CVE-2026-110746

A local privilege escalation vulnerability exists in TotalAV that allows an unprivileged local user to execute arbitrary code as NT AUTHORITYSYSTEM . The root cause is the ability for an attacker to forge the gRPC IPC authentication token by loading IPC.dll and abusing the SYSTEM service within t...

EUVD-2026-102075

A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM...

CVE-2026-110936

A vulnerability exists in Siemens Software Center (all versions

EUVD-2026-102072

A vulnerability has been identified in Siemens Software Center All versions. The affected application loads dynamic-link libraries DLLs from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches,...

CVE-2026-110936

A vulnerability has been identified in Siemens Software Center All versions V4.0.9.8. The affected application loads dynamic-link libraries DLLs from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application...

CVE-2026-84659

A flaw was found in the Jenkins Script Security Plugin. This vulnerability allows an attacker to bypass security restrictions by disabling the global script sandbox. By exploiting a missing permission check through Stapler data binding, an attacker can execute arbitrary code, potentially...

libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT8BITABGR output format and a specific stride value, leading to a heap-base...

CVE-2026-79830

A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution...

CVE-2026-79831

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution...

CVE-2026-79831 HPE NonStop Posix User Threads - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution...

CVE-2026-79831 HPE NonStop Posix User Threads - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution...

CVE-2026-79831

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution . The vulnerability affects the Posix User Threads component, specifically version T1280 - T1280L02^ACG and earlier . HPE has released a fix in version T1280L02^ACH (L24.08 onwards), which does not require...

EUVD-2026-102002

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution...

PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

SummaryThe plugin manager loads and executes arbitrary .py files from .praisonai/plugins/ directories both project-level and user home via importlib.util.specfromfilelocation + execmodule with zero code signing, integrity verification, or sandboxing. Any attacker who can write a file to the plugi...

PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

SummaryAn unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed. DetailsThe vulnerability is located in the workflow structured output resolution logic.File:...

PYSEC-2026-4271 PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

Summary The plugin manager loads and executes arbitrary .py files from .praisonai/plugins/ directories both project-level and user home via importlib.util.specfromfilelocation + execmodule with zero code signing, integrity verification, or sandboxing. Any attacker who can write a file to the...

PYSEC-2026-4266 PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

Summary CodeAgent.executepython executes LLM-generated Python code in a subprocess with the complete parent-process environment os.environ.copy, zero AST validation, zero import restrictions, and no sandbox enforcement — even when CodeConfigsandbox=True is explicitly set. This allows an attacker...

PYSEC-2026-4267 PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

Summary An unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed. Details The vulnerability is located in the workflow structured output resolution logic. File:...

PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

SummaryThe deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile value via CLI argument, configuration, or upstream API can...

CVE-2026-79830 HPE NonStop Kernel Level Thread Model Lib - Stack buffer overflow vulnerability

A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution...