DELMIA Apriso - Broken Access Control

DELMIA Apriso Release 2020 through Release 2025 contains a broken access control vulnerability caused by missing authorization, letting attackers gain privileged access to the application, exploit requires no special conditions. id: CVE-2025-6205 info: name: DELMIA Apriso - Broken Access Control...

PT-2026-107741

In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them...

PT-2026-107790

A flaw was found in Katello where the Docker Tags repositories API does not properly enforce organization scoping when listing repositories for a Docker meta tag. An authenticated user with permission to view products in one organization may be able to retrieve repository metadata associated with...

CVE-2026-88648

An incomplete X.509 implementation in GnuTLS v3.8.13 allows an attacker who controls a subordinate Certificate Authority to bypass cross-domain PKI restrictions . This flaw enables the unauthorized issuance of certificates. No specific remediation or exploit details are provided in the documents.

UBUNTU-CVE-2026-107279

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

DEBIAN-CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

Summary Injection Defense is a purpose-built prompt injection defense layer. It scans LLM inputs through six detection categories: instruction overrides, authority claims, boundary manipulation, obfuscation, financial manipulation, and self-harm instructions. The defense is misconfigured by...

Payload: Unauthorized update to collection documents

Impact An attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control. You are affected if: - You are configuring orderable: true with any collection or join field. Patches In the patched version...

NPM: Payload: Unauthorized update to collection documents

NPM: Payload: Unauthorized update to collection documents vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...

CVE-2026-107363

In OpenStack Zaqar before version 23.0.1 , a vulnerability exists in the WebSocket transport where it fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token . An authenticated user with a valid token for one project can substitute another pr...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

EUVD-2026-94614

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

EUVD-2026-94000

Backstage has improper authorization in GitLab organizational user ingestion...

GHSA-GP6M-X9VW-5C5X Backstage has improper authorization in GitLab organizational user ingestion

Impact Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticate...

GHSA-HMP2-4M7G-22CV Backstage: Scaffolder action input authorization bypass

Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. Patches Patched in...

EUVD-2026-94068

Backstage: Scaffolder action input authorization bypass...

Backstage: Scaffolder action input authorization bypass

Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. Patches Patched in...