262243 matches found
Incorrect Authorization
Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...
ROOT-APP-GOBINARY-CVE-2026-32285 CVE-2026-32285 in rootio-github.com/buger/jsonparser - Patched by Root
Root has patched CVE-2026-32285 in the rootio-github.com/buger/jsonparser package for Root:Go. Multiple fixed versions available...
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage Summary PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.gettools: python ctx = setupdynamiccontext agent = Agent instructions="You are a data analyst.",...
GHSA-J7QX-P75M-WP7G PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage Summary PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.gettools: python ctx = setupdynamiccontext agent = Agent instructions="You are a data analyst.",...
GHSA-8579-RGG5-PH2M PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
DiscordApproval accepts unrelated channel messages as dangerous-tool approvals Summary praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. The decision is...
CVE-2026-42487 x86 HVM I/O port list traversal
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model via XENDOMCTLioportmapping, and hence the linked list used may changed at any time. Traversal of those lists while handling guest I/O port accesses therefore needs...
CVE-2026-11717
creationtimestamp| type| source ---|---|--- 2026-06-18 13:18:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokw33ts7e2e 2026-06-18 15:30:22+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mol5hf2ood27 2026-06-18 15:30:29+00:00| seen|...
CVE-2026-11718
creationtimestamp| type| source ---|---|--- 2026-06-18 13:13:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokvs5esly2y 2026-06-18 14:00:17+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mokygbvzep2c 2026-06-18 14:00:30+00:00| seen|...
Cross-site Scripting (XSS)
Overview tinacms is a headless content management system with support for Markdown, MDX, JSON, YAML, and more. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the url field in Slate link or image nodes during rich-text rendering and parsing. An attacker can execut...
EUVD-2026-37166
OpenClaw: Host environment sanitizer missed two Node.js control variables...
ROOT-APP-NPM-CVE-2018-16469 CVE-2018-16469 in @rootio/merge - Patched by Root
Root has patched CVE-2018-16469 in the @rootio/merge package for Root:npm. Multiple fixed versions available...
CVE-2026-44942 libzypp .repo files can have an optional path which can lead to path traversal attacks
A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content...
ROOT-APP-MAVEN-CVE-2025-22235 CVE-2025-22235 in io.root.org.springframework.boot:spring-boot - Patched by Root
Root has patched CVE-2025-22235 in the io.root.org.springframework.boot:spring-boot package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2023-20883 CVE-2023-20883 in io.root.org.springframework.boot:spring-boot-autoconfigure - Patched by Root
Root has patched CVE-2023-20883 in the io.root.org.springframework.boot:spring-boot-autoconfigure package for Root:Maven. Multiple fixed versions available...
CVE-2026-42507
A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...
CVE-2026-55742
creationtimestamp| type| source ---|---|--- 2026-06-18 08:48:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokgyupp3y2v...
CVE-2026-55744
creationtimestamp| type| source ---|---|--- 2026-06-18 08:38:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokggxn5qs27...
GHSA-WXV8-W48J-R2F4 vulnerabilities
Vulnerabilities for packages: python...
CVE-2026-55741
Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action 'a=update' processes POST data via cotconfigupdateoptions without calling cotcheckxg to validate...