PT-2026-63465

An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated...

GHSA-H56G-4QW7-2MXG Gitea: Public-only API token restriction is not enforced on team API routes

Summary Gitea's /api/v1/teams/id API routes do not correctly enforce the public-only access token restriction. A public-only token is intended to limit API access to public repositories and public organizations. However, several team API routes continue to return private team repository metadata...

CVE-2026-47408

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The GET /workspaces/workspaceid/issues/issueid/activity endpoint is gated by requireworkspacememberworkspaceid and dispatches to...

CVE-2026-47408 praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The GET /workspaces/workspaceid/issues/issueid/activity endpoint is gated by requireworkspacememberworkspaceid and dispatches to...

CVE-2026-47408

CVE-2026-47408 affects PraisonAI Platform: the endpoint GET /workspaces/{workspace_id}/issues/{issue_id}/activity is vulnerable to Insecure Direct Object Reference because list_for_issue(issue_id) ignores workspace context. A member can retrieve the full activity log for any issue across the mult...

CVE-2026-47408 praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The GET /workspaces/workspaceid/issues/issueid/activity endpoint is gated by requireworkspacememberworkspaceid and dispatches to...

CVE-2026-8933

creationtimestamp| type| source ---|---|--- 2026-07-21 15:08:09+00:00| seen| https://bsky.app/profile/arc-codex.com/post/3mr63m2s54b2k 2026-07-21 15:23:47+00:00| seen| https://bsky.app/profile/arc-codex.com/post/3mr64hz2xco2g 2026-07-21 15:36:50+00:00| seen|...

MAL-2026-10965 Malicious code in requestor-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6d4229671aa9a57f0ffbe61cd9ebe925c0874f55dd72d15f43adff096d0cf3f0 The OpenSSF Package Analysis project identified 'requestor-util' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...

CERTFR-2026-ACT-031

creationtimestamp| type| source ---|---|--- 2026-07-20 08:34:42+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mr2v5ko7qq2g 2026-07-20 08:51:10+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3mr2w2zlyeq2b 2026-07-20 08:51:16+00:00| seen|...

CVE-2026-16217

creationtimestamp| type| source ---|---|--- 2026-07-19 06:00:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/116945113858277904 2026-07-19 06:00:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqy42sn6732h 2026-07-19 08:10:02+00:00| seen|...

CVE-2026-57848

Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component reachable to any process on the device via the android.intent.action.SEND intent and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does not validate or filte...

CVE-2026-57848 Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation

Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component reachable to any process on the device via the android.intent.action.SEND intent and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does not validate or filte...

CVE-2026-57848 Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation

Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component reachable to any process on the device via the android.intent.action.SEND intent and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does not validate or filte...

CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild

Overview On July 14, 2026, Microsoft published a security advisory addressing CVE-2026-58644, a critical remote code execution RCE vulnerability affecting on-premises Microsoft SharePoint Server deployments. The vulnerability, which carries a CVSS v3.1 score of 9.8 Critical, results from the...

Malicious code in easyway2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcfc1bc035f5239e384f9e32be4fc53cdffe065920da7c6181e42757d6b41195 On npm install, the package's postinstall hook executes index.js, which POSTs the installer's full process.env, OS username, and current working...

CVE-2026-22104 Improper access control in Hashtopolis server chunk activity component

Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracked hashes of a Hashtopolis server instance...

CVE-2026-22104 Improper access control in Hashtopolis server chunk activity component

Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracked hashes of a Hashtopolis server instance...

CVE-2026-22104 Improper access control in Hashtopolis server chunk activity component

Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracked hashes of a Hashtopolis server instance...

CVE-2026-22104

Hashtopolis server web-interface chunk activity component has an improper access control vulnerability in versions prior to 0.14.8, allowing any created account to read all cracked hashes for a Hashtopolis server instance. Root cause: insufficient access restrictions on the chunk activity UI/back...

U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support

The U.S. Treasury Department's Office of Foreign Assets Control OFAC has designated two individuals and a VPN service provider for enabling ransomware actors' and other cybercriminals' malicious activities, including ransomware attacks against Americans. The VPN, named First VPN Service 1VPNS, ha...