35892 matches found
GHSA-F44V-7QGW-9GH9 PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into /.praison/cache/templates/github//// without...
GHSA-47QP-HQVX-6R3F
creationtimestamp| type| source ---|---|--- 2026-06-18 13:41:25+00:00| seen| https://gist.github.com/alon710/adfa7aacc3b80320d7d38d47591141d2 2026-06-18 14:01:20+00:00| seen| https://gist.github.com/alon710/1009ff77420ca2d3dfc49ca0eb601808...
CVE-2026-55229
creationtimestamp| type| source ---|---|--- 2026-06-18 13:04:54+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-2mrg-35hw-x3x9 2026-07-11 13:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqeptauyzd2r 2026-07-13 23:37:05+00:00| seen|...
CVE-2026-55832
creationtimestamp| type| source ---|---|--- 2026-06-18 07:13:10+00:00| published-proof-of-concept| https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5...
CVE-2026-54527
creationtimestamp| type| source ---|---|--- 2026-06-18 07:12:58+00:00| published-proof-of-concept| https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5 2026-07-08 22:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq64oaqtfb24 2026-07-09...
CVE-2026-55185
creationtimestamp| type| source ---|---|--- 2026-06-18 03:23:33+00:00| published-proof-of-concept| https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r...
CVE-2026-46699: Improper Access Control
conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub...
PT-2026-53135
Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into /.praison/cache/templates/github//// without...
PT-2026-61767
Name of the Vulnerable Software and Affected Versions PraisonAI versions 2.6.0 through 4.6.57 Description The template loader fails to properly normalize or validate GitHub template URIs, allowing the path and ref variables to be stored verbatim. This leads to a path traversal issue where a craft...
PT-2026-50794
Name of the Vulnerable Software and Affected Versions conda-smithy versions prior to 3.61.0 Description conda-smithy is a tool that combines a conda recipe with configurations to build using freely hosted CI services into a single repository. A flaw in the conda-forge automated webservices allows...
CVE-2026-12567
The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...
CVE-2026-12567
The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...
CVE-2026-12567
CVE-2026-12567 affects the github_workflows module. It constructs local directory paths from user-controlled repository names without validating for symlinks, enabling a local attacker sharing the scan directory to plant a symlink at a predictable output path. This can cause workflow data to be w...
CVE-2026-12567 Symlink-following arbitrary write via github_workflows module
The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...
CVE-2026-12567 Symlink-following arbitrary write via github_workflows module
The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...
MAL-2026-6083 Malicious code in syncagents (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aebf468a6887fb09002d4ae4aceab77e347034b389b02e252844f7d0d81fabd6 The PyPI package 'syncagents' impersonates the legitimate PyPI package 'agentsync' — the README, PKG-INFO, CHANGELOG, and project URLs all point at...
GHSA-376J-8F52-GP2X vulnerabilities
Vulnerabilities for packages: openjdk...
Beyond the benchmark: Advancing security at AI speed
In this article 1. From the lab into the pipeline 2. This month’s set of discoveries 3. Beyond the headline: What the engineering work taught us 4. Where we go next 5. Defense at AI speed 6. Learn more Every vulnerability has two clocks running. One belongs to the defender racing to find it; the...