CVE-2026-57124: Improper Neutralization of Special Elements used in an OS Command

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...

Amazon Linux 2023 : cups-filters, cups-filters-devel, cups-filters-libs (ALAS2023-2026-2127)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2127 advisory. A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort...

CVE-2026-37008

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

EUVD-2026-77008

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-li...

CVE-2026-90773

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals...

CVE-2026-90773: Improper Neutralization of Escape, Meta, or Control Sequences

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals...

CVE-2026-90782: NULL Pointer Dereference

S2OPC through 1.7.3 contains a null pointer dereference in msgsubscriptionpublishbsallocnotificationmessageitems where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions wit...

Linux Distros Unpatched Vulnerability : CVE-2026-90773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute...

SUSE CVE-2026-89698

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...

kasld v0.4.0

KASLD recovers the Linux kernel's virtual and physical memory layout — primarily the kernel text base — from a local process. What it can recover is a function of that process's vantage: its privileges and capabilities, the system's configuration, and any container confinement. It recovers the ba...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the discount process. An attacker can manipulate financial calculations and produce unintended order totals by submitting negative values through the administrative interface, which are then persisted and...

CVE-2026-50013 Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy,...

CVE-2026-48496 opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block...

CVE-2026-48496 opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block...

CVE-2026-48496

OpenTelemetry eBPF Profiler (versions 0.0.202527 through before 0.0.202622 ) is vulnerable to a denial of service triggered by a local, unprivileged process. The root cause is that the profiler can be induced to open a nonregular mapping file (such as a FIFO), which causes it to block indefinitel...

CVE-2026-89593

A flaw was found in the Linux kernel's huge page hugetlb subsystem. This vulnerability occurs when a huge page of memory is shared between a parent and a child process. If the parent process unmaps the huge page before the child, the system can incorrectly reduce the count of reserved huge pages...

EUVD-2026-76515

In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscalltraceenter for ptrace, another thread can install a seccomp filter with SECCOMPFILTERFLAGTSYNC e.g...

Uncaught Exception

Overview hbs is an Express.js template engine plugin for Handlebars Affected versions of this package are vulnerable to Uncaught Exception in its async helper output escaping, where a helper value carrying a truthy but non-callable toHTML property causes handlebars' escapeExpression to invoke it ...

CVE-2026-87123 hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

CVE-2026-87442

A flaw was found in Prerender in Google Chrome. A remote attacker who has compromised the renderer process could exploit a confused deputy vulnerability by crafting a malicious HTML page. This could potentially allow them to bypass the web origin policy, which is a fundamental security mechanism...