EUVD-2026-46322

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The GET /workspaces/workspaceid/issues/issueid/activity endpoint is gated by requireworkspacememberworkspaceid and dispatches to...

CVE-2026-47408 praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The GET /workspaces/workspaceid/issues/issueid/activity endpoint is gated by requireworkspacememberworkspaceid and dispatches to...

CVE-2026-47408 praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The GET /workspaces/workspaceid/issues/issueid/activity endpoint is gated by requireworkspacememberworkspaceid and dispatches to...

CVE-2026-16454 Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability CWE-284 / CWE-862 has been identified in the Direct Device Integration DDI Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned...

CVE-2026-16454 Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability CWE-284 / CWE-862 has been identified in the Direct Device Integration DDI Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned...

CVE-2026-47406 praisonai-platform: Dependency endpoints accept any issue_id and dep_id without workspace ownership check, cross-workspace issue linking + read + delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The dependency endpoints POST/GET /workspaces/workspaceid/issues/issueid/dependencies and DELETE .../dependencies/depid gate access on...

CVE-2026-47406 praisonai-platform: Dependency endpoints accept any issue_id and dep_id without workspace ownership check, cross-workspace issue linking + read + delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The dependency endpoints POST/GET /workspaces/workspaceid/issues/issueid/dependencies and DELETE .../dependencies/depid gate access on...

CVE-2026-47406

PraisonAI Platform has a documented IDOR flaw in its dependency endpoints. Versions before 0.1.4 allow cross-workspace linkage, read, and deletion of dependencies because URL and body IDs (workspace_id, issue_id, dep_id, and body.depends_on_issue_id) are not workspace-validated before DependencyS...

CVE-2026-28317

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments...

CVE-2026-28313

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments...

CVE-2026-28314

SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments...

CVE-2026-28316

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in...

CVE-2026-28308

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments...

CVE-2026-28305

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments...

CVE-2026-28302

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments...

CVE-2026-47399

Summary of vulnerability (CVE-2026-47399): PraisonAI Platform prior to version 0.1.4 exposes a systemic object-level authorization flaw where workspace-scoped REST routes verify only that a caller is in the URL workspace, but the service layer resolves objects (e.g., agents, projects, issues, com...

CVE-2026-47399 PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to...

CVE-2026-47399 PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to...

CVE-2026-47399 PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to...

CVE-2026-28317 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments...