EUVD-2026-77371

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field...

CVE-2026-8821 Playbooks run owner channel membership permission bypass

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field...

CVE-2026-8821

Mattermost versions 11.9.0, 11.8.4, 11.7.7, and 10.11.22 (and below within their respective branches) contain a permission bypass in the Playbooks feature. During playbook run creation, the system fails to validate the channel member-management permission, allowing an authenticated channel member...

CVE-2026-8821 Playbooks run owner channel membership permission bypass

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field...

PT-2026-91039

Name of the Vulnerable Software and Affected Versions ipa-lab HackingBuddyGPT versions prior to 0.5.1 Description A remote OS command injection is possible due to improper handling of input in the ssh run command function within the src/hackingBuddyGPT/extensions/ssh run command.py file. OS comma...

PT-2026-91031

Name of the Vulnerable Software and Affected Versions GH05TCREW PentestAgent versions up to cf882dabea3ed91cef016cdd115e5426315665a2 Description An OS command injection flaw exists in the MCP HTTP Server component within the run task function of the interface/main.py file. This issue allows a...

PT-2026-91162

Name of the Vulnerable Software and Affected Versions Mattermost version 11.9.0 Mattermost version 11.8.4 Mattermost version 11.7.7 Mattermost version 10.11.22 Description An issue exists where the system fails to validate if a property field belongs to the specified run before updating its value...

PT-2026-91154

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field...

CVE-2026-8821: Missing Authorization

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field...

PT-2026-96471

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERR PTR to kthread stop event test stuff calls kthread run and unconditionally passes the returned task struct pointer to kthread stop. kthread run returns an error pointer such as ERR PTR-ENOMEM when...

PYSEC-2026-3858 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

Summary In affected versions of langgraph-api the LangGraph Server runtime, the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant reads and cron creation dispatch the...

langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

SummaryIn affected versions of langgraph-api the LangGraph Server runtime, the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant reads and cron creation dispatch the assistants.re...

Malicious Package

Overview sams-run-style is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the sams-run-style...

CVE-2026-9225: Authorization Bypass Through User-Controlled Key

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...

Malicious code in sams-run-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14b995469abba673b875788358966c5468456f0a911b1f6e3b5ee95c8f14afb1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16090 Malicious code in sams-run-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14b995469abba673b875788358966c5468456f0a911b1f6e3b5ee95c8f14afb1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-76009: Improper Authentication

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

arca (>=0.1.0a0, <=0.1.0), mali (>=0.2775.0, <=0.4018.0) +4 more potentially affected by CVE-2026-78678 via gitpython (2.1.7)

gitpython PYPI version 2.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - arca =0.1.0a0, =0.2775.0, =0.2304.0, =0.2304.0, =0.1.0a1, =1.0.0, =1.0.6 Source cves: CVE-2026-78678 Source advisory: OSV:GHSA-5XXX-QHH7-9287...

CVE-2026-85651

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

EUVD-2026-71115

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...