PYSEC-2026-2930 PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

Summary PraisonAI Platform's workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to another workspace by supplying the victim object's global UUID. The affected pattern...

PYSEC-2026-2671 Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing

Summary The fileID field from Manifest.db a SQLite database inside iOS backups, generated by the device is used directly in filesystem path construction without validation. This affects two commands through a shared code path: - mvt-ios decrypt-backup decrypt.py: fileid is used to construct both...

PYSEC-2026-2726 Open WebUI has Broken Access Control for Completions API

Summary Any user X can continue the conversation of any other user Y, as long as the Chat ID of Y is known. User X does not even need to be an admin to do so. Details A user just needs to use the API endpoint: /api/chat/completions with their own API key generated in OWUI and the Chat ID of anoth...

CVE-2026-59216

creationtimestamp| type| source ---|---|--- 2026-07-13 15:09:01+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjxwa6pxg2c 2026-07-16 08:01:21+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrgb6tvx2g 2026-07-24 18:35:08+00:00| published-proof-of-concept|...

PYSEC-2026-2943 PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling

Summary The MultiAgentLedger and MultiAgentMonitor components in the provided code exhibit vulnerabilities that can lead to context leakage and arbitrary file operations. Specifically: 1. Memory State Leakage via Agent ID Collision: The MultiAgentLedger uses a dictionary to store ledgers by agent...

PYSEC-2026-2693 Open WebUI has unauthorized deletion of knowledge files

Summary An access control check is missing when deleting a file from a knowledge base. The only check being done is that the user has write access to the knowledge base or is admin, but NOT that the file actually belongs to this knowledge base. It is thus possible to delete arbitrary files from...

MINI-259P-JVVV-H9G4

Bulletin has no description...

MINI-RCVQ-MPWH-4MGC

Bulletin has no description...

MINI-JHCP-Q7JH-GW34

Bulletin has no description...

MINI-CCWW-C94W-PF5J

Bulletin has no description...

MINI-8Q4M-9J29-3VW7

Bulletin has no description...

MINI-6CMX-W644-WV9J

Bulletin has no description...

MINI-4PQ4-983R-QRV8

Bulletin has no description...

CVE-2026-61983

creationtimestamp| type| source ---|---|--- 2026-07-13 13:33:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjskvppzu2i 2026-07-13 15:43:10+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqjztca5rv2j 2026-07-13 19:48:17+00:00| seen|...

MINI-6J88-F33P-PQ4C

Bulletin has no description...

MINI-37CF-HXPW-44G9

Bulletin has no description...

MINI-6RMX-2MMX-FR9Q

Bulletin has no description...

CVE-2026-61958

creationtimestamp| type| source ---|---|--- 2026-07-13 11:37:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjm4cslsu2y 2026-07-13 11:37:42+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqjm4elph22m 2026-07-14 02:25:56+00:00| seen|...

CVE-2026-57729

creationtimestamp| type| source ---|---|--- 2026-07-13 11:19:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjl4gej3426 2026-07-16 07:56:57+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqr6f2d2k2y...

CVE-2026-57702

creationtimestamp| type| source ---|---|--- 2026-07-13 11:16:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjkvqdtb32w 2026-07-14 01:45:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql3hzwcvj2w 2026-07-14 01:45:28+00:00| seen|...