CVE-2026-47411 praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + settings tampering. The PATCH /workspaces/workspaceid endpoint is gated only by requireworkspacememberworkspaceid default...

CVE-2026-47407

PraisonAI Platform prior to v0.1.4 has cross-tenant IDOR and privilege-escalation flaws: the URL workspace_id is not validated against inner resources, enabling read/update/delete of other tenants’ data; and member-role checks allow basic members to promote themselves or modify/remove others and ...

EUVD-2026-42432

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npmexecpath is unset or empty, allowing arbitrary OS command execution with the privileg...

CVE-2026-50549 Cursor Desktop sandbox escape via symlink and failed path canonicalization

Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a Write, the agent canonicalizes the target path to confirm it stays inside the workspace, but when canonicalization fails it falls back to the original path an...

CVE-2026-55583 Twenty: Cross-workspace IDOR in AgentTurnResolver

Twenty is an open-source CRM customer relationship management platform. Prior to 2.9.0, Twenty was vulnerable to a cross-workspace insecure direct object reference IDOR in the AI agent monitor's AgentTurnResolver, in packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-monitor/reso...

PT-2026-52081

Name of the Vulnerable Software and Affected Versions Twenty versions prior to 2.9.0 Description An insecure direct object reference IDOR exists in the AI agent monitor's AgentTurnResolver and the agent-turn-grader.service.ts file. The agentTurnsagentId query and the evaluateAgentTurnturnId...

Anthropic Claude Code < 2.1.64 Sandbox Escape via Symlink Following (CVE-2026-39861)

The version of Anthropic Claude Code installed on the remote host is prior to 2.1.64. It is, therefore, affected by a sandbox escape vulnerability. - Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code...

CVE-2026-31879 Frappe Workspace modification and stored XSS due to improper resource ownership checks

Frappe is a full-stack web application framework. Prior to 14.100.2, 15.101.0, and 16.10.0, due to a lack of validation and improper permission checks, users could modify other user's private workspaces. Specially crafted requests could lead to stored XSS here. This vulnerability is fixed in...

PT-2026-24826

A weakness has been identified in OpenBMB XAgent 1.0.0. Affected by this vulnerability is the function workspace of the file XAgentServer/application/routers/workspace.py. This manipulation of the argument file name causes path traversal. The attack may be initiated remotely. The exploit has been...

Exploit for CVE-2025-62376

CVE-2025-62376: Local Privilege Escalation Exploit for Sudo...

EUVD-2019-12374

Malware in sbrugna...

EUVD-2014-8487

Malware in sbrugna...

EUVD-2013-4060

Malware in sbrugna...

The vulnerability of the Workspace component of the Oracle Hyperion Financial Reporting application allows a malicious actor to gain unauthorized access to modify, read, and delete protected information.

The vulnerability of the Workspace component of the Oracle Hyperion Financial Reporting application for automating budget management processes is related to access control errors. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to modify, rea...

Dust: User Limit Bypass via Pending Invitations in Workspace System

The platform's workspace user limit was found to be vulnerable to bypass through the use of pending invitations. Users were able to join a workspace by signing up with an invited email, even after the workspace had reached its user limit for the current subscription tier. This allowed an unlimite...

KDE Workspace Path Traversal Vulnerability

KDE Workspace is a virtual desktop tool from the KDE community. A path traversal vulnerability exists in KDE Workspace 5.93.0 and earlier versions, which stems from a path traversal vulnerability in the component /calendar/eventpluginsmanager.cpp...

Oracle Hyperion 安全漏洞

Oracle Hyperion is the United States Oracle Oracle company's set of financial modeling applications. The software provides financial closure, report creation, and other functions. A security vulnerability exists in Oracle Hyperion's Oracle Hyperion Workspace product, which arises from a...

IBM Planning Analytics 代码问题漏洞

IBM Planning Analytics is a business planning and analysis solution from IBM Corporation. Planning Analytics Workspace is the Web management interface for IBM Planning Analytics. IBM Planning Analytics Workspace version 2.0 contains a file upload vulnerability that stems from a failure to Validat...

IBM Planning Analytics 信息泄露漏洞

IBM Planning Analytics is a suite of business planning and analytics solutions from IBM USA. The solution supports automated execution of processes such as business planning, budgeting and analysis. An information disclosure vulnerability exists in IBM Planning Analytics Workspace that allows a...

Oracle Hyperion Unspecified Vulnerability in Oracle Hyperion Financial Reporting Component

Oracle Hyperion is the United States Oracle Oracle company's set of financial modeling applications, it provides financial results, report production and other functions.Oracle Hyperion Financial Reporting is one of the financial statement management component. An unspecified vulnerability exists...