489732 matches found
EUVD-2026-108875
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.gettools. The implemented artifact tools do not enforce that the supplied artifactpath is an artifact created by the...
CVE-2026-56834 PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.gettools. The implemented artifact tools do not enforce that the supplied artifactpath is an artifact created by the...
CVE-2026-56833
The PraisonAI multi-agent system (versions 3.8.1 through 4.6.58 ) is vulnerable to a path traversal issue in its Dynamic Context module. The vulnerability exists because the history_search, history_tail, history_get, terminal_tail, terminal_grep, and terminal_commands tools accept run_id and agen...
CVE-2026-56833 PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept runid and agentid arguments from the tool...
CVE-2026-56833 PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept runid and agentid arguments from the tool...
CVE-2026-56833 PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept runid and agentid arguments from the tool...
CVE-2026-112904 Vvveb: Path Traversal in nextRestore() and nextBackup()
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore and nextBackup functions in the backup controller accept a file GET parameter and concatenate it directly to DIRBACKUP without calling...
CVE-2026-112904
The Vvveb CMS (versions 1.0.8.6 and prior) contains a Path Traversal vulnerability in the nextRestore() and nextBackup() functions of the backup controller. The root cause is the direct concatenation of a file GET parameter to DIR_BACKUP without utilizing the sanitizeFileName() function. This all...
EUVD-2026-108691
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore and nextBackup functions in the backup controller accept a file GET parameter and concatenate it directly to DIRBACKUP without calling...
CVE-2026-112904 Vvveb: Path Traversal in nextRestore() and nextBackup()
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore and nextBackup functions in the backup controller accept a file GET parameter and concatenate it directly to DIRBACKUP without calling...
CVE-2026-115724 VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider
VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW...
EUVD-2026-108712
VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW...
CVE-2026-115724 VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider
VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW...
CVE-2026-115724
VLC for Android before version 3.7.2 is vulnerable to a confused-deputy file overwrite vulnerability within the FileUtils.getUri() function. The issue arises because the application trusts content URIs based solely on the com.fsck.k9.attachmentprovider or gmail-ls authorities. A co-installed appl...
Security update for cifs-utils
This update for cifs-utils fixes the following issue: CVE-2026-104715: mount options injection via CIFS credentials-file parsing bsc1284932. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you ca...
SUSE-SU-2026:4897-1 Security update for cifs-utils
This update for cifs-utils fixes the following issue: - CVE-2026-104715: mount options injection via CIFS credentials-file parsing bsc1284932...
CVE-2025-30052
The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. The...
WordPress Depicter — Popup & Slider Builder plugin 4.0.5-4.8.1 - Editor+ Arbitrary File Upload vulnerability
Editor+ Arbitrary File Upload vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Depicter Slider versions 4.0.5-4.8.1...
CVE-2026-98777
A flaw was found in the Linux kernel's Android Binder inter-process communication IPC driver. When an asynchronous transaction supersedes an earlier pending transaction in a frozen process, the kernel frees the outdated transaction without releasing associated file descriptor references. A local...
EUVD-2025-211182
The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. The...