PYSEC-2026-2937 praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

Summary Type: Authorization bypass enabling workspace metadata + settings tampering. The PATCH /workspaces/workspaceid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member". Any member can rewrite the workspace's name, description, and the settings JSON blob. The...

The vulnerability of the CONFIG_IP_DEFRAG function in the implementation of the IP packet defragmentation algorithm in the U-Boot loader for embedded Linux-based operating systems allows a hacker to rewrite metadata and gain access to the operating system under the identity of a user.

The vulnerability of the CONFIGIPDEFRAG function in the implementation of the IP packet defragmentation algorithm for U-Boot bootloaders of embedded Linux-based operating systems is related to errors in processing input data and the possibility of writing beyond the buffer boundaries. Exploiting...