Lucene search
+L

55878 matches found

OSV
OSV
added 2026/06/29 11:50 a.m.8 views

PYSEC-2026-483 PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)

Summary executecode in praisonaiagents/tools/pythontools.py v1.6.37, subprocess sandbox mode can be fully bypassed using print.self to retrieve the real Python builtins module, from which import can be extracted via vars and runtime string construction. This achieves arbitrary OS command executio...

9.9CVSS6.4AI score0.00601EPSS
SaveExploits0References5
OSV
OSV
added 2026/06/29 11:50 a.m.7 views

PYSEC-2026-539 SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker

SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads without authentication...

9.8CVSS7.4AI score0.01534EPSS
SaveExploits1References9
OSV
OSV
added 2026/06/29 11:50 a.m.10 views

PYSEC-2026-537 SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module

SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads without authentication...

9.8CVSS7.4AI score0.01158EPSS
SaveExploits1References8
OSV
OSV
added 2026/06/29 11:50 a.m.8 views

PYSEC-2026-542 smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module

A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution RCE. The vulnerability stems from the localpythonexecutor.py module, which inadequately restricts Python code...

9.9CVSS7.9AI score0.18654EPSS
SaveExploits1References6
OSV
OSV
added 2026/06/29 11:50 a.m.9 views

PYSEC-2026-300 Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL

Summary During a manual source code review, ARIMLABS.AI researchers identified that the browseruse module includes an embedded whitelist functionality to restrict URLs that can be visited. This restriction is enforced during agent initialization. However, it was discovered that these measures can...

9.3CVSS5.8AI score0.00445EPSS
SaveExploits0References7
OSV
OSV
added 2026/06/29 11:14 a.m.9 views

BIT-PYTHON-2026-11972 tarfile opened in streaming mode mishandles EOF

When using the "tarfile" module with a file opened in "streaming mode" mode="r|" the tarfile module did not properly handle EOF, making archive parsing take exponentially longer...

8.2CVSS5.8AI score0.00433EPSS
SaveExploits0References10
OSV
OSV
added 2026/06/29 11:14 a.m.8 views

BIT-PYTHON-MIN-2026-0864 Configuration Injection via Carriage Return (\r) in write() method

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters \r the resulting file could be injected with unexpected keys and values if the attacker controls the written value...

4.1CVSS5.7AI score0.00128EPSS
SaveExploits0References8
OSV
OSV
added 2026/06/29 11:10 a.m.8 views

BIT-LIBPYTHON-2026-11972 tarfile opened in streaming mode mishandles EOF

When using the "tarfile" module with a file opened in "streaming mode" mode="r|" the tarfile module did not properly handle EOF, making archive parsing take exponentially longer...

8.2CVSS5.8AI score0.00433EPSS
SaveExploits0References10
RedHat Linux
RedHat Linux
added 2026/06/29 10:39 a.m.5 views

python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module

A flaw was found in Python's http.cookies module. The Morsel.jsoutput function, responsible for generating JavaScript output for cookies, does not properly neutralize the HTML sequence. This oversight could allow a remote attacker to inject malicious script into a web page, potentially leading to...

6.1CVSS6.4AI score0.00229EPSS
SaveExploits1References8
NVD
NVD
added 2026/06/29 10:16 a.m.11 views

CVE-2026-13555

A vulnerability was found in itsourcecode Online Hotel Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/modusers/controller.php?action=add. The manipulation of the argument Name results in sql injection. The attack can be launched remotely. The exploi...

7.5CVSS0.00412EPSS
SaveExploits0References6
NVD
NVD
added 2026/06/29 10:16 a.m.13 views

CVE-2026-13554

A vulnerability has been found in itsourcecode Online Hotel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/modamenities/controller.php?action=add of the component POST Request Handler. The manipulation of the argument Name leads to cross site...

5.3CVSS0.00443EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/06/29 10:0 a.m.8 views

CVE-2026-13557

A vulnerability was identified in itsourcecode Online Hotel Management System 1.0. This vulnerability affects unknown code of the file /admin/modroom/controller.php?action=add of the component POST Request Handler. Such manipulation of the argument Name leads to cross site scripting. The attack m...

5.3CVSS4.2AI score0.00443EPSS
SaveExploits0References6Affected Software1
RedhatCVE
RedhatCVE
added 2026/06/29 9:41 a.m.11 views

CVE-2026-53302

A flaw was found in the Linux kernel's cryptographic module, specifically within the EIP93 hardware accelerator driver. An error in how the system allocates resources for HMAC Keyed-Hash Message Authentication Code operations can lead to a critical system failure. When certain cryptographic...

5.5CVSS5.8AI score0.00121EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/06/29 9:15 a.m.46 views

CVE-2026-13554 itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting

A vulnerability has been found in itsourcecode Online Hotel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/modamenities/controller.php?action=add of the component POST Request Handler. The manipulation of the argument Name leads to cross site...

5.3CVSS0.00443EPSS
SaveExploits0References6
RedhatCVE
RedhatCVE
added 2026/06/29 8:19 a.m.8 views

CVE-2026-53304

A flaw was found in the Linux kernel's SCSI generic sg module. A local user could bypass the intended size restrictions for the defreservedsize module parameter. By setting this parameter to an invalid value and then attempting to open a SCSI generic device, the system can experience a soft locku...

5.5CVSS5.8AI score0.00101EPSS
SaveExploits0References4
OSV
OSV
added 2026/06/29 6:27 a.m.11 views

MAL-2026-6583 Malicious code in pino-debugging (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83f0ecc81a618444e701cf5302ced1fa1e92aadc8df2ae2821d2a94a30683d9d Package name 'pino-debugging' is a single-edit typosquat of the legitimate 'pino-debug'. The shipped index.js requires a dependency named 'loadutils'...

6.2AI score
SaveExploits0References3
RedHat Linux
RedHat Linux
added 2026/06/29 2:55 a.m.7 views

httpd: mod_md: unrestricted OCSP response leads to resource exhaustion

A flaw was found in the modmd module of httpd. When processing OCSP Online Certificate Status Protocol responses from a malicious or compromised OCSP responder, the module fails to enforce proper size limits on the incoming data. This issue leads to memory exhaustion and a denial of service...

7.3CVSS7AI score0.00628EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/06/29 2:45 a.m.39 views

CVE-2026-13528 YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.04-jdk8-SNAPSHOT. The impacted element is the function generateUploadPath of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/service/file/FileServiceImpl.java of the component AppFileController File...

7.5CVSS0.00447EPSS
SaveExploits0References8
Oracle linux
Oracle linux
added 2026/06/29 12:0 a.m.8 views

perl-IO-Compress security update

2.081-2 - Remove use of eval in File::GlobMapper for safer string interpolation - Resolves: RHEL-180411...

7.8CVSS5.8AI score0.00292EPSS
SaveExploits3
BDU FSTEC
BDU FSTEC
added 2026/06/29 12:0 a.m.11 views

The vulnerabilities of the ngx_http_proxy_v2_module and ngx_http_grpc_module modules in NGINX Plus and NGINX Open Source web servers allow attackers to execute arbitrary code or cause service interruptions.

The vulnerability of the ngxhttpproxyv2module and ngxhttpgrpcmodule modules in NGINX Plus and NGINX Open Source web servers stems from the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause service...

8.1CVSS6.8AI score0.03552EPSS
SaveExploits1References3Affected Software11
Rows per page
Query Builder