SUSE CVE-2026-64679

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated...

PT-2026-86398

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue id parameter to the public deploy-board comment endpoint...

PT-2026-86306

Name of the Vulnerable Software and Affected Versions PCRE2 versions prior to 10.48 Description An out-of-bounds write occurs in the pcre2 dfa match function due to a missing size check when reusing a cached workspace block within a recursive Deterministic Finite Automaton DFA matching workspace...

PT-2026-91917

PCRE2 before 10.48 allows a pcre2 dfa match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check even though a newly allocated block, for the same purpose, does have a size check. This outcome requires an attacker-controlled...

Linux Distros Unpatched Vulnerability : CVE-2026-86145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCRE2 before 10.48 allows a pcre2dfamatch out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size che...

NPM: CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

NPM: CodeWhale: imageanalyze follows workspace symlinks, leaking external file bytes vulnerability discovered by ? in WordPress Npm deepseek-tui versions = 0.8.32, 0.8.41...

CVE-2026-85619

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read...

CVE-2026-85622

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establishwsconnectionv2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object...

CVE-2026-85685 AgentScope through 2.0.7.post1 Arbitrary Directory Copy via add_skill

AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.addskill that copies arbitrary server directories into the agent workspace via an unconfined source path parameter. Attackers can supply any directory path in the skillpath request parameter to copy files int...

CVE-2026-85622 AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establishwsconnectionv2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object...

CVE-2026-85622

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership in the establish_ws_connection_v2 WebSocket handler. This allows any authenticated user to bind a session to a workspace they do not belong to, then send sync Manifest messages with victim object identifiers to read full documen...

EUVD-2026-71229

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establishwsconnectionv2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object...

CVE-2026-85622 AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establishwsconnectionv2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object...

CVE-2026-85622 AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establishwsconnectionv2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object...

CVE-2026-85619 AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read...

CVE-2026-85619 AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read...

CVE-2026-85619

AppFlowy-Cloud 0.9.64 contains an authorization bypass in its collaboration object access control (libs/access-control/src/casbin/collab.rs). The service fails to verify that requested collab objects belong to the caller's workspace, allowing an authenticated attacker to supply a victim's object ...

EUVD-2026-71226

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read...

CVE-2026-85619 AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read...

CVE-2026-85583

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace a...