CVE-2026-86359

Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-86359

Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2

A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and...

Acronis Backup Incorrect Default Permissions Vulnerability

Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation...

CVE-2026-86359: Incorrect Default Permissions

Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

EUVD-2026-79945

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

CVE-2026-54688 mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, weburlread passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed in src/url-reader.ts runs only when MCPHTTPHARDEN is enable...

CVE-2026-54688 mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, weburlread passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed in src/url-reader.ts runs only when MCPHTTPHARDEN is enable...

CVE-2026-59160

@yeger/turbo-graph (an npm package in the Yeger monorepo) prior to version 2.8.9 exposes an embedded Next.js server on all network interfaces (0.0.0.0:29312 by default) due to a missing hostname argument in .listen() at packages/turbo-graph/src/index.ts:44. The /api/run GET handler (packages/turb...

EUVD-2026-78575

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see ...

CVE-2026-57147

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonaiplatform/services/authservice.py assigns the public dev-secret-change-me value to JWTSECRET when PLATFORMJWTSECRET is unset, and its production guard does not run when PLATFORMENV is also unset because that setting defaults to dev....

CVE-2026-52824 Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APPSECRET to the public value changethistosomethingunique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony uses it as kernel.secret. An unauthenticated...

CVE-2026-57147 praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonaiplatform/services/authservice.py assigns the public dev-secret-change-me value to JWTSECRET when PLATFORMJWTSECRET is unset, and its production guard does not run when PLATFORMENV is also unset because that setting defaults to dev....

EUVD-2026-78397

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonaiplatform/services/authservice.py assigns the public dev-secret-change-me value to JWTSECRET when PLATFORMJWTSECRET is unset, and its production guard does not run when PLATFORMENV is also unset because that setting defaults to dev....

CVE-2026-57147 praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonaiplatform/services/authservice.py assigns the public dev-secret-change-me value to JWTSECRET when PLATFORMJWTSECRET is unset, and its production guard does not run when PLATFORMENV is also unset because that setting defaults to dev....

CVE-2026-57147

praisonai-platform (PyPI), the platform layer of the PraisonAI multi-agent system, defaults its JWT signing key to the public literal dev-secret-change-me when PLATFORM_JWT_SECRET is unset. The production guard intended to catch this misconfiguration is ineffective because PLATFORM_ENV defaults t...

CVE-2026-57140 PraisonAI AgentOS exposes unauthenticated agent listing and invocation

PraisonAI is a multi-agent teams system. From 1.6.0 until 1.7.2, AgentOS in src/praisonai-ts/src/os/agentos.ts uses the 0.0.0.0 default from src/praisonai-ts/src/os/config.ts and registers GET /api/agents and POST /api/chat without authentication middleware. A remote caller who can reach the...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

[SECURITY] Fedora 43 Update: perl-Data-Entropy-0.010-1.fc43

This module maintains a concept of a current selection of entropy source. Algorithms that require entropy, such as those in Data::Entropy::Algorithms, can use the source nominated by this module, avoiding the need for entropy source objects to be explicitly passed around. This is convenient becau...

PT-2026-92025

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see ...