Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
CVE-2026-44018
### Impact The METS-GBS backend's XML parsing and the input document format detection lacked security controls, enabling
#pip
共收录 834 条相关情报。
← 返回所有主题Docling: Unsafe Playwright-based HTML Rendering
CVE-2026-44016
### Impact In versions `>= 2.82.0, < 2.91.0`, if the HTML backend was explicitly configured for rendering (rendering opt
malla: Stored XSS via Meshtastic node names in multiple frontend pages
CVE-2026-43980
Node names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM
AIOHTTP is Vulnerable to Deserialization of Untrusted Data
CVE-2026-34993
### Summary Using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. ### Impact Most appli
Docling: Unsafe Zip Extraction in EasyOCR Model Download
CVE-2026-44017
### Impact In versions `< 2.91.0`, The EasyOCR model download functionality extracted ZIP archives without validating me
kas checks out SHA-like git branches as valid commits
CVE-2026-47191
### Impact When relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a repository is equival
praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}
CVE-2026-47412
## Summary **Type:** Authorization bypass enabling destructive action. The `DELETE /workspaces/{workspace_id}` endpoint
praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR
CVE-2026-47415
## Summary **Type:** Insecure Direct Object Reference. The issue CRUD endpoints (`GET / PATCH / DELETE /workspaces/{wor
praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members
CVE-2026-47413
## Summary **Type:** Privilege escalation / cross-tenant member injection. The `POST /workspaces/{workspace_id}/members
praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}
CVE-2026-47411
## Summary **Type:** Authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{wor
praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR
CVE-2026-47417
## Summary **Type:** Insecure Direct Object Reference. The comment endpoints (`POST /workspaces/{workspace_id}/issues/{
praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR
CVE-2026-47418
## Summary **Type:** Insecure Direct Object Reference. The project CRUD endpoints (`GET / PATCH / DELETE /workspaces/{w
praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}
CVE-2026-47416
## Summary **Type:** Vertical privilege escalation. The `PATCH /workspaces/{workspace_id}/members/{user_id}` endpoint i
praisonai-platform: Missing authorization on member removal enables full workspace takeover by any user regardless of role
CVE-2026-47409
## Summary **Type:** Authorization bypass enabling owner lockout. The `DELETE /workspaces/{workspace_id}/members/{user_
praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)
CVE-2026-47414
## Summary **Type:** Insecure Direct Object Reference. Five label endpoints — `PATCH /workspaces/{workspace_id}/labels/
praisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks
CVE-2026-47406
## Summary **Type:** Insecure Direct Object Reference. The dependency endpoints (`POST/GET /workspaces/{workspace_id}/i
praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset
CVE-2026-47410
## Summary **Type:** Insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal `"dev
PraisonAI Platform: Missing role checks let any workspace member become owner and control workspace membership
CVE-2026-47405
### Summary PraisonAI Platform has a broken workspace authorization check that allows any authenticated low-privilege w
PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID
CVE-2026-47399
### Summary PraisonAI Platform's workspace-scoped REST routes contain a systemic object-level authorization flaw that a
PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation
CVE-2026-47407
## Summary The Platform server exposes resources under `/api/v1/workspaces/{workspace_id}/...` and protects them with a