PT-2026-60093

Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the Web rate editing flows for projects, customers, and activities. A user who can edit one authorized parent object can combine that authorized parent ID with the rate ID of a different, unauthorized parent...

PT-2026-60092

Summary Kimai contains an authenticated improper authorization vulnerability in Team-related assignment APIs. A Teamlead who can edit their own team can use backend API endpoints to add users or activities that fall outside their intended visible or manageable scope, even when the frontend...

Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team, add the current user as teamlead, and bind the target...

GHSA-PGCC-VFMC-7CW5 Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team, add the current user as teamlead, and bind the target...

CVE-2026-57782

creationtimestamp| type| source ---|---|--- 2026-07-13 19:28:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkgfn4yte2x...

activity-browser (>=3.0.0b966, <=3.0.0b202610031934), aitraining (>=0.0.0, <=0.8.37.dev0) +32 more potentially affected by CVE-2026-55206 via py7zr (0.22.0)

py7zr PYPI version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - activity-browser =3.0.0b966, =0.0.0, =0.9.0, =0.8.26, =0.2.1, =0.9.0, =1.1.0, =2.1.7, =1.3.2, =0.0.71, =1.0.7, =3.5.1, =0.0.15, =0.2.4, =0.3.8 and mo...

praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

SummaryType: Insecure Direct Object Reference. The GET /workspaces/workspaceid/issues/issueid/activity endpoint is gated by requireworkspacememberworkspaceid and dispatches to ActivityService.listforissueissueid, which executes SELECT FROM activity WHERE issueid = :issueid with no workspace...

PYSEC-2026-2927 praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

Summary Type: Insecure Direct Object Reference. The GET /workspaces/workspaceid/issues/issueid/activity endpoint is gated by requireworkspacememberworkspaceid and dispatches to ActivityService.listforissueissueid, which executes SELECT FROM activity WHERE issueid = :issueid with no workspace...

PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server

The A2U Agent-to-User event stream server in PraisonAI exposes all agent activity without authentication. This is a separate component from the gateway server fixed in CVE-2026-34952.The createa2uroutes function registers the following endpoints with NO authentication checks:- GET /a2u/info —...

CVE-2026-14934

creationtimestamp| type| source ---|---|--- 2026-07-13 12:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116912555902353220 2026-07-13 12:00:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqjnf5zvau2g 2026-07-13 12:10:05+00:00| seen|...

CVE-2026-57714

creationtimestamp| type| source ---|---|--- 2026-07-13 10:56:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjjrvbgcs2g 2026-07-13 11:11:34+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjknmwz7j2a 2026-07-13 11:20:04+00:00| seen|...

MAL-2026-10436 Malicious code in jest-formatter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af1f270f7df9ee4f9088044964921e1b085b809ddb1d696e652326c58e5c0aba The package [email protected] presents itself as a Jest test output formatter but its lib/collect.js imports childprocess and invokes execSync wit...

MAL-2026-10255 Malicious code in abuden212 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12fc33584a728d7313bfc310121db6971d546738676f5b71bd5202527415822a The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

CVE-2026-9492

creationtimestamp| type| source ---|---|--- 2026-07-13 04:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/116910786151566204 2026-07-13 04:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqiuaepo5j2r 2026-07-13 05:00:25+00:00| seen|...

PT-2026-58979

Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team, add the current user as teamlead, and bind the target...

PT-2026-59559

Summary Type: Insecure Direct Object Reference. The GET /workspaces/workspace id/issues/issue id/activity endpoint is gated by require workspace memberworkspace id and dispatches to ActivityService.list for issueissue id, which executes SELECT FROM activity WHERE issue id = :issue id with no...

BIT-NEXTCLOUD-2026-45153 Nextcloud: PIN bypass in PassCodeActivity via back button

Nextcloud is an open source content collaboration platform. From version 33.0.0 to before version 33.1.0, after unlocking a locked Android phone the back-button could be used to bypass the Nextcloud Files app PIN. This issue has been patched in version 33.1.0...

CVE-2026-15486

creationtimestamp| type| source ---|---|--- 2026-07-12 09:28:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqgufolnd62c 2026-07-12 11:27:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqh342n5je26...

CVE-2026-9282

creationtimestamp| type| source ---|---|--- 2026-07-11 07:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/116900169327845158 2026-07-11 07:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqe5efmorb2x 2026-07-11 07:36:29+00:00| seen|...

CSV Injection

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to CSV Injection through the postActivityReport process. An attacker can cause arbitrary formula execution in spreadsheet software by injecting a specially crafted User-Agent...