gapps

Gapps Gapps is an Security compliance platform that makes it easy to track your progress against various security frameworks. ❄️ View the Gapps site 🏠 Interested in contacting me? Please join our discord Table of Contents 1. Getting Started 2. FAQ New Features ❄️ SOC2, NIST CSF, NIST-800-53, CMMC,...

zitadel

The Identity Infrastructure for Developers ZITADEL...

CVE-2026-110609

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...

CVE-2026-110124 FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values ...

PT-2026-109317

Name of the Vulnerable Software and Affected Versions Astron Agent versions prior to 1.1.2 Description An authenticated low-privilege tenant can execute arbitrary code as root within the core-workflow container. This occurs because the default workflow code-node path through the endpoints...

CVE-2026-105864

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection...

PT-2026-106797

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-multi-tenant versions prior to 3.90.0 @payloadcms/plugin-multi-tenant canary versions prior to 4.0.0-canary.34 Description An authenticated user restricted to a single tenant can create a record within another tenant, provid...

SUSE CVE-2026-88808

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

CVE-2026-88808

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

EUVD-2026-88335

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

CVE-2026-88808 Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

CVE-2026-88808 Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

CVE-2026-88808

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

CVE-2026-100608 Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode MODE=queue, ENABLEBULLMQDASHBOARD=true, and !isCloud, the /admin/queues mount is protected only by the...

CVE-2026-84703

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When creating or editing an execution environment, the controller does not verify that the requesting user has use permission on the container registry credential referenced by the execution environment; it validates...

PYSEC-2026-3988

Apache Airflow's /assets/events API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID,...

PT-2026-96143

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.91.1 Description An issue exists in the platform used for orchestrating background tasks, AI agents, and durable workflows. The endpoint 'GET /api/v1/stable/durable-tasks/durable-task', implemented by the...

CVE-2026-88898

AppFlowy-Cloud versions 0.7.2 through 0.9.64 contain a missing authorization check in the bulk publish endpoint , which fails to verify that the caller is authorized against the target workspace. An authenticated user can exploit this to publish content into other tenants' namespaces, writing vie...

CVE-2026-88898

AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata int...

CVE-2026-80223 Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read

Incorrect Authorization vulnerability in ash-project ashgraphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions. The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory: its fast path...