CVE-2026-62290 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, percona-xtradb-cluster-operator-fips, cert-manager-istio-csr-fips, cert-manager-cmctl, percona-xtradb-cluster-operator, step-issuer-fips, mariadb-operator, cert-manager-openshift-routes-fips, cert-manager-cmctl-fips,...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the ServeHTTP function in pkg/middlewares/replacepathregex/replacepathregex.go, which forwards the post-substitution path to the backend without checking whether it normalizes to a different route. An attacker can...

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Author: Prakhar Porwal Date: 2026-05-24 Target: Gitea self-hosted Git service Branch tested: main @ b7e95cc48c development build, go1.26.3 Component: routers/api/v1/org/action.go org-level Actions API OWASP: API3:2023 Broken Object Property Level Authorization --- 1. Summary The org-level Actions...

Gitea: Public-only API token restriction is not enforced on team API routes

Summary Gitea's /api/v1/teams/id API routes do not correctly enforce the public-only access token restriction. A public-only token is intended to limit API access to public repositories and public organizations. However, several team API routes continue to return private team repository metadata...

GHSA-H56G-4QW7-2MXG Gitea: Public-only API token restriction is not enforced on team API routes

Summary Gitea's /api/v1/teams/id API routes do not correctly enforce the public-only access token restriction. A public-only token is intended to limit API access to public repositories and public organizations. However, several team API routes continue to return private team repository metadata...

GHSA-6CQF-375W-639G Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform no token-scope or public-only enforcement. A personal access token that is correctly blocked HTTP 403 from a private repository on /raw, /media, /archive, and /releases/download/... — because it is marked public-only o...

CVE-2026-47399 PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to...

GHSA-X27W-589X-FRM2 Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Summary When ISR is enabled, the serverless entrypoint lets an unauthenticated request decide which route the origin renders. The internal isr function reads the xastropath query parameter and rewrites the request path to it without any authentication. Edge level access controls only ever see the...

Guzzle: Proxy-Authorization headers can be sent to origin servers

Impact In affected versions, the built-in cURL handlers CurlHandler and CurlMultiHandler put every first-class request header in cURL's origin header list CURLOPTHTTPHEADER. These handlers are the default when the PHP cURL extension is available. They move Proxy-Authorization to the proxy-only li...

CVE-2026-32823

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...

CVE-2026-64622

Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...

EUVD-2026-45937

Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...

CVE-2026-64622 Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox

Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...

CVE-2026-64622 Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox

Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...

CVE-2026-64622

Network-AI (npm: network-ai) versions 5.12.2–5.13.3 are affected by missing authorization on the ApprovalInbox read routes. Specifically, the GET routes /approvals/?status=all, /approvals/:id, /approvals/stats, and /approvals/sse fail to apply the configured authorization check (checkAuth/secret)...

CVE-2026-64622

Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...

PT-2026-61582

Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...

PT-2026-61551

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.2.0 Description Custom API routes fail to validate namespace and database scope, which allows authenticated users to invoke endpoints across different namespaces or databases. An attacker with valid credentials fo...

BIT-HUBBLE-RELAY-2026-56742 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant...

BIT-CILIUM-2026-56742 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant...