CVE-2026-57130 PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/emailtools.py interpolates LLM-controlled fromaddr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can...

CVE-2026-57130

PraisonAI (praisonaiagents) is a multi-agent framework. Prior to 1.6.59 , the file email_tools.py interpolates LLM-controlled parameters (from_addr, subject, query, search_id) directly into IMAP SEARCH criteria using f-string formatting with double-quote delimiters, with no escaping or sanitizati...

CVE-2026-7848 SQL Injection in Alior Bank raty PrestaShop module

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters...

CVE-2026-7848 SQL Injection in Alior Bank raty PrestaShop module

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters...

EUVD-2026-77518

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: A NULL pointer dereference occurred in meshrxcsaframe. In meshrxcsaframe, elems-meshchanswparamsie was dereferenced at lines 1638 and 1642, without a prior NULL check: c ifmsh-chswttl =...

Astra Linux – Vulnerability in dovecot

A mail message containing an excessive number of RFC 2231 MIME parameters causes LMTP to consume too much CPU resources. A properly formatted mail message prevents the mail delivery process from consuming excessive CPU time. Use MTA capabilities to limit the number of RFC 2231 MIME parameters in...

Astra Linux – Vulnerability in mbedtls

A issue was discovered in Mbed TLS before version 2.25.0 and before versions 2.16.9 LTS and 2.7.18 LTS. A NULL algorithm parameter entry resembles an array of REAL values with a size of zero; therefore, the certificate is considered valid. However, if the parameters do not match at all, then the...

Astra Linux – Vulnerability in Zabbix

The Zabbix Agent 2 item key “smart.disk.get” does not sanitize its parameters before passing them to a shell command, which may lead to a vulnerability for remote code execution...

Astra Linux – Vulnerability in Firefox and Thunderbird

When accessing directory listings for chrome:// URLs as source text, certain parameters are reflected. This vulnerability affects Firefox ESR 102.1, Firefox ESR 91.12, Firefox 103, Thunderbird 102.1, and Thunderbird 91.12...

Astra Linux – Vulnerability in OpenVPN

A vulnerability was discovered in OpenVPN 2.4.x prior to version 2.4.9. An attacker can inject a data channel v2 PDATAV2 packet using the victim’s peer-id. Normally, such packets are discarded. However, if this packet arrives before the data channel crypto parameters have been initialized, the...

Astra Linux – Vulnerability in OpenSSL

Issue Summary: Checking excessively long DH keys or parameters can be very slow. Impact Summary: Applications that use functions like DHcheck, DHcheckex, or EVPPKEYparamcheck to check DH keys or parameters may experience prolonged delays. If the keys or parameters are obtained from an untrusted...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

A stack overflow flaw was discovered in the Linux kernel’s SYSCTL subsystem regarding how a user modifies certain kernel parameters and variables. This flaw allows a local user to crash the system or potentially escalate their privileges on the system...

Astra Linux – Vulnerability in Firefox

Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox versions earlier than 110...

CVE-2026-91144: Authorization Bypass Through User-Controlled Key

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...

PT-2026-91223

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters "alior product...

PT-2026-91279

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a...

EUVD-2026-76857

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter...

Arbitrary Argument Injection

Overview aiosmtplib is an aiosmtplib is an asynchronous SMTP client for use with asyncio. Affected versions of this package are vulnerable to Arbitrary Argument Injection in the parseaddress function of src/aiosmtplib/email.py, which returns parsedaddress or address.strip, so a malformed mailbox...

CVE-2026-89268

QloApps through 1.7.0 contains a reflected cross-site scripting (XSS) vulnerability in the back-office list helper template (list_header.tpl). POST parameters from list filter forms are rendered into HTML value attributes without escaping , allowing an attacker to induce an authenticated user to ...