EUVD-2026-42475

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard /browser endpoint...

CVE-2026-52853

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

EUVD-2026-38489

Language Servers for AWS vulnerable to arbitrary file write...

Language Servers for AWS vulnerable to arbitrary file write

Summary Language Servers for AWS the aws/language-servers project provides the Language Server Protocol implementations that power AWS developer tooling, including the Amazon Q Developer agentic chat experience, across IDEs such as VS Code, JetBrains, Visual Studio, and Eclipse. Missing symlink...

GHSA-6V3R-4P5C-MRP5 Language Servers for AWS vulnerable to arbitrary file write

Summary Language Servers for AWS the aws/language-servers project provides the Language Server Protocol implementations that power AWS developer tooling, including the Amazon Q Developer agentic chat experience, across IDEs such as VS Code, JetBrains, Visual Studio, and Eclipse. Missing symlink...

EUVD-2026-38488

Language Servers for AWS Vulnerable to Arbitrary Code Execution...

GHSA-XHCR-J4J9-3GH7 Language Servers for AWS Vulnerable to Arbitrary Code Execution

Summary Language Servers for AWS the aws/language-servers project provide the underlying language-server runtime that powers Amazon Q Developer's AI coding assistance across its IDE plugins Visual Studio Code, JetBrains, Eclipse, and Visual Studio. Improper trust boundary enforcement in Language...

CVE-2026-52853 Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

CVE-2026-52853 Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

CVE-2026-52853

The open-source collaborative wiki software Docmost is vulnerable to privilege escalation prior to version 0.90.1 . An authenticated workspace ADMIN can bypass role ceilings within the workspace invitation flow to invite an external email address with OWNER permissions. This flaw allows an ADMIN ...

EUVD-2026-86391

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

CVE-2026-52853 Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

EUVD-2026-86387

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce...

CVE-2026-95985

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to...

CVE-2026-95985 Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to...

CVE-2026-52853: Improper Privilege Management

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

PT-2026-98240

Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.90.1 Description An authenticated workspace ADMIN can exploit the workspace invitation flow to invite an external email address and assign it the OWNER role. This occurs because the role ceiling does not prevent ADM...

Citrix Workspace App for Windows Multiple Vulnerabilities (CTX697034)

The version of Citrix Workspace App installed on the remote Windows host is 2507 / 2507.1 LTSR prior to 2507.1 LTSR CU3, or a Current Release prior to 2603.11. It is, therefore, affected by multiple vulnerabilities: - An out-of-bounds read vulnerability exists in Citrix Workspace app for Windows...

EUVD-2026-84813

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

CVE-2026-63104 Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...