CVE-2026-57138

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function inside withsandbox and relies on a small source-code blocklist plus shadowed process and require properties. Code can use...

CVE-2026-57141

PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function and withsandbox, while a regular-expression blocklist can be bypassed with Function'return this' to recover the glob...

CVE-2026-57138 PraisonAI codeMode sandbox escape via Function constructor

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function inside withsandbox and relies on a small source-code blocklist plus shadowed process and require properties. Code can use...

CVE-2026-57138 PraisonAI codeMode sandbox escape via Function constructor

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function inside withsandbox and relies on a small source-code blocklist plus shadowed process and require properties. Code can use...

CVE-2026-57138 PraisonAI codeMode sandbox escape via Function constructor

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function inside withsandbox and relies on a small source-code blocklist plus shadowed process and require properties. Code can use...

CVE-2026-57138

CVE-2026-57138 is a sandbox escape in the npm package praisonai (versions ≥ 1.4.0,

EUVD-2026-78423

PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function and withsandbox, while a regular-expression blocklist can be bypassed with Function'return this' to recover the glob...

CVE-2026-57141

PraisonAI (praisonai npm, a TypeScript multi-agent AI framework) is vulnerable to remote code execution via its codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts. The tool executes LLM-generated JavaScript using new Function() with a with(sandbox) pattern guarded by a regex blockl...

CVE-2026-57141 PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool

PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function and withsandbox, while a regular-expression blocklist can be bypassed with Function'return this' to recover the glob...

CVE-2026-57141 PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool

PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function and withsandbox, while a regular-expression blocklist can be bypassed with Function'return this' to recover the glob...

postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein or levenshteinlessequal SQL functions. This allows the user to execute arbitrary code as the operating system user running th...

CVE-2026-66046

A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts function, causing excessive CPU consumption and a denial of service Mitigation To mitigate, avoid parsing...

CVE-2026-17495

A flaw was found in moment, a JavaScript library for handling dates. A remote attacker could exploit this vulnerability by providing a specially crafted input to the moment.locale function. This input, which is not a standard text string, can bypass security checks designed to prevent unauthorize...

CVE-2026-17495 moment vulnerable to Path Traversal via crafted non-string locale name

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

CVE-2026-91002 stamparm maltrail Blacklist Endpoint httpd.py _blacklist missing authentication

A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function blacklist of the file core/httpd.py of the component Blacklist Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been...

CVE-2026-91001 D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow

A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddnsasp of the file /ddns.asp of the component DDNS Configuration. Performing a manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiate...

CVE-2026-90881 D-Link DIR-882 CGI Binary dllog.cgi main information disclosure

A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the...

CVE-2026-90858

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the function sessionstart of the file adminappview.php. Executing a manipulation of the argument adminmail can lead to authorization bypass. The...

CVE-2026-90852

luben zstd-jni (a Java binding for the Zstandard compression library) is affected by a use-after-free vulnerability in the Dictionary Sharing component, specifically in the function ZstdCompressCtx.loadDict within ZstdCompressCtx.java. Affected versions are up to 1.5.7-13 . The vulnerability can ...

PT-2026-92177

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...