PYSEC-2026-3526 PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

Summary A workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role chec...

CVE-2026-13059

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...

UBUNTU-CVE-2026-13059

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...

CVE-2026-13059

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...

CVE-2026-13059 Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...

CVE-2026-13059

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...

CVE-2026-13059

Technical details are not publicly available in the provided documents. No specific affected products, versions, or exploit vectors are stated here. Monitor for updates as new information may emerge.

CVE-2026-16544

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumeraccess function jobevents, workflowevents, adhoccommandevents. Three event groups - inventoryupdateevents, projectupdateevents, and systemjobevents — are n...

CVE-2026-16544

AWX security issue: the websocket event consumer omits RBAC checks for inventory_update_events, project_update_events, and system_job_events, allowing any authenticated user to subscribe to these unmapped groups and view real-time stdout from jobs in other organizations. Affected component is the...

PT-2026-63463

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with low privileges can perform unauthorized reads and writes on data protected by role-based query-level access controls. This occurs due ...

CVE-2026-61275

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Role Based Security. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub...

Gitea: Public-only repository tokens can update private PR head branches

Summary Gitea allows a public-only,write:repository token to update a private pull request head branch through a public base repository route. The vulnerable endpoint is: text POST /api/v1/repos/public-owner/public-repo/pulls/index/update Gitea checks the token's public-only restriction against t...

CVE-2026-11876 Missing Authorization in get_deployed_stack Endpoint in zenml-io/zenml

In zenml-io/zenml version 0.94.2, the GET /api/v1/stack-deployment/stack endpoint getdeployedstack lacks proper RBAC authorization checks, allowing any authenticated user to enumerate all deployed stacks across all users and tenants. This includes stack component details, service connector...

CVE-2026-11876

CVE-2026-11876 in zenml-io/zenml

CVE-2026-15927

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an externalreference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validateexternalregistryurl. A repository...

CVE-2026-55550 NextCRM has RBAC Bypass in MCP Product Tools that Allows Low-Privileged Users to Modify the CRM Product Catalog

NextCRM is open-source customer relationship management CRM software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to manager and admin roles. However, in version 0.12.1, the MCP product tools...

EUVD-2026-45978

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API DAPI handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the maste...

GO-2026-5999 milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery in github.com/milvus-io/milvus

milvus: RBAC grantee-id uses truncated MD5 64-bit, enabling privilege-binding collisions and cross-role privilege forgery in github.com/milvus-io/milvus...

GO-2026-5941 Kite has an authenticated cluster RBAC bypass in /api/v1/overview in github.com/zxh326/kite

Kite has an authenticated cluster RBAC bypass in /api/v1/overview in github.com/zxh326/kite...

GHSA-M2V6-2JMH-4C68 Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization

Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions 4: - Tenant has SecurityPolicy + TCPRoute RBAC baseline - Tenant namespace permitted to attach TCPRoute to a Gateway listener - spec.authorization omitted the trigger - No admission...