Export limit exceeded: 12186 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (12186 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-63733 | 1 Surrealdb | 1 Surrealdb | 2026-07-28 | 4.3 Medium |
| SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption. | ||||
| CVE-2026-63309 | 1 Surrealdb | 1 Surrealdb | 2026-07-28 | 4.3 Medium |
| SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. Attackers can issue ORDER BY queries on indexed restricted fields to recover the hidden values' sort order across records, even though the field itself returns null as intended. | ||||
| CVE-2026-42016 | 1 Jfrog | 1 Artifactory | 2026-07-28 | 8.1 High |
| JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. | ||||
| CVE-2026-59851 | 2 Libssh, Redhat | 4 Libssh, Enterprise Linux, Hardened Images and 1 more | 2026-07-27 | 8.8 High |
| A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users. | ||||
| CVE-2026-47405 | 1 Mervinpraison | 1 Praisonai | 2026-07-27 | 8.8 High |
| PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to `owner`. The issue is caused by privileged workspace-management routes using the shared dependency `require_workspace_member(...)` without requiring `admin` or `owner`. The dependency defaults to `min_role="member"`, so routes that should be administrative are accessible to ordinary workspace members. As a result, a normal workspace member can promote their own account from `member` to `owner`; add arbitrary users as `owner` or `admin`; change other members' roles; remove legitimate owners or members; take over workspace membership completely; and/or perform destructive workspace operations after escalation. This is a broken access control / vertical privilege escalation vulnerability. PraisonAI Platform version 0.1.4 patches the issue. | ||||
| CVE-2026-47407 | 1 Mervinpraison | 1 Praisonai | 2026-07-27 | N/A |
| PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under `/api/v1/workspaces/{workspace_id}/...` and protects them with a `require_workspace_member(workspace_id)` FastAPI dependency. The dependency only checks that the caller is a member of the workspace_id in the URL prefix. The route handlers then look up the inner resource (`agent_id`, `issue_id`, `project_id`, `label_id`, `comment_id`, `dependency_id`) by primary key alone. The resource's own `workspace_id` is never compared to the URL's `workspace_id`. A user can therefore put their own workspace in the URL prefix and any other workspace's resource ID in the path. The auth check passes, since they really are a member of the prefix workspace. The service then returns the cross-tenant resource for read, update, or delete. There is a second bug in the member-management routes (`add_member`, `update_member_role`, `remove_member`, `update_workspace`, `delete_workspace`). Each one inherits the default `min_role="member"` from `require_workspace_member`. Any basic member can therefore promote themselves to admin or owner, demote or remove other members, and delete the workspace. The role hierarchy exists in the schema but is not enforced. Registration is open at `/api/v1/auth/register` with no email verification. The default server bind is `0.0.0.0:8000` (`python -m praisonai_platform`). One curl from any unauthenticated network position is enough to bootstrap into the system. PraisonAI Platform version 0.1.4 patches the issue. | ||||
| CVE-2026-47409 | 1 Mervinpraison | 1 Praisonai | 2026-07-27 | 8.1 High |
| PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The `DELETE /workspaces/{workspace_id}/members/{user_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member can remove any other member, including the workspace owner, using a single DELETE. There is no caller-role check, no target-role check, no "cannot remove last owner" guard. PraisonAI Platform version 0.1.4 patches the issue. | ||||
| CVE-2026-47411 | 1 Mervinpraison | 1 Praisonai | 2026-07-27 | 6.5 Medium |
| PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member can rewrite the workspace's `name`, `description`, and the `settings` JSON blob. The settings field is a free-form JSON object — depending on which downstream code reads it, this becomes a configuration-injection primitive for any setting the platform exposes there. PraisonAI Platform version 0.1.4 patches the issue. | ||||
| CVE-2026-47412 | 1 Mervinpraison | 1 Praisonai | 2026-07-27 | 8.1 High |
| PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The `DELETE /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member of the workspace can issue a single DELETE to wipe the entire workspace, including every project, issue, comment, agent, label, and member record (cascading via the foreign-key relationships). There is no owner-role gate, no confirmation token, no soft-delete window, no recovery path. PraisonAI Platform version 0.1.4 patches the issue. | ||||
| CVE-2026-47413 | 1 Mervinpraison | 1 Praisonai | 2026-07-27 | 9.6 Critical |
| PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The `POST /workspaces/{workspace_id}/members` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`) and forwards the request body's `user_id` and `role` straight into `MemberService.add(workspace_id, user_id, role)`, which has no caller-permission check. A user with the lowest workspace privilege can add any user (including a new attacker-controlled second account, or an existing account they want to grief) as owner of the workspace. PraisonAI Platform version 0.1.4 patches the issue. | ||||
| CVE-2026-47416 | 1 Mervinpraison | 1 Praisonai | 2026-07-27 | 9.6 Critical |
| PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. The `PATCH /workspaces/{workspace_id}/members/{user_id}` endpoint is gated by `require_workspace_member(workspace_id)`, which defaults to `min_role="member"` and is never overridden by the route. The handler then calls `MemberService.update_role(workspace_id, user_id, body.role)` which sets the target member's role to whatever the request body specifies, with no check that the caller has owner-or-admin privilege, no check that the new role is not higher than the caller's own, and no check that the caller is not silently promoting themselves. PraisonAI Platform version 0.1.4 patches the issue. | ||||
| CVE-2026-65055 | 1 Taiga | 1 Taiga | 2026-07-27 | 5.3 Medium |
| Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and gravatar hashes, bypassing the access controls that correctly restrict other project API endpoints. | ||||
| CVE-2026-59536 | 2 Cocart Headless, Wordpress | 2 Cocart – Headless Ecommerce, Wordpress | 2026-07-27 | 7.5 High |
| Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions. | ||||
| CVE-2026-59557 | 2 Franky, Wordpress | 2 Events Made Easy, Wordpress | 2026-07-27 | 6.5 Medium |
| Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions. | ||||
| CVE-2026-65433 | 2 Themewant, Wordpress | 2 Rt Mega Menu – Mega Menu Builder For Elementor & Gutenberg, Wordpress | 2026-07-27 | 6.5 Medium |
| Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions. | ||||
| CVE-2026-65435 | 2 Thrive Themes Coupon, Wordpress | 2 Thrive Leads Version, Wordpress | 2026-07-27 | 6.5 Medium |
| Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions. | ||||
| CVE-2026-65567 | 2 Nexcess, Wordpress | 2 Event Tickets, Wordpress | 2026-07-27 | 5.3 Medium |
| Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions. | ||||
| CVE-2026-66442 | 2 Wordpress, Yaycommerce | 2 Wordpress, Yaypricing | 2026-07-27 | 5.4 Medium |
| Subscriber Broken Access Control in YayPricing <= 3.5.6 versions. | ||||
| CVE-2026-17530 | 1 Astrbot | 1 Astrbot | 2026-07-27 | 6.3 Medium |
| A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file AstrBot/astrbot/core/astr_agent_tool_exec.py of the component Subagent. The manipulation results in incorrect authorization. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as d23011262e8e75e1ec41b0f1f0091493a022327e. A patch should be applied to remediate this issue. | ||||
| CVE-2026-59529 | 2 Motovnet, Wordpress | 2 Ebook Store, Wordpress | 2026-07-27 | 7.5 High |
| Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions. | ||||