CVE-2026-55190

The open-source platform Event Schedule versions 1.0.0 and prior is vulnerable to Server-Side Request Forgery (SSRF) . The flaw exists in the App luss iejsUrlUtils::isUrlSafe() function, which fails to properly validate user-supplied import URLs. Attackers can bypass the SSRF guard using brackete...

CVE-2026-57146

The PraisonAI multi-agent system (versions 4.5.115 to 4.6.58 ) contains an incomplete authentication fix in the A2U Agent-to-User event stream server . When using the documented CLI entrypoint (praisonai serve a2u), the system fails to install API-key middleware or generate a default token. Inste...

CVE-2026-57146 PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without...

CVE-2026-57146 PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without...

EUVD-2026-108900

PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate with watsonx Assistant Cartridge version 5.4.4 Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION: brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time...

CVE-2026-113500 LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose commen...

CVE-2026-113500 LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose commen...

CVE-2026-113500

The LiteSpeed Cache WordPress plugin (versions before 7.9.2 ) is vulnerable to an unauthenticated stored XSS vulnerability. The issue stems from an HTML optimization routine that fails to limit its scope to stylesheet content, potentially deleting the markup that closes attributes in the rendered...

PT-2026-121873

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imx mu isr imx mu shutdown imx mu xcr rmwpriv, IMX MU RCR, 0, IMX MU xCR RIEnpriv-dcfg-type, cp-idx; imx mu...

PT-2026-121942

Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, AppUtilsUrlUtils::isUrlSafe is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when the...

PT-2026-121909

In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf event open currently gates perf allow kernel only on !attr.exclude kernel. However, users can still request kernel callchain collection with attr.exclude...

PT-2026-122234

Name of the Vulnerable Software and Affected Versions GraphQL Scalars versions 1.24.1 through 2.0.0 Description The GraphQLPhoneNumber scalar in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers. This causes exponential backtracking when a value contains a sequence of digits...

PT-2026-121862

In the Linux kernel, the following vulnerability has been resolved: firmware: arm scmi: Validate BASE ERROR EVENT payload size BASE ERROR EVENT carries a variable number of message reports, with the count encoded in error status. The notification parser used that count without checking whether th...

PT-2026-122430

Summary Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's url.Values.Get returns only the first value...

EUVD-2026-107552

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse...

EUVD-2026-107555

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse...

npm: DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

npm: DOMPurify INPLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed incomplete fix for GHSA-p98j-92pf-mc4p vulnerability discovered by ? in WordPress npm dompurify versions = 3.4.16...

GHSA-MRV2-3PQR-J5JR DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

Summary The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an INPLACE hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay...

DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

Summary The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an INPLACE hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay...