33079 matches found
CVE-2026-47407 PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under /api/v1/workspaces/workspaceid/... and protects them with a requireworkspacememberworkspaceid FastAPI dependency. The dependency only checks tha...
CVE-2026-28313
creationtimestamp| type| source ---|---|--- 2026-07-21 16:36:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6ajcpvl42q 2026-07-26 17:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrkuldwnwd2s...
CVE-2026-28304
creationtimestamp| type| source ---|---|--- 2026-07-21 16:28:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6a2yshpb2v 2026-07-26 18:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrkzmbga6l23...
EUVD-2026-46303
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls...
libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack
An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel value...
EUVD-2026-46278
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spidertools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe...
EUVD-2026-46265
A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function...
CVE-2026-16403
Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...
UBUNTU-CVE-2026-16403
Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...
SUSE CVE-2026-44508
REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43618. Reason: This candidate is a duplicate of CVE-2026-43618. Notes: All CVE users should reference CVE-2026-43618 instead of this candidate...
SUSE CVE-2026-53374
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpubocreatekernel does not zero-initialize the buffer, when a single PTE is written the TLB may speculativel...
SUSE CVE-2026-53375
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that only one of lo/hi is valid, the patching could result in a bad address written to in FW...
SUSE CVE-2026-63922
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6parsetlv caches skbnetworkheaderskb in nh while walking IPv6 TLVs. ipv6desthao may call pskbexpandhead for a cloned skb, which can move the skb head and invalidate the cached...
SUSE CVE-2026-64042
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Check BAR resources before exporting a DMABUF A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved before exporting. Otherwise, it's...
SUSE CVE-2026-64115
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...
SUSE CVE-2026-64117
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb-cb ieee80211invokefastrx reads RX status through IEEE80211SKBRXCBskb, which aliases the same skb-cb storage that ieee80211rxmeshdata reuses as IEEE80211TXINFO. In the...
Security update for go1.25-openssl
This update for go1.25-openssl fixes the following issues Update to version go1.25.12 bsc1244485. CVE-2026-25679: net/url: reject IPv6 literal not at start of host bsc1259264. CVE-2026-27139: os: FileInfo can escape from a Root bsc1259268. CVE-2026-27142: html/template: URLs in meta content...
Security update for wget
This update for wget fixes the following issues: CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread bsc1271033. CVE-2026-58470:...
