CVE-2026-88817

Curiosity Workspace is affected by a privilege escalation vulnerability in its legacy access group creation endpoint . An authenticated, non-guest user could enroll themselves as an administrator and member of an existing access group without an invitation or approval. However, the flaw did not g...

CVE-2026-88817 Privilege escalation via legacy access group creation endpoint

An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access t...

CVE-2022-22954

CVE-2022-22954 CVE-2022-22954 VMware Workspace ONE Access freemarker SSTI Detección de múltiples puntos de activación de vulnerabilidades, detección por lotes multihilo, ejecución de comandos, escritura de archivos root@kitploit: // Single target vulnerability detection python CVE-2022-22954.py -...

CVE-2022-22954-Testi

CVE-2022-22954-Prueba Prueba de la vulnerabilidad CVE-2022-22954 VMware Workspace ONE Access e Identity Manager contienen una vulnerabilidad de ejecución remota de código debido a una inyección de plantilla del lado del servidor. Un actor malicioso con acceso a la red puede desencadenar una...

CVE-CVE-2025-25231

CVE-2025-25231 Nuclei 模板 该模板是为 Nuclei 工具编写的，用于检测 Omnissa Workspace ONE UEM 产品中的 CVE-2025-25231 （二次路径遍历）漏洞。 漏洞描述 CVE-2025-25231 是一种路径遍历漏洞，允许攻击者通过向受限 API 发送精心构造的 GET 请求，访问服务器上的敏感只读文件。该漏洞可能导致配置信息、API 密钥和系统日志等关键数据泄露。 3. 执行以下命令： root@kitploit: nuclei -t cve-2025-25231-path-traversal.yaml -u...

CVE-2022-22954

CVE-2022-22954 PoC VMware Workspace ONE Access and Identity Manager RCE via SSTI. CVE-2022-22954 - PoC SSTI Usage: root@kitploit: CVE-2022-22954.py -h -m SETMODE -i IP -c CMD optional arguments: -h, --help show this help message and exit -m SETMODE, --mode SETMODE Available modes: shodan | file |...

CVE-2026-79994 Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink race

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to...

CVE-2022-22954

CVE-2022-22954 PoC VMware Workspace ONE Access 和 Identity Manager 通过 SSTI 的远程代码执行漏洞。 CVE-2022-22954 - SSTI 概念验证 用法： root@kitploit: CVE-2022-22954.py -h -m SETMODE -i IP -c CMD optional arguments: -h, --help 显示此帮助信息并退出 -m SETMODE, --mode SETMODE 可选模式：shodan | file | manual -i IP, --ip IP 主机 IP 地址 ...

CVE-2026-63443

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API por...

CVE-2026-63443 Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API por...

CVE-2026-91933

Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from ChatFlows in other workspaces by supplying an unscoped chatflowid. Attackers can invoke GET and POST requests to retrieve tool definitions and...

EUVD-2026-78791

Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from ChatFlows in other workspaces by supplying an unscoped chatflowid. Attackers can invoke GET and POST requests to retrieve tool definitions and...

CVE-2026-91933 Flowise before 3.1.4 Authorization Bypass via openai-realtime

Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from ChatFlows in other workspaces by supplying an unscoped chatflowid. Attackers can invoke GET and POST requests to retrieve tool definitions and...

CVE-2026-91929 Flowise before 3.1.4 Cross-Tenant Authorization Bypass

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse...

CVE-2026-91930 Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organization owners, create workspaces, and gain administrative access to victim...

EUVD-2026-78787

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse...

EUVD-2026-78788

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organization owners, create workspaces, and gain administrative access to victim...

CVE-2026-91993 Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository...

CVE-2026-91993 Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository...

CVE-2026-46558

CVE-2026-46558 Plane 的 V2 资产子系统在缺乏正确成员关系检查的情况下，信任了用户提供的工作区 slug 和资产 UUID，这使得一个已认证用户可以读取、复制、删除和覆盖其他工作区中的资产。 简介 我在评审 Plane （开源项目管理平台）时发现了这个问题，带着一个非常具体的问题： V2 资产端点是否实际实施了工作区隔离，还是过度信任了攻击者提供的工作区 slug 和资产 ID？ 在这个案例中，答案是不。 Plane 的 V2 资产子系统暴露了两个相关的授权缺陷，破坏了任何已认证用户的工作区隔离： 工作区级资产端点在执行资产操作之前，没有强制目标工作区的成员资格...