CVE-2026-48169 PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any...

CVE-2026-48169

CVE-2026-48169 (PraisonAI Platform) has concrete cross-workspace IDOR and privilege-escalation flaws. The API routes enforce workspace membership but the service layer (in IssueService and ProjectService) performs global primary-key lookups (e.g., get/update/delete) without filtering by workspace...

CVE-2026-48169

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any...

CVE-2026-48169 PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any...

CVE-2026-45808

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via th...

EUVD-2026-54684

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via th...

CVE-2026-45808 OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via th...

SUSE-SU-2026:3536-1 Security update for podman

This update for podman fixes the following issues: - CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership modification on the host filesystem bsc1268579. - CVE-2026-57231: specially crafted image can trick podman run into...

Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Summary memo from hono/jsx retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Details Component...

Exploit for CVE-2026-64638

cve-id Donate Support the maintenance of this project wit...

lure v0.4.0

lure Local Linux binary analysis. Zero cloud. Zero root. Zero cost. ⚠️ Early development v0.4.0. Core features inspect, run, diff work end to end on x8664 Linux. This is a young project — expect rough edges, limited error handling on unusual inputs, and missing features. Bug reports, feedback, and...

EUVD-2026-54124

Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

EUVD-2025-210647

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publishe...

Security Bulletin: IBM Bob Premium Package for i is affected by multiple vulnerabilities

Summary There are multiple vulnerabilities in IBM Bob Premium Package for i. fast-uri can fail to canonicalize Unicode hostnames CVE-2026-13676. Hono Web Application framework can allow untrusted className values CVE-2026-59895, does not isolate context vales CVE-2026-59896, can drop distinct...

CVE-2026-37171

A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant...

TONTOU: On the Exploitability of Time-of-Neutralization to Time-of-Use Windows

Recently deployed Spectre v2 mitigations neutralize branch predictor state when switching privilege contexts or immediately prior to indirect branch execution, either through domain isolation or sanitization. These defenses assume that subsequent branch predictor behavior remains free from attack...

CVE-2026-37171

A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant...

CVE-2026-37171

CVE-2026-37171 affects SuperTokens Core, versions 6.0.0 to 11.4.0. The root cause is a lack of tenant separation, enabling an authenticated party in one tenant to access sessions, data, and endpoints of another tenant. The CVSS 3.1 base score is 5.9 (Medium) with vectors: AV:N/AC:H/PR:L/UI:N/S:U/...

PT-2026-70006

Name of the Vulnerable Software and Affected Versions TrueConf server versions 5.3.0 through 5.3.9 TrueConf server versions 5.4.0 through 5.4.9 TrueConf server versions 5.5.0 through 5.5.5 TrueConf server versions prior to 5.3.0 Description Improper management of code generation allows a remote...

CVE-2026-37171

A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant...