CVE-2026-57137: Protection Mechanism Failure

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that...

ROS-20260915-73-0049

The vulnerability of the Autofill component in Google Chrome and Microsoft Edge relates to insufficient validation of entered data. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2026-91957: Use After Free

FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference...

PT-2026-92080

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0 Description A denial-of-service issue exists in the URBDRC control-transfer request path. The software fails to validate the OutputBufferSize variable before forwarding it to the libusb backend. A malicious RDP...

ROS-20260915-73-0119

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

Ubuntu 26.04 LTS : dracut vulnerability (USN-8758-1)

The remote Ubuntu 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8758-1 advisory. It was discovered that dracut did not properly shell-quote messages written by the die function to the emergency hook directory. An attacker on the adjacent netwo...

ROS-20260915-73-0138

The vulnerability of the Ozone component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260915-73-0195

The vulnerability of the BrowserTag component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

ROS-20260915-73-0151

The vulnerability of the Views component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

ROS-20260915-73-0010

The vulnerability in Chromium is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

CVE-2026-92030: Protection Mechanism Failure

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

CVE-2026-92002: Insufficient Logging

Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User-setupRedis returns false when Redis cannot be reached. The vulnerable shouldLog logic on...

ROS-20260915-73-0071

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260915-73-0155

The vulnerability of the Downloads component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

PT-2026-92097

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.6.0 Description An API token scope bypass exists in task read endpoints because the authorization process does not inspect query string parameters. An attacker with limited token scopes can utilize the expand...

PT-2026-97293

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.19 through 11.0.25 Apache Tomcat versions 10.1.53 through 10.1.59 Apache Tomcat versions 9.0.116 through 9.0.121 Description An incomplete cleanup issue allows a malformed request to potentially cause a request from...

Alsa-lib Heap Buffer Overflow DoS

The vulnerability of the sndctlasciielemidparse function in the library for interacting with kernel audio drivers from the Alsa-lib library is related to a single-shift error. Exploiting this vulnerability could allow an attacker to cause a service failure...

Net-SNMP SMUX Buffer Overflow DoS

The vulnerability of the smuxaccept function in the SMUX software module for SNMP protocol implementation and deployment is related to simultaneous access to a remote resource without a timeout mechanism. Exploiting this vulnerability could allow a malicious actor to cause service failure...

USN-8758-1: dracut vulnerability

It was discovered that dracut did not properly shell-quote messages written by the die function to the emergency hook directory. An attacker on the adjacent network controlling a rogue DHCP server could use this issue to inject commands that execute as root during boot-failure handling...

rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure

A flaw was found in rsync. This vulnerability allows a remote attacker to bypass hostname-based access control rules. By inducing DNS resolution failures, the rsync daemon incorrectly skips deny rules, granting unauthorized access to restricted module file trees...