Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.. Mattermost Advisory ID: MMSA-2026-00732
CVE-2026-115627 is an incorrect authorization vulnerability in ash-project's ash_postgres library affecting versions from 0.38.0 up to but not including 2.15.2. The flaw allows a user to load destination records linked to a source record through another tenant's join rows due to improper enforcement of attribute multitenancy in lateral join queries. This results in unauthorized access to data belonging to other tenants. The issue is fixed in version 2.15.2.
CVE-2026-115635 is an incorrect authorization vulnerability in ash-project's ash_postgres library. It allows a user to read another tenant's record due to a skipped upsert operation that does not enforce multitenancy attribute checks. This affects versions from 2.6.22 up to but not including 2.15.2. The issue is fixed in version 2.15.2.
CVE-2026-114214 is an incorrect authorization vulnerability in ash-project ash versions from 3.24.0 up to but not including 3.37.1. It allows clients to read destination records unrelated to the source record through a has_many or has_one through relationship when queried with a limit of 1. This occurs because the code path reads destination records without properly filtering them by the source, enabling enumeration of records that should be restricted by policy.
GiveWP WordPress plugin versions before 4.19.0.1 contain an authorization flaw that allows users with a custom fundraising role to edit, publish, and read pages owned by other users, including administrators. This issue arises from incorrect determination of page-capability requests. The vulnerability is fixed in version 4.19.0.1.
CVE-2026-115883 is an improper input validation vulnerability in langchain-ai's langgraph checkpoint savers for Postgres and SQLite state persistence. Prior to versions 3.1.3 (Postgres) and 3.1.2 (SQLite), certain namespace label operations do not properly validate dotted labels, allowing cross-namespace access. This can lead to unauthorized reads, overwrites, or deletions of another tenant's stored namespace. The issue does not affect InMemoryStore. Fixed in langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2.
CVE-2026-75525 is an authorization vulnerability in OpenReception's appointment booking software versions 2.1.0 and earlier. It allows an unauthenticated attacker to insert an arbitrary encryption public key into any tenant's staff-crypto recipient directory. This breaks the product's end-to-end encryption guarantee by enabling the attacker to receive encrypted appointment data intended for staff members. No patches are publicly available at the time of disclosure.
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed `memory/<type>/<name>.md` path without reliably preserving note ownership or the consistency of a failed lifecycle operation. During shared materialization, a hand-authored note or an orphan left by a different entity whose name sanitized to the same path could have its entire body overwritten on the next write naming that type and name, with non-owned frontmatter preserved. `rename_entity` also seeded the destination path with a direct atomic write without validating ownership and could overwrite a foreign note there. Separately, several tools mutated SQLite before fallible filesystem work: `create_entity` and `link_entities` inserted the row or relation before materialization; `rename_entity` updated the entity, including a retired status, before updating its note; `unlink_entities` removed a relation before rematerializing the source note; and `delete_entity`'s cascade removed the target and its relations before rematerializing neighbouring notes. A later filesystem failure could therefore leave a row or relation changed and the memory graph inconsistent with the notes on disk even when the operation failed. An authorized caller with the required memory-tool permissions could, without intending to, destroy the body of a vault note outside the entity being written; `delete_entity` additionally requires its deletion permission and destructive confirmation, which this memory flaw does not bypass. Snapshots-before-write through `restore_note` mitigate the overwrite only where snapshots are enabled and the note had previously been written through obsidian-tc. This issue is fixed in version 1.31.4.
A vulnerability in obsidian-tc versions 1.13.0 through 1.31.3 allows improper authorization of certain destructive vault operations. When deployed with Streamable HTTP and auth.jwtSecret configured, a client supporting elicitation.form could bypass human approval by resubmitting a valid requestState, causing the server to trust the approval state incorrectly. This affects only tools marked as destructive or requiring human-in-the-loop scope. The issue is fixed in version 1.31.4.
baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 contain a path traversal vulnerability in the optional BcThemeFile plugin. An authenticated user with theme-file view permission can read certain files outside the theme directory by exploiting improper path validation. This can disclose sensitive application source code and configuration files, including database credentials and security salts. The plugin is disabled by default, and unauthenticated access is not sufficient. The issue is fixed in versions 5.3.2 and 5.4.2.
PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write_file when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then sends those strings to shell-backed compute providers. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment. With compute="local", commands execute through the local subprocess compute provider on the host. With Docker, commands execute in the container. This issue has been patched in version 4.6.59.
CVE-2026-57142 is a high-severity OS command injection vulnerability in MervinPraison's PraisonAI multi-agent teams system. Versions from 4.5.87 up to but not including 4.6.61 are affected. The flaw arises because the recipe execution policy only checks dangerous tools declared in TEMPLATE.yaml, but steps-based recipes can self-approve dangerous tools like execute_command via workflow.yaml, bypassing the intended restriction. This allows untrusted recipes to execute critical shell commands without explicit permission. The issue has been fixed in version 4.6.61.
CVE-2026-56838 is an OS command injection vulnerability in MervinPraison's PraisonAI affecting versions from 4.5.87 up to but not including 4.6.59. The issue arises because the streaming execution path recipe.run_stream() bypasses the dangerous tool policy check that is enforced in the normal recipe.run() path. This allows execution of commands that should be denied unless explicitly allowed. The vulnerability has been fixed in version 4.6.59.
PraisonAI versions from 3.11.0 up to but not including 4.6.59 contain a missing authorization vulnerability in the Slack app_mention event handler. This flaw allows a Slack workspace user to trigger configured PraisonAI agents by mentioning the bot in a channel, bypassing restrictions set by allowed users, allowed channels, and unknown user policies. The issue is fixed in version 4.6.59.
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending yes after the approval message appears. the same PoV also shows that the Slack and Telegram messaging approval backends have no explicit approver allowlist parameter, but the primary report-grade issue is the Discord backend's unthreaded channel cross-talk: the approving message does not need to be a reply or otherwise request-bound. This issue has been patched in version 4.6.59.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and have the Download Monitor WordPress plugin before 5.3.5 serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors; single-site installations are unaffected.
The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options.
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.
Authlib versions prior to 1.9.0 contain an incorrect authorization vulnerability in the OpenIDImplicitGrant.validate_authorization_request() method. The method improperly checks the client-controlled raw request payload for the 'openid' scope instead of the filtered allowed scopes. This allows a registered client permitted an ID token response type but not the 'openid' scope to add 'openid' to the request, obtain user consent, and receive a signed ID token with user subject and profile claims. The issue is fixed in version 1.9.0.