8534 matches found
EUVD-2026-92470
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...
CVE-2026-88394
WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...
PT-2026-106083
Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description The webhook delivery task in apps/api/plane/bgtasks/webhook task.py uses the requests.post function without setting allow redirects=False and fails to validate redirect targets. While the validate url...
CVE-2026-88393
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...
Compromise Is Not Consequence: Evaluating Task-Scoped Authorization in LLM Agents with Paired Replay
A tool-using model can follow a malicious instruction even when its credentials are valid. We study whether task-scoped authorization contains the resulting tool execution. Our paired-replay testbed samples a model request once and submits the same action, resource, and arguments to broad bearer,...
EUVD-2026-92442
WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...
PT-2026-105998
WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...
CVE-2026-88394
WookTeam versions v1.6.6 and before are vulnerable to a Directory Traversal flaw within the project task export endpoint (/api/project/task/export). The root cause is the lack of path normalization or directory boundary checks when processing the data parameter. Specifically, a crafted JSON paylo...
CVE-2026-105636: Server-Side Request Forgery (SSRF)
Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post without allowredirects=False and does not validate redirect targets. validateurl blocks private, loopback, link-local, and reserved addresses in...
CVE-2026-104973: Server-Side Request Forgery (SSRF)
Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhooktask.py performs a separate DNS resolution...
CVE-2026-88393
WookTeam version 1.6.6 and before is vulnerable to Remote Code Execution (RCE) via the project task export interface at /api/project/task/export. The root cause is that the data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php. This function ...
CVE-2026-88394
WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...
CVE-2026-88393: Improper Control of Generation of Code
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...
NetAgent: Multi-Task Agentic Network Traffic Analysis Made Practical
Network traffic analysis is central to network security, spanning tasks from intrusion detection to encrypted traffic classification. Existing approaches either train task-specific models that generalize poorly or rely on costly traffic foundation models that still struggle under distribution...
GHSA-PP95-GC86-JQ6Q Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
Summary The run replay action function at apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts has no authentication or authorization check. While the loader GET in the same file properly calls requireUserrequest and scopes queries to the user's organizations, the action POST at line 166...
NPM: Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
NPM: Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution IDOR vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.1...
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
Summary The run replay action function at apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts has no authentication or authorization check. While the loader GET in the same file properly calls requireUserrequest and scopes queries to the user's organizations, the action POST at line 166...
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
Summary The dashboard replay action authorizes the source run it must belong to the caller's org, but the target environment for the replayed run is taken verbatim from the request body and is never checked for org or project membership. The environment lookup used by the replay path filters by i...
GHSA-QXPP-QJG8-X4JV Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
Summary The dashboard replay action authorizes the source run it must belong to the caller's org, but the target environment for the replayed run is taken verbatim from the request body and is never checked for org or project membership. The environment lookup used by the replay path filters by i...
