16 matches found
CVE-2026-112047 OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident A...
CVE-2026-112047 OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident A...
CVE-2026-112047
OneUptime versions 14.0.2 before 14.0.69 are vulnerable to an incorrect authorization flaw (CWE-863) within Kubernetes AI Actions . This vulnerability occurs because project-wide permission checks can be exploited by authenticated project members to perform actions on clusters outside their inten...
CVE-2026-112047 OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident A...
CVE-2026-59970
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space,...
EUVD-2026-103145
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space,...
CVE-2026-59970
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space,...
PT-2026-116141
Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.6.10 Description An authenticated user can trigger a Server-Side Request Forgery SSRF by creating a Space and configuring an AI provider with a URL targeting an internal address. When an AI action is invoked...
Malicious code in @zapier/ai-actions-react (npm)
Source: amazon-inspector 0711da4a6c6d0dbc599d757b367430a63ae51f6f4fb48b6758fb21ba718b0778 The package @zapier/ai-actions-react was found to contain malicious code. Source: google-open-source-security 1383a0732179c5eeceb51158230ef443e8bbaffbe23cca9276e2ac39c47af763 This package was compromised by...
@brainbase-ai/action-read (0.0.1), @brainbase-ai/actions (>=3.2.105, <=3.2.107) +67 more potentially affected by CVE-2026-26831 via textract (>=2.1.1, <=2.5.0)
textract NPM version =2.1.1, =3.2.105, =0.0.0, =0.0.0, =0.0.0, =0.0.15, =0.0.0, =0.1.0, =1.0.0-beta.70, =0.1.1, =0.7.0, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2026-26831 Source advisory: OSV:GHSA-9PCJ-M5RR-P28G...
MAL-2025-190917 Malicious code in @zapier/ai-actions-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0711da4a6c6d0dbc599d757b367430a63ae51f6f4fb48b6758fb21ba718b0778 The package @zapier/ai-actions-react was found to contain malicious code. Source: google-open-source-security...
Malicious code in @zapier/ai-actions-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0711da4a6c6d0dbc599d757b367430a63ae51f6f4fb48b6758fb21ba718b0778 The package @zapier/ai-actions-react was found to contain malicious code. Source: google-open-source-security...
Malware in @zapier/ai-actions
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in @zapier/ai-actions (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a316e279c8bb03071a6e5197270ffbb95c5f23592a64c504271f47e0f9adb11f The package @zapier/ai-actions was found to contain malicious code. Source: ghsa-malware...
MAL-2025-190830 Malicious code in @zapier/ai-actions (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a316e279c8bb03071a6e5197270ffbb95c5f23592a64c504271f47e0f9adb11f The package @zapier/ai-actions was found to contain malicious code. Source: ghsa-malware...