Skip to content

/

ZeroHour

ZeroHour aggregates public sources — security and AI press, vendor advisories, NVD, CISA KEV, FIRST EPSS, leak-site trackers and Have I Been Pwned — and classifies them with AI. Summaries can be wrong: read the original. All times are UTC.

News CVEs Incidents Tags Daily brief Traffic Sources RSS & API Kiosk Health Sitemap

Home
News feed
Exploited now

Security

CVEs
Ransomware & breaches
Threat actors & entities
IOCs

AI

AI & models

Explore

Tags
Daily brief
Analytics
Traffic & readers
Ask the feed
Sources

You

Watchlist
Saved
RSS, API & alerts

#authorization — news, CVEs and analysis · ZeroHour

today 43 visits · 56 views · 7 reads·all time 17K views

06:59 UTC· 6m ago

Tag

#authorization

10 stories this week · 29 this month · 32 in 6 months · mostly security

stories per day · 30 days

Related#access-control 8 #agent-security 8 #ai-agents 6 #apache 4 #prompt-injection 4 #apache-airflow 3 #delegation 3 #iam 3 #noma-labs 3 #workflow-identity-hijacking 3 #ai-security 2 #apache-roller 2 #cve 2 #idor 2 #llm-agents 2 #mcp 2 #oauth 2 #open-source 2

31 stories, newest first · one card per story

1–24 of 31← Prev1 / 2Next →

oss-security·1d ago high

CVE-2026-82377: Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers

#apache #apache-roller #cve-2026-82377

CVE-2026-82377

arXiv cs.CR·2d ago

Beyond Centralized Policy Decision Points: Decentralized Sticky Policy Authorization through Evidence Quorums

#sticky-policy #authorization #decentralized

Research

CERT/CC Vulnerability Notes·3d ago high

VU#754548: Cinnamon's kotaemon contains improper authorization checks in Kotaemon multi‑user chat handlers

#kotaemon #cinnamon #idor

CVE-2026-86867

3 min

Cyber Security News·3d ago

Outerlimit Raises $16M to Build Zero Trust Security Layer for Autonomous AI Agents

#outerlimit #ai-agents #zero-trust

2 sources 3 min

Full Disclosure·4d ago

CVE-2026-17613: Penpot cross-team file takeover via import-binfile (unpatched in 2.17.2)

#penpot #cve-2026-17613 #authorization

CVE-2026-17613

arXiv cs.CR·5d ago

ZeroGate: Trust-Preserving Fast Paths for Governed AI Agent Runtimes

#zerogate #ai-agents #authorization

AI safety & security

1

oss-security·5d ago

[OSSA-2026-040] OpenStack Blazar: Multiple authorization vulnerabilities in the Blazar V2 lease API (CVE-2026-93852, CVE-2026-93854)

#openstack #blazar #authorization

CVE-2026-93852

2

oss-security·5d ago

CVE-2026-75158: Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

#apache-airflow #cve-2026-75158 #authorization

CVE-2026-75158

arXiv cs.CR·5d ago

ActGov: Governing LLM Agent Actions via Policy-Constrained Validation

#actgov #llm-agents #prompt-injection

AI safety & security

1

oss-security·9d ago

CVE-2026-75157: Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

#access-control #apache-airflow #authorization

CVE-2026-75157

arXiv cs.CR·9d ago

Authorization Revocation for Long-Running AI Agents: Root-Scoped Quiescence under Delegation and Asynchronous Execution

#ai-agents #authorization #revocation

AI safety & security

arXiv cs.CR·9d ago

Loopjacking: Hijacking Human-in-the-Loop Approval

#loopjacking #human-in-the-loop #agents

AI safety & security

oss-security·11d ago

CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity

#apache-airflow #authorization #cookie

CVE-2026-76186

Cloudflare Blog·11d ago

Give every teammate and agent the right level of access to your Workers

#access-control #api-tokens #authorization

8 min

arXiv cs.CR·12d ago

Authorization Architectures for Tool-Using AI Agents

#access-control #ai-agents #architecture

AI safety & security

oss-security·12d ago

CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective

#access-control #apache #authorization

CVE-2026-77181

oss-security·12d ago

CVE-2026-75030: Apache Syncope: Incomplete authorization checks for Group members deprovisioning

#apache-syncope #authorization #cve-2026-75030

CVE-2026-75030

1

oss-security·12d ago

CVE-2026-73470: Apache Syncope: Delegating users can grant unowned Roles

#apache #authorization #cve-2026-73470

CVE-2026-73470

arXiv cs.CR·12d ago

Approval Integrity and Recovery in LLM Answer Publication

#authorization #evals #llm-security

AI safety & security

Help Net Security·13d ago

Permify: Open-source authorization as a service

#access-control #authorization #devtools

1

arXiv cs.CR·16d ago

IDORacle: Template-Guided SQL-Sink Mediation for Object-Level Authorization in Java Applications

#access-control #authorization #bola

Research

1

arXiv cs.CR·16d ago

From Intent to Execution Grant: An Execution-Boundary Conformance Profile for High-Risk AI Actions

#agent-security #ai-agents #authorization

AI safety & security

1

Cyber Security News·16d ago

Hackers Can Turn AI Workflows Into Privileged Data-Stealing Proxies Without Jailbreaking Models

#ai-security #authorization #data-exfiltration

3 min

CSO Online·16d ago

AI workflows may be creating a dangerous new authorization blind spot

#agent-security #ai-agents #authorization

5 min