Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities

Summary Several vulnerabilities were found in DataStage on Cloud Pak for Data Vulnerability Details CVEID:CVE-2026-82101 DESCRIPTION: DataStage on Cloud Pak for Data could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability. CWE:CWE-22: Imprope...

CVE-2026-94382 Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to...

EUVD-2026-83909

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to...

Unchecked Input for Loop Condition

Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition due to unbounded next-action-time search in the schedule spec evaluation logic in service/worker/scheduler/spec.go and the scheduler/frontend list-matching-time paths. An authenticated caller with...

CVE-2026-89139 Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host

Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...

CVE-2026-65651

temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses...

PT-2026-96220

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.25.6 Description The api get recording stream function in warpgate-admin/src/api/recordings detail.rs fails to enforce the AdminPermission::RecordingsView requirement for the...

CVE-2026-88403: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request...

CVE-2026-84990: Exposure of Sensitive Information to an Unauthorized Actor

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...

CVE-2026-83621: Missing Authorization

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled,...

CVE-2026-77560: Improper Handling of Case Sensitivity

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cas...

CVE-2026-88978: Authorization Bypass Through User-Controlled Key

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durableevents.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant...

CVE-2026-84298: Authorization Bypass Through User-Controlled Key

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied taskexternalid values in the durableInvocations routing map before tenant ownership is verified, and callback delivery...

CVE-2026-88403

A Server-Side Request Forgery SSRF in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request...

CVE-2026-94536: Authorization Bypass Through User-Controlled Key

lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can supply arbitrary employeeId values to enumerate other employees' role codes, permission codes, an...

CVE-2026-94535: Authorization Bypass Through User-Controlled Key

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove...

CVE-2026-94534: Authorization Bypass Through User-Controlled Key

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex...

CVE-2026-94532: Authorization Bypass Through User-Controlled Key

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate the userId parameter to harvest sensitive user information including mobile numbers, email addresse...

CVE-2026-61852: Improper Neutralization of Special Elements used in an SQL Command

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...

CVE-2026-61743: Reliance on Reverse DNS Resolution for a Security-Critical Action

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeRequest.js calls validateOutboundUrl to resolve and validate a target hostname, but request-promise performs a separate DNS...