop deserialization (#1293) · basecamp/trix@9c0a993
StringPiece.fromJSON trusted href attributes from application/x-trix-document
JSON payloads, allowing javascript: URIs to reach the DOM via drag-and-drop in
Level0InputController. Add DOMPurify.isV...
JSON payloads, allowing javascript: URIs to reach the DOM via drag-and-drop in
Level0InputController. Add DOMPurify.isV...
🚨 CVE-2026-73666
OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.
🎖@cveNotify
OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.
🎖@cveNotify
GitHub
backport: fix: enable dangerous auth flags only in guest mode - #712 … · openchoreo/backstage-plugins@114a215
…(#716)
* fix: enable dangerous auth flags only in guest mode (#709)
Signed-off-by: Kavith Lokuhewage <kaviththiranga@gmail.com>
* chore: Update changeset file for dangerous auth f...
* fix: enable dangerous auth flags only in guest mode (#709)
Signed-off-by: Kavith Lokuhewage <kaviththiranga@gmail.com>
* chore: Update changeset file for dangerous auth f...
🚨 CVE-2026-73843
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.
🎖@cveNotify
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.
🎖@cveNotify
GitHub
Merge commit from fork · openchoreo/openchoreo@047d80d
Signed-off-by: yashodgayashan <yashodgayashan@gmail.com>