CVE-2026-63143

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

CVE-2026-63143 Missing Authorization in Kibana Leading to Unauthorized Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the org-level Actions REST API endpoints, which lack per-repository access control checks. An attacker can access sensitive workflow metadata from private repositories by sending authenticated requests as an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the org-level Actions REST API endpoints, which lack per-repository access control checks. An attacker can access sensitive workflow metadata from private repositories by sending authenticated requests as an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the org-level Actions REST API endpoints, which lack per-repository access control checks. An attacker can access sensitive workflow metadata from private repositories by sending authenticated requests as an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the org-level Actions REST API endpoints, which lack per-repository access control checks. An attacker can access sensitive workflow metadata from private repositories by sending authenticated requests as an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the org-level Actions REST API endpoints, which lack per-repository access control checks. An attacker can access sensitive workflow metadata from private repositories by sending authenticated requests as an...

CVE-2026-62547

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow...

EUVD-2026-46419

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filtersdata API endpoints on UserStory, Task, Issue, and Epic viewsets...

CVE-2026-65055

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filtersdata API endpoints on UserStory, Task, Issue, and Epic viewsets...

CVE-2026-47690 MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of GITHUBTOKEN with write permissions to the repository. The vulnerable workflow used...

CVE-2026-47690 MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of GITHUBTOKEN with write permissions to the repository. The vulnerable workflow used...

CVE-2026-47690

MeltanoHub (hub.meltano.com) had a vulnerability in versions prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173, where a pull_request_target workflow could exfiltrate the repository GITHUB_TOKEN with write permissions. The issue was fixed by the commit 923820de8f64d753951fbbd54f7282a3d5f751...

CVE-2026-65055

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose private project members and internal workflow configuration. By supplying a project ID to the filters_data endpoints on UserStory, Task, Issue, and Epic viewsets, attackers can issue unau...

CVE-2026-65055 Taiga taiga-back Private Project Member Roster Disclosure via Unauthenticated filters_data Endpoints

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filtersdata API endpoints on UserStory, Task, Issue, and Epic viewsets...

CVE-2026-65055 Taiga taiga-back Private Project Member Roster Disclosure via Unauthenticated filters_data Endpoints

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filtersdata API endpoints on UserStory, Task, Issue, and Epic viewsets...

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

| Field | Value | |-------|-------| | Identifier researcher-assigned | GITEA-2026-004 | | Product | Gitea self-hosted Git service | | Component | Gitea Actions — fork pull request approval gate | | Affected versions | All Gitea releases v1.20.0 and later, including the latest main...

EUVD-2026-41607

Gitea: Permanent Fork PR Workflow Approval Gate Bypass...

CVE-2026-47394

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in mcpserver/adapters/clitools.py. Commit 68cc9427 "fixsecurity: harden MCP rules path handling…" adde...

CVE-2026-47394 PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in mcpserver/adapters/clitools.py. Commit 68cc9427 "fixsecurity: harden MCP rules path handling…" adde...