CVE-2026-57140 PraisonAI AgentOS exposes unauthenticated agent listing and invocation

PraisonAI is a multi-agent teams system. From 1.6.0 until 1.7.2, AgentOS in src/praisonai-ts/src/os/agentos.ts uses the 0.0.0.0 default from src/praisonai-ts/src/os/config.ts and registers GET /api/agents and POST /api/chat without authentication middleware. A remote caller who can reach the...

SUSE-SU-2026:23782-1 Security update for kronosnet

This update for kronosnet fixes the following issues: - CVE-2026-15811: improper sanitization of sensitive memory locations following cryptographic configuration adjustments can lead to potential exposure of encryption keys bsc1271923. - CVE-2026-15812: improper verification of packet origins...

OPENSUSE-SU-2026:21851-1 Security update for kronosnet

This update for kronosnet fixes the following issues: - CVE-2026-15811: improper sanitization of sensitive memory locations following cryptographic configuration adjustments can lead to potential exposure of encryption keys bsc1271923. - CVE-2026-15812: improper verification of packet origins...

SUSE-SU-2026:23792-1 Security update for kronosnet

This update for kronosnet fixes the following issues: - CVE-2026-15811: improper sanitization of sensitive memory locations following cryptographic configuration adjustments can lead to potential exposure of encryption keys bsc1271923. - CVE-2026-15812: improper verification of packet origins...

CVE-2026-15758

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...

CVE-2026-86701

Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's Android device may exploit the affected component via an Intent, potentially allowing the malicious application to obtain...

CVE-2026-86701

CVE-2026-86701 affects the Android application ManabiPocket for Parents , which contains an improper access control vulnerability in one of its components. A malicious application installed on the same device can exploit the affected component via an Intent , potentially allowing it to obtain sen...

CVE-2026-81320 Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

CVE-2026-15758

The 3D FlipBook WordPress plugin (PDF Embedder, Flipbook Viewer, Image Gallery) is vulnerable to sensitive information exposure in all versions up to and including 1.16.20 . Unauthenticated attackers can exploit the 'id' parameter to extract the full metadata payload of password-protected flipboo...

CVE-2026-15758 3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...

CVE-2026-15758 3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...

EUVD-2026-78272

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...

CVE-2026-91774 Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

CVE-2026-91774 Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

CVE-2026-91773 Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames...

EUVD-2026-78249

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames...

SUSE CVE-2026-88059

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering SSR and hydration u...

SUSE CVE-2026-90557

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sgloadplayerunit when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a...

EUVD-2026-78207

GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text,...

EUVD-2026-78159

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...