GO-2026-6664 Grafana legacy correlations allow cross-tenant disclosure and deletion in github.com/grafana/grafana

Grafana legacy correlations allow cross-tenant disclosure and deletion in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

PYSEC-2026-4046 djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

Impact The WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory.get... with no HTTPHOST, so request.gethost defaulted to "testserver" on the live path. Host/subdomain/domain TenantResolvers then misresolved the tenant — None on the live path while the HTTP...

djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

ImpactThe WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory.get... with no HTTPHOST, so request.gethost defaulted to "testserver" on the live path. Host/subdomain/domain TenantResolvers then misresolved the tenant — None on the live path while the HTTP...

PT-2026-105582

Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher in github.com/hatchet-dev/hatchet...

PT-2026-105803

Impact The WebSocket handle mount and ViewRuntime. build request rebuild an HttpRequest via RequestFactory.get... with no HTTP HOST, so request.get host defaulted to "testserver" on the live path. Host/subdomain/domain TenantResolvers then misresolved the tenant — None on the live path while the...

automation-controller: automation-controller-container: automation-controller: constructed inventory input inventory attachment checks only read permission on the source inventory, allowing a read-only user to clone another tenant's hosts and secrets and run ad hoc commands against them

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching a source inventory to a constructed inventory through the inputinventories relationship endpoint, the controller verifies only that the requesting user can read the source inventory, rather than that...

automation-controller: automation-controller-container: automation-controller: constructed inventory input inventory attachment checks only read permission on the source inventory, allowing a read-only user to clone another tenant's hosts and secrets and run ad hoc commands against them

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching a source inventory to a constructed inventory through the inputinventories relationship endpoint, the controller verifies only that the requesting user can read the source inventory, rather than that...

automation-controller: automation-controller-container: automation-controller: constructed inventory input inventory attachment checks only read permission on the source inventory, allowing a read-only user to clone another tenant's hosts and secrets and run ad hoc commands against them

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching a source inventory to a constructed inventory through the inputinventories relationship endpoint, the controller verifies only that the requesting user can read the source inventory, rather than that...

CVE-2026-84707

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The hostfilter query parameter on the hosts list API is parsed into a raw Django ORM filter whose lookup path is validated only against a sensitive-field blocklist, with no authorization check on the database relatio...

CVE-2026-84684

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching a source inventory to a constructed inventory through the inputinventories relationship endpoint, the controller verifies only that the requesting user can read the source inventory, rather than that...

CVE-2026-55610

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...

EUVD-2026-85338

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...

CVE-2026-55610

In multi-company installations of InvoiceShelf prior to version 2.4.1 , an Insecure Direct Object Reference (IDOR) vulnerability allows any user with Owner privileges of one company to access other companies' data. The GET/PUT /api/v1/users/{user} endpoints resolve target users by a global primar...

PT-2026-97339

Name of the Vulnerable Software and Affected Versions InvoiceShelf versions prior to 2.4.1 Description In multi-company installations, a user with Owner privileges in one company can read and overwrite any user account in any other company on the same installation. This occurs because the GET/PUT...

CVE-2026-55610: Authorization Bypass Through User-Controlled Key

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

Cross-tenant disclosure risk on DurableTask bidi RPC This is a low-severity, low-risk cross-tenant data exposure vuln caused by blindly accepting a durable task id, in addition to a list of node and branch ids that identify records in that task's event log, and returning them to the caller via th...

CVE-2026-84298

Hatchet , a platform for orchestrating background tasks and durable workflows, contains a cross-tenant information disclosure in its V1 DurableTask stream handler prior to version 0.95.3. The root cause is that worker-supplied task_external_id values are stored in the durableInvocations routing m...

CVE-2026-84298 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied taskexternalid values in the durableInvocations routing map before tenant ownership is verified, and callback delivery...

CVE-2026-63342

Hatchet , a platform for orchestrating background tasks, AI agents, and durable workflows, is affected by a cross-tenant authorization bypass prior to version 0.91.1 . The GET /api/v1/stable/durable-tasks/{durable-task} endpoint (implemented by listDurableEventLog) fails to require the target ten...

CVE-2026-63342 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...