20537 matches found
PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
Summary The email search tool in src/praisonai-agents/praisonaiagents/tools/emailtools.py constructs IMAP SEARCH commands by interpolating LLM-controlled parameters fromaddr, subject, query directly into IMAP protocol strings using f-string formatting with double-quote delimiters. An attacker who...
GHSA-C969-5X3P-VQ3V PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
Summary The email search tool in src/praisonai-agents/praisonaiagents/tools/emailtools.py constructs IMAP SEARCH commands by interpolating LLM-controlled parameters fromaddr, subject, query directly into IMAP protocol strings using f-string formatting with double-quote delimiters. An attacker who...
CVE-2026-42487
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model via XENDOMCTLioportmapping, and hence the linked list used may changed at any time. Traversal of those lists while handling guest I/O port accesses therefore needs...
ALPINE-CVE-2026-42487
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model via XENDOMCTLioportmapping, and hence the linked list used may changed at any time. Traversal of those lists while handling guest I/O port accesses therefore needs...
CVE-2026-42487
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model via XENDOMCTLioportmapping, and hence the linked list used may changed at any time. Traversal of those lists while handling guest I/O port accesses therefore needs...
CVE-2026-42487 x86 HVM I/O port list traversal
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model via XENDOMCTLioportmapping, and hence the linked list used may changed at any time. Traversal of those lists while handling guest I/O port accesses therefore needs...
EUVD-2026-37888
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model via XENDOMCTLioportmapping, and hence the linked list used may changed at any time. Traversal of those lists while handling guest I/O port accesses therefore needs...
CVE-2026-42487
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model via XENDOMCTLioportmapping, and hence the linked list used may changed at any time. Traversal of those lists while handling guest I/O port accesses therefore needs...
Integer overflow in tract-nnef NNEF tensor parser leads to out-of-bounds read on model load
tractnnef::tensors::readtensor builds a tensor shape from attacker-controlled 32-bit dimensions and computes both the element count productshape and the byte allocation productshape sizeofdt with unchecked usize arithmetic. In release builds no overflow-checks both products wrap modulo 2^64. A...
MINI-777W-PHRM-H39P
Bulletin has no description...
MINI-498V-4572-P6XH
Bulletin has no description...
Scripting the disassembler: Local agentic reverse engineering through vbdec’s live COM object model
Analysis tools do not need AI built in to support agentic workflows; they simply need to expose their data through an external scripting interface. Even traditional graphical user interface GUI applications can be made AI-accessible by publishing their internal object models, allowing agents to...
MINI-3V64-X455-GF8Q
Bulletin has no description...
MINI-PC2F-7R2X-XPWV
Bulletin has no description...
MINI-W979-763G-Q64J
Bulletin has no description...
MINI-934W-4MGC-X6H6
Bulletin has no description...
MINI-843V-PC77-W377
Bulletin has no description...
MINI-WX78-HX3G-MVW3
Bulletin has no description...
Analyzing Defensive Misdirection against Model-Guided Automated Attacks on Agentic AI Systems
Agentic AI systems increasingly rely on language-model components to interpret instructions, process external data, invoke tools, and coordinate with other agents. These capabilities make prompt-injection and jailbreak attacks more consequential, especially as attackers adopt model-guided...
PT-2026-50702
Name of the Vulnerable Software and Affected Versions Node.js version 22 Node.js version 24 Node.js version 26 Description A flaw in the Permission Model enforcement allows a bypass through path misvalidation in the process.report.writeReport function. This issue can result in a confidentiality...