PT-2026-59623

A path traversal and arbitrary file write vulnerability exist in the embedded get function in ' main .py' in PyMuPDF version, 1.26.5...

PT-2026-58979

Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team, add the current user as teamlead, and bind the target...

CVE-2026-51821

SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /user/getUserLogin endpoint...

PT-2026-60079

Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team, add the current user as teamlead, and bind the target...

PT-2026-59686

A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made...

PT-2026-59190

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the get os path function within jupyter server/services/contents/fileio.py. The check uses startswithroot without appending a trailing path separator, allowing sibling...

PT-2026-63315

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Three code paths bypass the existing Server-Side Request Forgery SSRF protections by using raw http.Get instead of the validated hostmatcher.NewDialContext dialer. This allows an attacker to ma...

PT-2026-59146

Summary A Server-Side Request Forgery SSRF vulnerability in get image info allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services e.g., AWS 169.254.169.254. This is a blind SSRF with confirmed internal port scanni...

PT-2026-59617

Description: The EventManager module in pyload manages a list of Client instances for subscribing to events. The addition of each unique uuid from the get events API causes the creation of a Client instance that gets appended to the clients list. Although there is a clean method available in the...

PT-2026-59682

A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get tokenizer of the file python/sglang/srt/utils/hf transformers utils.py of the component HuggingFace Transformer Handler. The manipulation results in deserialization. The attack can be executed remotely. A...

PT-2026-59014

A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function get bytes from web url of the file src/agentscope/ utils/ common.py of the component Internal Service. Performing a manipulation results in server-side request forgery. It is possible to initiate...

PT-2026-59700

Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get resource method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using...

Server-side Request Forgery (SSRF)

Overview AstrBot is a 易上手的多平台 LLM 聊天机器人及开发框架 Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the getonlineplugins function in the marketlist Endpoint when processing the customregistry argument. An attacker can induce the server to make arbitrary HTTP...

CVE-2026-15500 AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery

A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Affected by this vulnerability is the function getonlineplugins of the file astrbot/dashboard/routes/plugin.py of the component marketlist Endpoint. Executing a manipulation of the argument customregistry can lead to server-side...

CVE-2026-15500

AstrBotDevs AstrBot (

CVE-2026-15500

A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Affected by this vulnerability is the function getonlineplugins of the file astrbot/dashboard/routes/plugin.py of the component marketlist Endpoint. Executing a manipulation of the argument customregistry can lead to server-side...

CVE-2026-15500 AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery

A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Affected by this vulnerability is the function getonlineplugins of the file astrbot/dashboard/routes/plugin.py of the component marketlist Endpoint. Executing a manipulation of the argument customregistry can lead to server-side...

PT-2026-57545

A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Affected by this vulnerability is the function get online plugins of the file astrbot/dashboard/routes/plugin.py of the component market list Endpoint. Executing a manipulation of the argument custom registry can lead to...

GHSA-G3PQ-3VVX-36W6 Duplicate Advisory: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6wjp-v33h-5cvq. This link is maintained to preserve external references. Original Description PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key...

Information Exposure

Overview praisonai is a PraisonAI TypeScript AI Agents Framework - Node.js, npm, and Javascript AI Agents Framework Affected versions of this package are vulnerable to Information Exposure due to insecure default configuration that binds to all interfaces without requiring an API key and allows...