CVE-2026-17349

/misc/workspace/adhocconnectserver, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone, which copies every column from the source row, including userid, shared, sharedusername, and the stored credential fields...

EUVD-2026-51562

/misc/workspace/adhocconnectserver, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone, which copies every column from the source row, including userid, shared, sharedusername, and the stored credential fields...

CVE-2026-17349

CVE-2026-17349 affects pgAdmin 4: from version 9.0 up to, but not including, 9.17. The issue occurs in the Workspaces feature’s adhoc_connect_server when cloning an existing server via Server.clone(): the clone copies every column, including user_id, shared, shared_username, and stored credential...

CVE-2026-17349 pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner

/misc/workspace/adhocconnectserver, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone, which copies every column from the source row, including userid, shared, sharedusername, and the stored credential fields...

CVE-2026-18215

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...

PT-2026-66728

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description Keycloak allows users to authenticate using Microsoft accounts with restrictions limited to a specific organization tenant. A flaw exists where this tenant restriction is ignored during the...

PT-2026-66774

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 9.0 through 9.16 Description The /misc/workspace/adhoc connect server endpoint, part of the Workspaces feature, improperly clones server records using the Server.clone function. When a non-owner triggers an adhoc connection ...

EUVD-2026-51311

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema and GetDefaultDatastoreUsername, allowing distinct...

CVE-2026-65835 Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the...

CVE-2026-48499 Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache

Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowin...

CVE-2026-48499 Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache

Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowin...

SUSE CVE-2026-47724

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

SUSE CVE-2026-54324

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, a cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user to subscribe to another organization's realtime notification...

CVE-2026-54249

A flaw was found in pydantic-ai. A remote attacker could exploit this vulnerability by submitting crafted message history containing unvalidated file references. This could trick the server into reading arbitrary files from its own cloud storage accounts, such as Amazon S3 or Google Cloud Storage...

EUVD-2026-51151

Julep contains an insecure direct object reference vulnerability in the getexecutiondetails endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary executionid values to retrieve sensitive execution records including task inputs, outputs,...

CVE-2026-54249

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter such as the Vercel AI adapter can reference arbitrary files in the application's...

CVE-2026-54249

CVE-2026-54249 affects Pydantic AI (Python agent framework) when using a Pydantic AI UI adapter (e.g., Vercel AI adapter). Versions 1.65.0–1.105.0 and 2.0.0b1–2.0.0b5 allow an attacker to reference arbitrary files in the application’s model-provider or cloud-storage account via UploadedFile refer...

CVE-2026-54249 VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injection

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter such as the Vercel AI adapter can reference arbitrary files in the application's...

CVE-2026-16326 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...

CVE-2026-16326 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...