PYSEC-2026-4254 PraisonAI: Shell command allowlist bypass via find -exec built-in action

Summary The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj utility-tools shell chaining and GHSA-vjv9-7m7j-h833 SandboxExecutor chaining can be bypassed via find's built-in -exec action. The fix blocks shell metacharacters ;|& + The ...

PYSEC-2026-4250 PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend

Summary SecurityPolicy in praisonaiagents/sandbox/config.py is a documented configuration data class with fields for allowsubprocess, allowedpaths, blockedpaths, allowedcommands, blockedcommands, allowedimports, and blockedimports. Its strict classmethod is explicitly described as creating "a...

PYSEC-2026-4262 PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass Summary praisonai-platform lets an ordinary workspace member patch owner-created project, issue, and agent records even though the paired delete routes enforce owner/admin authorization. For...

PYSEC-2026-4257 PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization and no Origin can initialize and...

PYSEC-2026-4248 PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked

Summary PraisonAI's opt-in prompt-injection defense enableinjectiondefense only blocks at ThreatLevel.CRITICAL, which requires three or more distinct detector families to match simultaneously. A realistic single- or double-vector prompt injection e.g. "Ignore all previous instructions…" is...

PYSEC-2026-4247 PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

Call API localhost-only authentication bypass via spoofed Host header Summary PraisonAI's patched PRAISONAICALLAUTH=disabled safeguard for the n8n/call agent invocation API can be bypassed with a spoofed Host: 127.0.0.1 header, allowing an unauthenticated network caller to list and invoke...

PYSEC-2026-4265 PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments

Summary PraisonAI gates dangerous tools file writes, deletes, shell/code execution behind an interactive approval prompt. The first approval of a tool is cached for the remainder of the run and silently reused for all later invocations of that tool with arbitrary, unreviewed arguments. Root cause...

PYSEC-2026-4230 Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Summary Langflow's project-scoped MCP transport authenticates the caller for the projectid in the connection URL, but the subsequent resources/read operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scoped MCP endpoint and supply ...

PYSEC-2026-4222 Hydra: Mutable instantiate policy sets allow target blocklist bypass

Summary Hydra's legacy instantiate target blocklists and related execution-policy collections are stored in mutable module-level state. Because locate can resolve attributes on imported objects, a configuration can resolve a mutation method such as .discard, modify the active policy, and then...

wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding

SummaryThe trainerlogin view in wger accepts GET requests and executes djangologin without any CSRF protection, because Django's CsrfViewMiddleware only enforces tokens on unsafe methods POST/PUT/PATCH/DELETE. An attacker can embed a single tag on a malicious page; when an authenticated trainer...

PYSEC-2026-4313 wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

Summary Five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment gym=None can read private admin notes, uploaded documents, gym contracts...

PYSEC-2026-4233 Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass

Summary A vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False. This allows a remote attacker who knows a flow's UUID ...

PYSEC-2026-4240 LangGraph SDK custom auth silently ignores actions= on resource decorators

Impact What kind of vulnerability is it? Who is impacted? langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons. In affected versions, a decorator such as: python...

PYSEC-2026-4206 DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools

DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowedmcptools function returning None instead of a denied result when mcptools is omitted from a user's grant in...

CVE-2021-27289

🐝 CVE-2021-27289: Playback Protection Bypass on Ksix Zigbee devices 📑 Table of Contents Before We Get Serious The Story Behind This CVE Vulnerability Affected Devices Technical Details Attack Scenario Impact Proof of Concept Demo Videos Original Blog Post Researcher Zigbee Basics Background and...

CVE-2026-44084

An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...

CVE-2026-18659

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

CVE-2021-27651

Summary An attacker can bypass all stages of the password reset flow and reset any user's account on Pega infinity. This is done by 1 initiating the password reset flow and typing in the victim email, then 2 forcing the HTTP POST request to update the password through. An attacker could login usi...

CVE-2018-13257

Blackboard Learn CAS Ticket Host Header Spoofing An authentication module within Blackboard Learn is susceptible to HTTP host header spoofing during Central Authentication Service CAS service ticket validation. A CAS service ticket is intended for only a specific service , but Blackboard Learn do...

0-click-RCE-Exploit-for-CVE-2024-10924

CVE-2024-10924 / Auth Bypass 2FA to RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1859061671852909055 This repository contains a proof-of-concept exploit for CVE-2024-10924, an authentication and 2FA bypass vulnerability in the Really Simple Security WordPress plugin tha...