automation-controller: automation-controller: Project scm_branch/scm_refspec argument injection into git during project sync allows arbitrary file read on the sync host (control-plane ServiceAccount token, SECRET_KEY, and DB credentials on control-plane deployments) leading to full AAP and Kubernetes-namespace compromise

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The Project SCM branch and SCM refspec fields are accepted without rejecting values that begin with a dash and are passed to the git module during project synchronization, where they reach a git checkout/git fetch...

automation-controller: automation-controller: Project scm_branch/scm_refspec argument injection into git during project sync allows arbitrary file read on the sync host (control-plane ServiceAccount token, SECRET_KEY, and DB credentials on control-plane deployments) leading to full AAP and Kubernetes-namespace compromise

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The Project SCM branch and SCM refspec fields are accepted without rejecting values that begin with a dash and are passed to the git module during project synchronization, where they reach a git checkout/git fetch...

CVE-2026-84711

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The Project SCM branch and SCM refspec fields are accepted without rejecting values that begin with a dash and are passed to the git module during project synchronization, where they reach a git checkout/git fetch...

DRUPAL-CONTRIB-2026-178

The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks CSRF...

CVE-2026-63445

A flaw was found in Perses, an open-source dashboard and visualization project. An authenticated attacker can exploit a vulnerability in list endpoints that use the file-system database. By manipulating the project query parameter with directory traversal characters, an attacker can read arbitrar...

Malicious code in @wizloft/harness-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 328a1e142939c4523f9be9f14f94ae40f314f2c8ff7f2531e7474c02100ec523 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16432 Malicious code in @wizloft/harness-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 328a1e142939c4523f9be9f14f94ae40f314f2c8ff7f2531e7474c02100ec523 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178

The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks CSRF...

PT-2026-97666

The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks CSRF...

PT-2026-97624

Name of the Vulnerable Software and Affected Versions pmTicket Project-Management-Software versions up to 078fa56a782490c5059a0814f84df27984f4d7e2 Description A remote SQL injection is possible due to improper handling of the conn settings argument within the setSync function of the '/ajax/add...

CVE-2026-77426

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...

CVE-2026-76909

Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML...

CVE-2026-63458

A flaw was found in Perses. An authenticated user with viewer access to one project can bypass authorization checks by manipulating the project query parameter on project-scoped list endpoints. This allows them to access and view resources, such as dashboards, datasources, and variables, belongin...

Gardener: Authorization Bypass via Group Subject Injection

Overview The manage-members custom verb authorization check in the Gardener API server's customverbauthorizer admission plugin can be bypassed by adding Group or ServiceAccount subjects to a Project's member list. The check is documented as controlling "human users or groups", but the...

GHSA-GFJV-GQF2-C888 Gardener: Authorization Bypass via Group Subject Injection

Overview The manage-members custom verb authorization check in the Gardener API server's customverbauthorizer admission plugin can be bypassed by adding Group or ServiceAccount subjects to a Project's member list. The check is documented as controlling "human users or groups", but the...

Unleash: Missing await on permission check + cross-project IDOR in admin API

Summary Multiple authorization vulnerabilities in Unleash admin API, including a critical missing await that completely bypasses a permission check. Vulnerability 1: Missing await on Permission Check HIGH File: src/lib/features/segment/segment-controller.ts line 345 POST...

NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API

NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

GHSA-72H8-WP98-7HCH Unleash: Missing await on permission check + cross-project IDOR in admin API

Summary Multiple authorization vulnerabilities in Unleash admin API, including a critical missing await that completely bypasses a permission check. Vulnerability 1: Missing await on Permission Check HIGH File: src/lib/features/segment/segment-controller.ts line 345 POST...

Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

Summary Unleash scopes write permissions per project and per environment: a user with the UPDATEFEATURESTRATEGY permission on project A is supposed to be able to mutate activation strategies only within project A. The endpoint POST...

NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment cross-project integrity write, bypassing project RBAC and the audit log vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...