CVE-2026-29075

Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner. This issue has been patched via commi...

CVE-2026-29789

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage...

CVE-2026-29789 Vito: Cross-project privilege escalation in workflow site-creation actions allows unauthorized server modification

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage...

CVE-2026-29789

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage...

CVE-2026-29789

Summary: Vito (self-hosted web app) suffers a cross-project privilege escalation due to a missing authorization check in workflow site-creation actions. Affected versions: prior to 3.20.3. Impact: an authenticated user with workflow write access in one project can create/manage sites on servers b...

CVE-2026-29789 Vito: Cross-project privilege escalation in workflow site-creation actions allows unauthorized server modification

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage...

CVE-2026-29789 Vito: Cross-project privilege escalation in workflow site-creation actions allows unauthorized server modification

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage...

EUVD-2026-10068

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage...

@ekairos/dataset (>=1.21.32-beta.0, <=1.22.22-beta.development.0), @ekairos/events (>=1.22.4-beta.development.0, <=1.22.34-beta.development.0) +10 more potentially affected by unknown CVE via workflow (>=4.0.1-beta.0, <=4.1.0-beta.63)

workflow NPM version =4.0.1-beta.0, =1.21.32-beta.0, =1.22.4-beta.development.0, =1.21.32-beta.0, =1.21.53-beta.0, =1.21.88-beta.0, =0.0.0-dev-20260121145510, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =4.0.1-beta.0, =1.21.32-beta.0, =0.3.0, =0.7.7 Source cve...

GHSA-9R75-G2CR-3H76 Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens

createWebhook in Vercel Workflow DevKit accepts a user-specified token parameter that serves as the credential for the public webhook endpoint /.well-known/workflow/v1/webhook/token. Official documentation recommended predictable token patterns, making it possible for an unauthenticated remote...

Weak Password Recovery Mechanism for Forgotten Password

Overview @workflow/core is a Core runtime and engine for Workflow DevKit Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password via the createWebhook function. An attacker can gain unauthorized access to workflow execution by guessing predictab...

@ekairos/dataset (>=1.21.32-beta.0, <=1.22.22-beta.development.0), @ekairos/events (>=1.22.4-beta.development.0, <=1.22.34-beta.development.0) +26 more potentially affected by unknown CVE via @workflow/core (>=4.0.1-beta.0, <=4.1.0-beta.63)

@workflow/core NPM version =4.0.1-beta.0, =1.21.32-beta.0, =1.22.4-beta.development.0, =1.21.32-beta.0, =1.21.53-beta.0, =1.21.88-beta.0, =0.0.0-dev-20260121145510, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =4.0.0-beta.2, =4.0.1-beta.4, =4.0.1-beta.0,...

Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens

createWebhook in Vercel Workflow DevKit accepts a user-specified token parameter that serves as the credential for the public webhook endpoint /.well-known/workflow/v1/webhook/token. Official documentation recommended predictable token patterns, making it possible for an unauthenticated remote...

@ekairos/dataset (>=1.21.32-beta.0, <=1.22.22-beta.development.0), @ekairos/events (>=1.22.4-beta.development.0, <=1.22.34-beta.development.0) +26 more potentially affected by unknown CVE via @workflow/core (>=4.0.1-beta.0, <=4.1.0-beta.63)

@workflow/core NPM version =4.0.1-beta.0, =1.21.32-beta.0, =1.22.4-beta.development.0, =1.21.32-beta.0, =1.21.53-beta.0, =1.21.88-beta.0, =0.0.0-dev-20260121145510, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =4.0.0-beta.2, =4.0.1-beta.4, =4.0.1-beta.0,...

CVE-2026-29075 Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner

Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner. This issue has been patched via commi...

vito 安全漏洞

VitoDeploy is an open-source web application for server management and PHP application deployment. Versions of Vito before 3.20.3 contained security vulnerabilities. These vulnerabilities stemmed from the lack of authorization checks during the workflow site creation process. This could allow a...

PT-2026-23751

Name of the Vulnerable Software and Affected Versions Vito versions prior to 3.20.3 Description Vito is a self-hosted web application used for managing servers and deploying PHP applications. A missing authorization check in workflow site-creation actions allows an authenticated attacker with...

openSUSE 16 Security Update : gitea-tea (openSUSE-SU-2026:20318-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20318-1 advisory. Changes in gitea-tea: - update to 0.12.0: New Features - Add tea actions commands for managing workflow runs and workflows in 880, 796 - Add tea...

CVE-2026-1651

The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the 'workflowids' parameter in all versions up to, and including, 5.9.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

📄 Juniper JunosEvolved Remote Command Execution

This Metasploit module exploits an unauthenticated command injection vulnerability in the Juniper JunosEvolved API. The exploit workflow involves creating a custom command entity, mapping it to a Directed Acyclic Graph DAG, and triggering an execution instance. The module uses a non-destructive...