PYSEC-2026-4262 PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass Summary praisonai-platform lets an ordinary workspace member patch owner-created project, issue, and agent records even though the paired delete routes enforce owner/admin authorization. For...

PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass Summarypraisonai-platform lets an ordinary workspace member patch owner-created project, issue, and agent records even though the paired delete routes enforce owner/admin authorization. For...

ROOT-OS-DEBIAN-13-CVE-2026-8932 CVE-2026-8932 in curl - Patched by Root

Root has patched CVE-2026-8932 in the curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-10966 CVE-2025-10966 in curl - Patched by Root

Root has patched CVE-2025-10966 in the curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2024-26461 CVE-2024-26461 in krb5 - Patched by Root

Root has patched CVE-2024-26461 in the krb5 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2018-5709 CVE-2018-5709 in krb5 - Patched by Root

Root has patched CVE-2018-5709 in the krb5 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-66046 CVE-2026-66046 in expat - Patched by Root

Root has patched CVE-2026-66046 in the expat package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-ALPINE-317-CVE-2026-28387 CVE-2026-28387 in openssl - Patched by Root

Root has patched CVE-2026-28387 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available...

ROOT-OS-ALPINE-317-CVE-2026-34180 CVE-2026-34180 in openssl - Patched by Root

Root has patched CVE-2026-34180 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available...

ROOT-OS-ALPINE-317-CVE-2026-34182 CVE-2026-34182 in openssl - Patched by Root

Root has patched CVE-2026-34182 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available...

ROOT-OS-ALPINE-317-CVE-2026-45447 CVE-2026-45447 in openssl - Patched by Root

Root has patched CVE-2026-45447 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available...

ROOT-OS-ALPINE-317-CVE-2026-7383 CVE-2026-7383 in openssl - Patched by Root

Root has patched CVE-2026-7383 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2026-4438 CVE-2026-4438 in glibc - Patched by Root

Root has patched CVE-2026-4438 in the glibc package for Root:Ubuntu:22.04. Multiple fixed versions available...

Rocky Linux 8 [CIQ] Security Update: flatpak-builder / flatpak-builder-debuginfo / etc (crlsa-2026_80973)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680973 advisory. flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git- am CVE-2026-86320 Tenable has extracted the preceding descriptio...

MiracleLinux 9 : flatpak-builder-1.2.3-1.el9_8.1 (AXSA:2026-2052:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2052:01 advisory. flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git- am CVE-2026-86320 Tenable has extracted the preceding...

CVE-2026-111312: Missing Authentication for Critical Function

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/id GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medic...

RHEL 10 : kpatch-patch-6_12_0-211_16_1 and kpatch-patch-6_12_0-211_49_1 (RHSA-2026:82326)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:82326 advisory. This is a kernel live patch module that can be loaded by the kpatch command-line utility to modify the code of a running kernel. This patc...

OpenHealthForAll OpenHealth Authorization Issues Vulnerability

OpenHealthForAll OpenHealth versions 0.2.0 and earlier have an authorization issue. This vulnerability stems from the GET, PATCH, and DELETE handlers at /api/health-data/id, which do not perform session or authorId checks when querying records by id. As a result, authentication and authorization...

CVE-2026-110623

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/nodeid to grant themselves an...

CVE-2026-110623

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/nodeid to grant themselves an...