PT-2026-81874

TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler in handleDeleteCustomDomain.ts authorizes a caller against a...

PT-2026-81329

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description PraisonAI contains path traversal flaws in its praisonai.code tool wrappers, which are intended to treat the workspace setting as a security boundary. The boundary is enforced inconsistently and...

PT-2026-81484

Name of the Vulnerable Software and Affected Versions Airbyte Platform affected versions not specified Description An issue exists where the platform determines the workspace for authorization decisions based on a field supplied by the caller. The AuthorizationServerHandler copies recognized...

CVE-2026-76837

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...

EUVD-2026-65009

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...

CVE-2026-76837

Baserow before 2.3.0 is vulnerable to stored cross-site scripting via the rich-text mention feature. The display name set through PATCH /api/user/account/ is interpolated without HTML encoding into the mention element built in mention.js. A name containing a double quote breaks out of the data-la...

CVE-2026-76837 Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...

CVE-2026-76837: Improper Neutralization of Input During Web Page Generation

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...

CVE-2026-64679

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated...

Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation

Summary Atlantis versions = 0.19.8 and 0.45.0 did not consistently validate user-controlled workspace values before using them to construct local workspace paths. A crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace paths outside the intended...

GHSA-26W5-6G95-GJ28 Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation

Summary Atlantis versions = 0.19.8 and 0.45.0 did not consistently validate user-controlled workspace values before using them to construct local workspace paths. A crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace paths outside the intended...

CVE-2026-64679

Atlantis , a self-hosted Go application that processes Terraform pull request events via webhooks, is affected by a path traversal vulnerability in its workspace handling. From version 0.19.8 through 0.44.x , user-controlled workspace values supplied via repository-level atlantis.yaml configurati...

CVE-2026-64679 Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated...

EUVD-2026-64142

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated...

CVE-2026-64679 Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated...

CVE-2026-64679 Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated...

CVE-2026-62676

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...

CVE-2026-62677

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing osenv.cwd value because omnigent/spec/parser.py stores the value verbatim and...

CVE-2026-62677

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing osenv.cwd value because omnigent/spec/parser.py stores the value verbatim and...

CVE-2026-62676 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...