CVE-2026-55530

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, astgreprewrite lacks the @requireapproval decorator used by sibling mutation tools. With dryrun=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected...

EUVD-2026-65501

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, astgreprewrite lacks the @requireapproval decorator used by sibling mutation tools. With dryrun=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected...

CVE-2026-55530 PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, astgreprewrite lacks the @requireapproval decorator used by sibling mutation tools. With dryrun=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected...

CVE-2026-55528 praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.authtoken but AgentServer.createapp does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when...

CVE-2026-78360

A missing authorization flaw was found in Anitya. The user deletion endpoint checks that the caller is logged in but does not check that the caller is an administrator. Any authenticated user can delete arbitrary user accounts, including administrator accounts, which can remove administrative...

USN-8674-1 openjdk-lts vulnerabilities

It was discovered that the JSSE component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of OpenJDK 11 did not correctly authorize users. A remote attack...

USN-8673-1 openjdk-8 vulnerabilities

It was discovered that the JSSE component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the ImageIO component of OpenJDK 8 did not correctly authorize users. A remote...

CVE-2026-78887

A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Executing a manipulation can lead to incorrect authorization. The attack can be launched remotely. This attack is characterized by high...

CVE-2026-78581

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

EUVD-2026-65489

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

CVE-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

CVE-2026-78581

CVE-2026-78581 is an authorization bypass (CWE-639) in Kibana affecting the AI Assistant feature. An authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-g...

EUVD-2026-65475

A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Executing a manipulation can lead to incorrect authorization. The attack can be launched remotely. This attack is characterized by high...

CVE-2026-78887

An incorrect authorization flaw was identified in liketrek TREK versions up to 3.0.22 , affecting the validateShareTokenForAsset function within the Journey Photo Proxy component. A remote attacker, without authentication, can manipulate the share token validation logic to gain partial access to ...

CVE-2026-78887 liketrek TREK Journey Photo Proxy validateShareTokenForAsset authorization

A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Executing a manipulation can lead to incorrect authorization. The attack can be launched remotely. This attack is characterized by high...

CVE-2026-78887 liketrek TREK Journey Photo Proxy validateShareTokenForAsset authorization

A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Executing a manipulation can lead to incorrect authorization. The attack can be launched remotely. This attack is characterized by high...

BIT-KEYCLOAK-2026-17048 Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

CVE-2026-79669

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...

CVE-2026-79672

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...

CVE-2026-79666

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...