CVE-2026-47408 praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The GET /workspaces/workspaceid/issues/issueid/activity endpoint is gated by requireworkspacememberworkspaceid and dispatches to...

CVE-2026-16451

CVE-2026-16451 concerns zsadmin2025 ZS-Admin (up to commit b52e14536d59fda11e56e2536a1c32e82a38cead). The vulnerability is in the file upload function of the component com.zs.file.controller.SysFileController, specifically the /api/system/file/upload endpoint. A manipulation of the File argument ...

CVE-2026-6792

Technical details about CVE-2026-6792 are not publicly available in the provided documents. Monitor for updates from official advisories; the available sources only reiterate a Missing Authorization issue affecting FlexCity versions 5.536.0–11052026.

ROOT-OS-DEBIAN-12-CVE-2023-34152 CVE-2023-34152 in rootio-imagemagick - Patched by Root

Root has patched CVE-2023-34152 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2025-37796 CVE-2025-37796 in rootio-linux - Patched by Root

Root has patched CVE-2025-37796 in the rootio-linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2025-40030 CVE-2025-40030 in rootio-linux - Patched by Root

Root has patched CVE-2025-40030 in the rootio-linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2025-21944 CVE-2025-21944 in rootio-linux - Patched by Root

Root has patched CVE-2025-21944 in the rootio-linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2026-46147 CVE-2026-46147 in rootio-linux - Patched by Root

Root has patched CVE-2026-46147 in the rootio-linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2026-23270 CVE-2026-23270 in rootio-linux - Patched by Root

Root has patched CVE-2026-23270 in the rootio-linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2026-52942 CVE-2026-52942 in rootio-linux - Patched by Root

Root has patched CVE-2026-52942 in the rootio-linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2026-23447 CVE-2026-23447 in rootio-linux - Patched by Root

Root has patched CVE-2026-23447 in the rootio-linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2026-53053 CVE-2026-53053 in rootio-linux - Patched by Root

Root has patched CVE-2026-53053 in the rootio-linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

CVE-2023-37508 HCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerability

HCL DevOps Plan is potentially susceptible to Cross-Site Scripting XSS which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present...

CVE-2026-64625 AVideo before 29.0 OS Command Injection via execAsync

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $ and backticks. Attackers can inject arbitrary OS commands through the Live plugin onpublish.php endpoint despite escapeshellarg...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

CVE-2026-44231

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged non-administrative user can obtain authentication credentia...

webkitgtk: webkitgtk: Visiting a website may leak sensitive data

A flaw was found in WebKitGTK. Visiting a website can leak sensitive data due to a permissions issue that was addressed with additional restrictions...

webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a type confusion due to improper checks, leading to memory corruption...

CVE-2026-61901

Joomla Extension - hikashop.com - Open redirect in Hikashop 6.5.2 - The Joomla extension Hikashop is vulnerable to an open redirect...

webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, resulting in an unexpected process crash...