CVE-2026-91786

CVE-2026-91786 is an out-of-bounds read in GNOME Shell that occurs when processing icons from a remote search provider via D-Bus . The root cause is a missing validation of the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider can su...

CVE-2026-91786 Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size

A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon...

CVE-2026-91786

A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon...

CVE-2026-91786 Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size

A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon...

EUVD-2026-78417

A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon...

CVE-2026-91786

A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon...

CVE-2026-57133 PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to childprocess.exec. A string that starts...

CVE-2026-57133

CVE-2026-57133 affects the PraisonAI npm package (praisonai) versions 1.5.1 through 1.7.1 . The shell() helper in utility-tools.ts validates only the first whitespace-delimited token against a read-only command allowlist, then passes the full string to child_process.exec(). Because exec() runs th...

CVE-2026-57133 PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to childprocess.exec. A string that starts...

EUVD-2026-78392

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to childprocess.exec. A string that starts...

CVE-2026-57133 PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to childprocess.exec. A string that starts...

CVE-2026-57136

PraisonAI (npm praisonai), a multi-agent teams system, contains a sandbox allowlist bypass in CommandValidator within sandbox-executor.ts. The validator checks only the first whitespace-delimited token against allowedCommands, while SandboxExecutor passes the entire command string to sh -c. An at...

CVE-2026-57136 PraisonAI SandboxExecutor allowedCommands bypass via shell chaining

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command...

EUVD-2026-78421

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command...

CVE-2026-57136 PraisonAI SandboxExecutor allowedCommands bypass via shell chaining

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command...

CVE-2026-57136 PraisonAI SandboxExecutor allowedCommands bypass via shell chaining

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command...

CVE-2026-91838

A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped...

Security Bulletin: Multiple security vulnerabilities found and remediated in IBM webMethods Managed File Transfer

Summary IBM webMethods Managed File Transfer is vulnerable to multiple issues in third-party JavaScript libraries used by its web user interface. The Axios HTTP client is susceptible to prototype pollution attacks that could allow an attacker to intercept or hijack HTTP transport, and to stream...

cowrie v3.0.14

.. SPDX-FileCopyrightText: 2014 Upi Tamminen [email protected] .. SPDX-FileCopyrightText: 2014-2025 Michel Oosterhof [email protected] .. .. SPDX-License-Identifier: BSD-3-Clause Cowrie What is Cowrie Cowrie is a medium to high interaction SSH and Telnet honeypot designed to log brute...

Linux Distros Unpatched Vulnerability : CVE-2026-91786

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions...