CVE-2026-63506: Authorization Bypass Through User-Controlled Key

Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID and asks isUserAuthorized to validate the bearer token against that selected TinaCloud app instead of the self-hosted site's configured app...

CVE-2026-92716: Authorization Bypass Through User-Controlled Key

Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one organization can supply arbitrary us...

CVE-2026-92779: Improperly Controlled Modification of Object Prototype Attributes

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing proto, prototype, or constructor paths to...

PT-2026-94118

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description The WebSocket handle mount function and ViewRuntime. build request method rebuild an HttpRequest using RequestFactory.get... without including the HTTP HOST. This causes request.get host to default to...

CVE-2026-61589: Use of Less Trusted Source

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory.get... with no HTTPHOST, so request.gethost defaulted to...

Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w39f-h553-h2mx. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task...

CVE-2026-63443

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API por...

CVE-2026-55774

A flaw was found in OpenBao, an open source identity-based secrets management system. An authenticated user with specific access to lease revocation functions could revoke a lease in a different namespace if the foreign lease identifier was known. This bypasses Access Control List ACL isolation,...

CVE-2026-63443

Coder (a Terraform-based remote development environment provisioner) is affected by an insecure redirect handling flaw in agentConn.apiClient(). The client used the default http.Client redirect behavior while its custom transport dialed the host from the request URL whenever the port matched the ...

EUVD-2026-78927

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API por...

CVE-2026-63443 Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API por...

CVE-2026-91984

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91930

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organization owners, create workspaces, and gain administrative access to victim...

CVE-2026-91929

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse...

CVE-2026-55636

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC c...

CVE-2026-55774

OpenBao is an open-source identity-based secrets management system. Prior to 2.5.5 , the lease lookup routing in vault/expiration.go allowed FetchLeaseInfo and loadEntry to resolve cached or stored lease data outside the requesting namespace. This meant an authenticated user with access to sys/le...

CVE-2026-55636 Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC c...

EUVD-2026-78670

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC c...

CVE-2026-55636

Capsule (a multi-tenancy and policy-based framework for Kubernetes) versions 0.13.0 through 0.13.6 contain a singular/plural typo in charts/capsule/templates/configuration.yaml: the validating webhook rule specifies namespace/finalize instead of namespaces/finalize. Because Kubernetes webhook rul...

CVE-2026-55636 Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC c...