GHSA-XCMW-GRXF-WJHJ PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)

TL;DR CVE-2026-40287's fix gated tools.py auto-import behind PRAISONAIALLOWLOCALTOOLS=true in two files toolresolver.py, api/call.py. A third import sink in praisonai/templates/tooloverride.py was missed and remains unguarded. It is reached by the recipe runner on every recipe execution and is...

CVE-2026-43583

creationtimestamp| type| source ---|---|--- 2026-05-06 22:04:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7pg74sf32r...

CVE-2026-44112

creationtimestamp| type| source ---|---|--- 2026-05-06 21:59:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7p6ipcm52v 2026-05-16 17:08:21+00:00| seen| https://bsky.app/profile/cerberusit.bsky.social/post/3mlydgxylsw2s 2026-05-16 23:10:43+00:00| seen|...

CVE-2026-40281

creationtimestamp| type| source ---|---|--- 2026-05-06 21:50:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7onz4kgp2n 2026-05-07 01:58:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mla4iyvhh22o 2026-05-11 16:07:14+00:00| seen|...

CVE-2026-43579

creationtimestamp| type| source ---|---|--- 2026-05-06 21:47:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7ohf6vsu2q...

CVE-2026-44113

creationtimestamp| type| source ---|---|--- 2026-05-06 21:44:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7octvlei2p 2026-05-19 18:30:06+00:00| seen| https://t.me/truesecator/8221...

CVE-2026-43582

creationtimestamp| type| source ---|---|--- 2026-05-06 21:36:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7ntpxucl2e...

EUVD-2026-27881

Unauthenticated DoS in ZTE H8102E, H168N, H167A, H199A, H288A, H198A, H267A, H267N, H268A, H388X, H196A, H369A, H268N, H208N, H367N, H181A, and H196Q. A denial-of-service condition can be triggered against the router's web interface by sending an oversized application/x-www-form-urlencoded POST...

CVE-2026-41938

creationtimestamp| type| source ---|---|--- 2026-05-06 20:50:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7lbjqwpq2e...

CVE-2026-46364

creationtimestamp| type| source ---|---|--- 2026-05-06 20:49:15+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-289f-fq7w-6q2w 2026-05-16 00:00:39+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlwk4jqvtu23...

CVE-2026-41934

creationtimestamp| type| source ---|---|--- 2026-05-06 20:46:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7l2ndbu42n...

CVE-2026-43584

creationtimestamp| type| source ---|---|--- 2026-05-06 20:39:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7kp3bhet2n 2026-05-06 21:42:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7o6oprf62i 2026-05-07 22:37:08+00:00| seen|...

CVE-2026-7412

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to...

CVE-2026-43174

A flaw was found in the Linux kernel's iouring/zcrx subsystem. Incorrect error handling during post-open operations allows for the direct release of zcrx ctx without ensuring that all associated page pools are properly terminated. This resource management issue could lead to system instability or...

GHSA-3R34-VQ8M-39GH Lemur: LDAP Filter Injection enables post-authentication privilege escalation

Description Overview Lemur's LDAP authentication module lemur/auth/ldap.py constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership querie...

Lemur: LDAP Filter Injection enables post-authentication privilege escalation

Description Overview Lemur's LDAP authentication module lemur/auth/ldap.py constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership querie...

CVE-2026-34473

Unauthenticated DoS in ZTE H8102E, H168N, H167A, H199A, H288A, H198A, H267A, H267N, H268A, H388X, H196A, H369A, H268N, H208N, H367N, H181A, and H196Q. A denial-of-service condition can be triggered against the router's web interface by sending an oversized application/x-www-form-urlencoded POST...

CVE-2026-8028

creationtimestamp| type| source ---|---|--- 2026-05-06 18:19:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7cuo4hcs2e...

CVE-2026-8002

creationtimestamp| type| source ---|---|--- 2026-05-06 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260507 2026-05-06 23:02:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7sozho6k2q 2026-05-07 01:27:19+00:00|...

CVE-2026-8016

creationtimestamp| type| source ---|---|--- 2026-05-06 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260507 2026-05-06 23:00:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7sld34262t 2026-05-07 01:22:17+00:00|...