CVE-2026-112047

OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident A...

CVE-2026-112047 OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions

OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident A...

EUVD-2026-103509

OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident A...

CVE-2026-112047

OneUptime versions 14.0.2 before 14.0.69 are vulnerable to an incorrect authorization flaw (CWE-863) within Kubernetes AI Actions . This vulnerability occurs because project-wide permission checks can be exploited by authenticated project members to perform actions on clusters outside their inten...

CVE-2026-112047 OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions

OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident A...

PT-2026-116886

In the Linux kernel, the following vulnerability has been resolved: iio: frequency: adf4377: Fully initialize clk init data and clk parent data The clk init data structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drive...

CVE-2026-98667: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: frequency: adf4377: Fully initialize clkinitdata and clkparentdata The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to...

CVE-2026-111930

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/id/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint ...

EUVD-2026-103297

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/id/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint ...

CVE-2026-111930

The Coder platform, versions 2.26.0 before 2.34.8 , is susceptible to an information disclosure vulnerability due to an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint. The system fails to properly validate permissions, checking only for workspace read access before f...

CVE-2026-111930 Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/id/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint ...

CVE-2026-111930 Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/id/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint ...

PT-2026-116498

Name of the Vulnerable Software and Affected Versions Coder versions 2.26.0 through 2.34.7 Description An incorrect authorization flaw exists where the system only verifies workspace read access before fetching group members using an elevated system context. Authenticated users with workspace use...

CVE-2026-111695

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

CVE-2026-111695

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

EUVD-2026-102986

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

Astra Linux – Vulnerability in Python 3.11, Python 3.7

The “tarfile” module will still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even when processing multi-block members such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could lead to a crafted tar archive being misinterpreted by the tarfile module compared to other implementations...

CVE-2026-110593 BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail

BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the sendemail Celery task, which compiles the user-supplied AccountEmail messagebody with django.template.Template. Authenticated organization members can submit template tags through POST /api/accounts//createmai...

EUVD-2026-101220

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...

CVE-2026-110592 BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...