MINI-8V3H-JHJJ-5PG3

Bulletin has no description...

CVE-2026-57803

creationtimestamp| type| source ---|---|--- 2026-07-13 19:29:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkgiadrvj2e 2026-07-14 02:26:53+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql5seep2a22 2026-07-16 08:08:03+00:00| seen|...

CVE-2026-55771

CVE-2026-55771 affects CedarJava prior to 4.9.0, where EntityIdentifier.equals() has inverted null/self-reference checks, causing incorrect equality results in custom integrations. The bug does not alter Cedar’s authorization decisions (computed in Rust from JSON) but could affect external code p...

CVE-2026-55771 CedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilities

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the EntityIdentifier.equals has inverted null/self branches which could lead to incorrect equality comparisons. The EntityIdentifier.equals meth...

CVE-2026-57363

creationtimestamp| type| source ---|---|--- 2026-07-13 18:51:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkeecjaem2a 2026-07-14 01:19:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql224uclj2w 2026-07-16 08:15:38+00:00| seen|...

CVE-2026-22100

creationtimestamp| type| source ---|---|--- 2026-07-13 18:50:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkecsvgau2c 2026-07-14 03:05:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql7xs3giy2i 2026-07-16 08:06:24+00:00| seen|...

Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching

Summary Apollo ConfigService may allow unauthorized access to configuration data when AccessKey / management key authentication is enabled and ConfigService accepts a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app. Details...

CVE-2026-57795

creationtimestamp| type| source ---|---|--- 2026-07-13 18:02:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkbm5fcyv22 2026-07-16 08:04:27+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrlsl2lh2g...

CVE-2026-13241

creationtimestamp| type| source ---|---|--- 2026-07-13 17:38:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqkaarczuq2t...

CVE-2026-13233

creationtimestamp| type| source ---|---|--- 2026-07-13 17:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7sj363e2h 2026-07-22 17:00:05+00:00| seen| Telegram/q3tIaYx4agFM3da1rV7jtAQTpWs9uwXUcQ2UZM8hUpw4XQ 2026-07-22 17:00:05+00:00| seen|...

GHSA-JXPJ-9J24-W337 Apollo Portal: There is a risk of unauthorized access to the Apollo configuration center

Summary Apollo Portal versions before 2.5.0 do not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/env/releases/releaseId. When configView.memberOnly.envs is enabled for the requested environment, a low-privileged Portal user can...

PYSEC-2026-2575 LangGraph SDK has unsafe URL path construction

Summary langgraph-sdk constructs HTTP request paths for resource operations by interpolating caller-supplied identifier values into URL templates. Without sanitization of those values, identifiers that contain characters with special meaning in URL paths could cause the resulting request to addre...

PYSEC-2026-2878 Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID

Development Runner Telephony WebSocket /ws Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID Summary The pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without any authentication. An unauthenticated remote attacker who...

PYSEC-2026-2406 Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known

Description Bugsink’s issue list supports bulk actions such as resolving or muting selected issues. In affected versions, the issue list view authorizes access through the project in the URL, but applies the requested bulk action to the submitted issue IDs without also requiring those issues to...

PYSEC-2026-2930 PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

Summary PraisonAI Platform's workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to another workspace by supplying the victim object's global UUID. The affected pattern...

PYSEC-2026-2671 Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing

Summary The fileID field from Manifest.db a SQLite database inside iOS backups, generated by the device is used directly in filesystem path construction without validation. This affects two commands through a shared code path: - mvt-ios decrypt-backup decrypt.py: fileid is used to construct both...

PYSEC-2026-2726 Open WebUI has Broken Access Control for Completions API

Summary Any user X can continue the conversation of any other user Y, as long as the Chat ID of Y is known. User X does not even need to be an admin to do so. Details A user just needs to use the API endpoint: /api/chat/completions with their own API key generated in OWUI and the Chat ID of anoth...

CVE-2026-59216

creationtimestamp| type| source ---|---|--- 2026-07-13 15:09:01+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjxwa6pxg2c 2026-07-16 08:01:21+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrgb6tvx2g 2026-07-24 18:35:08+00:00| published-proof-of-concept|...

PYSEC-2026-2943 PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling

Summary The MultiAgentLedger and MultiAgentMonitor components in the provided code exhibit vulnerabilities that can lead to context leakage and arbitrary file operations. Specifically: 1. Memory State Leakage via Agent ID Collision: The MultiAgentLedger uses a dictionary to store ledgers by agent...

PYSEC-2026-2693 Open WebUI has unauthorized deletion of knowledge files

Summary An access control check is missing when deleting a file from a knowledge base. The only check being done is that the user has write access to the knowledge base or is admin, but NOT that the file actually belongs to this knowledge base. It is thus possible to delete arbitrary files from...