Hiyokosauna37

**Name of the Vulnerable Software and Affected Versions** wger versions through master **Description** An incomplete authorization bypass exists in the `wger/core/views/user.py` file. Three views utilize raw integer comparison for gym-scope checks instead of the `is same gym()` helper function. This allows gym staff members who have `gym=None` affiliation and the `gym.manage gym` permission to delete, deactivate, or activate any other user who also has `gym=None`. This occurs due to a logic error in the `None != None` comparison edge case. **Recommendations** Update wger to a version where the `is same gym()` helper is correctly implemented in `wger/core/views/user.py` to replace raw integer comparisons.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.78 **Description** An allowlist bypass exists in shell command execution. Attackers can execute restricted commands by utilizing the built-in `-exec`, `-execdir`, and `-delete` actions of the `find` command. This allows for reading blocked files, deleting files, or executing binaries not present on the allowlist by bypassing shell metacharacter filters. **Recommendations** Update PraisonAI to version 4.6.78 or later.