CVE-2026-67308

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

PraisonAI - Authentication Bypass

PraisonAI 2.5.6 to 4.6.34 contains a broken authentication caused by disabled default authentication in legacy Flask API server, letting remote attackers access /agents and trigger workflows without token, exploit requires network access to API server. id: CVE-2026-44338 info: name: PraisonAI -...

FreeBSD : Gitlab -- vulnerabilities (661d3db5-8bd9-11f1-9c40-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 661d3db5-8bd9-11f1-9c40-2cf05da270f3 advisory. Gitlab reports: Sensitive Information Exposure issue in Workhorse impacts GitLab CE/EE Mass...

CLEANSTART-2026-ZW70206 Security fixes in argo-workflows-fips 3.7.0-r0

Package argo-workflows-fips version 3.7.0-r0 fixes 3 vulnerabilities: CVE-2025-47907, CVE-2025-0913, CVE-2025-4673...

CLEANSTART-2026-KJ87969 Security fixes in argo-workflows 3.6.18-r2

Package argo-workflows version 3.6.18-r2 fixes 5 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, CVE-2026-33186, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-AC04649 Security fixes in argo-workflows-fips 3.7.10-r1

Package argo-workflows-fips version 3.7.10-r1 fixes 3 vulnerabilities: ghsa-9h8m-3fm2-qjrq, CVE-2026-24051, CVE-2026-27141...

CLEANSTART-2026-HW68695 Security fixes in argo-workflows 4.0.1-r0

Package argo-workflows version 4.0.1-r0 fixes 2 vulnerabilities: ghsa-fw7p-63qq-7hpr, CVE-2026-26958...

CLEANSTART-2026-DE38896 Security fixes in argo-workflows 4.0.0-r0

Package argo-workflows version 4.0.0-r0 fixes 1 vulnerabilities: CVE-2026-24051...

CLEANSTART-2026-BV74882 Security fixes in argo-workflows-fips 3.6.19-r1

Package argo-workflows-fips version 3.6.19-r1 fixes 2 vulnerabilities: ghsa-p436-gjf2-799p, CVE-2025-15558...

CLEANSTART-2026-IB38631 Security fixes in argo-workflows-fips 3.7.11-r0

Package argo-workflows-fips version 3.7.11-r0 fixes 2 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-AQ85366 Security fixes in argo-workflows-fips 3.7.9-r2

Package argo-workflows-fips version 3.7.9-r2 fixes 3 vulnerabilities: ghsa-fw7p-63qq-7hpr, CVE-2026-26958, CVE-2026-24051...

CLEANSTART-2026-QJ99609 Security fixes in argo-workflows 3.7.10-r3

Package argo-workflows version 3.7.10-r3 fixes 2 vulnerabilities: ghsa-fw7p-63qq-7hpr, CVE-2026-26958...

CVE-2026-15054

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows such as email notifications of forms the site owner has deactivated or...

CVE-2026-15054 Bit Form < 3.1.2 - Unauthenticated Inactive Form Submission

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows such as email notifications of forms the site owner has deactivated or...

PT-2026-65895

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.7 Description HTTP-emitting modules fetch caller-controlled URLs without using the validate url with env config function, which allows Server-Side Request Forgery SSRF to internal or metadata endpoints. SSRF ...

BIT-ARGO-WORKFLOWS-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...

CVE-2026-48036 Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...

CVE-2026-48036

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...

CVE-2026-48036 Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...

CVE-2026-16799

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...