6380 matches found
CVE-2026-80049
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...
CVE-2026-80049
Airbyte Platform through 2.0.0 suffers a cross-workspace authorization bypass. The root cause is that AuthorizationServerHandler extracts a caller-supplied workspaceId from the raw JSON request body and sets it in the X-Airbyte-Workspace-Id header, which AuthenticationHeaderResolver.resolveWorksp...
CVE-2026-80049 Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...
CVE-2026-80049 Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...
CVE-2026-55540
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, ispathwithindirectory uses os.path.abspath rather than os.path.realpath for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing readfile and other code tools to access files...
GO-2026-6273 Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation in github.com/runatlantis/atlantis
Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation in github.com/runatlantis/atlantis...
PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks
Summary PraisonAI's praisonai.code tool wrappers exported as CODETOOLS for agents expose a workspace setting that the module itself treats as a path-traversal security boundary — readfile, writefile, applydiff, and searchreplace explicitly call ispathwithindirectory and return "… is outside the...
GHSA-CH89-H4R2-C8F8 PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks
Summary PraisonAI's praisonai.code tool wrappers exported as CODETOOLS for agents expose a workspace setting that the module itself treats as a path-traversal security boundary — readfile, writefile, applydiff, and searchreplace explicitly call ispathwithindirectory and return "… is outside the...
CVE-2026-55540 PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, ispathwithindirectory uses os.path.abspath rather than os.path.realpath for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing readfile and other code tools to access files...
CVE-2026-55540
CVE-2026-55540 is a path traversal vulnerability in PraisonAI , a multi-agent teams system. The function is_path_within_directory() relies on os.path.abspath() instead of os.path.realpath() to enforce the workspace boundary, so a symlink placed inside the workspace can resolve to a path outside i...
EUVD-2026-65512
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, ispathwithindirectory uses os.path.abspath rather than os.path.realpath for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing readfile and other code tools to access files...
CVE-2026-55540 PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, ispathwithindirectory uses os.path.abspath rather than os.path.realpath for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing readfile and other code tools to access files...
CVE-2026-55540 PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, ispathwithindirectory uses os.path.abspath rather than os.path.realpath for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing readfile and other code tools to access files...
CVE-2026-80049: Authorization Bypass Through User-Controlled Key
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...
PT-2026-81484
Name of the Vulnerable Software and Affected Versions Airbyte Platform affected versions not specified Description An issue exists where the platform determines the workspace for authorization decisions based on a field supplied by the caller. The AuthorizationServerHandler copies recognized...
CVE-2026-62861: Authorization Bypass Through User-Controlled Key
TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler in handleDeleteCustomDomain.ts authorizes a caller against a...
PT-2026-81874
TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler in handleDeleteCustomDomain.ts authorizes a caller against a...
PT-2026-81329
Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description PraisonAI contains path traversal flaws in its praisonai.code tool wrappers, which are intended to treat the workspace setting as a security boundary. The boundary is enforced inconsistently and...
CVE-2026-76837
Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...
EUVD-2026-65009
Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...