PULSEUnderground Intel

EN VIVO36señales / 24h

FEED

ransomwhitearmor reclama a wagyu.xyz · Retail & E-Commerceransomdirewolf reclama a GRUPO PETROIL · MX · Energy & Utilitiesransombooba project reclama a RCOA- Regent Christian Online Academy · CA · Educationransombooba project reclama a Kerckstede vzw · BE · Otherransombooba project reclama a BASS Medical Group · US · Healthcareransombooba project reclama a Hudson River Museum · US · Educationransombooba project reclama a Horizon Eye Specialists & LASIK Center · US · Healthcareransombooba project reclama a Aesthetic Specialty Centre · PK · Healthcareransombooba project reclama a City of Big Spring · US · Government & Defenseransombooba project reclama a KING FAMILY MEDICAL · US · Healthcareransombooba project reclama a Charter Township of Commerce · US · Government & Defenseransombooba project reclama a Regent Christian Online Academy · CA · Educationransomaurora reclama a GreenbergFarrow · Professional Servicesransomwallstreet reclama a Bristol City Council · GB · Government & Defenseransomwhitearmor reclama a wagyu.xyz · Retail & E-Commerceransomdirewolf reclama a GRUPO PETROIL · MX · Energy & Utilitiesransombooba project reclama a RCOA- Regent Christian Online Academy · CA · Educationransombooba project reclama a Kerckstede vzw · BE · Otherransombooba project reclama a BASS Medical Group · US · Healthcareransombooba project reclama a Hudson River Museum · US · Educationransombooba project reclama a Horizon Eye Specialists & LASIK Center · US · Healthcareransombooba project reclama a Aesthetic Specialty Centre · PK · Healthcareransombooba project reclama a City of Big Spring · US · Government & Defenseransombooba project reclama a KING FAMILY MEDICAL · US · Healthcareransombooba project reclama a Charter Township of Commerce · US · Government & Defenseransombooba project reclama a Regent Christian Online Academy · CA · Educationransomaurora reclama a GreenbergFarrow · Professional Servicesransomwallstreet reclama a Bristol City Council · GB · Government & Defense

← Todos los CVEs

CVE Watch27 oct 2026

CVE-2026-82983

The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level pe

CVSS

3.3

Bajo

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 27 oct 2026 · Última mod.: 27 oct 2026 · CWE-200

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels. This does not expose the table's data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels.

Referencias oficiales

hackerone.comhttps://hackerone.com/reports/3524971

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1176047.5 ALT

———Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.5h CVE-2026-1168198.5 ALT

——0OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.20h CVE-2026-1168054.3 MED

——0OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secret column, enabling offline verification of leaked secrets without audit trails.5h CVE-2026-1165075.3 MED

——0A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used.5h CVE-2026-1165756.3 MED

——0Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.4h CVE-2026-1164794.3 MED

——0A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. Patch name: bbee3369f3825d0fba2373d821f6dc6d4fc82ec0. Upgrading the affected component is advised.5h