PYSEC-2026-4251 PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

API deploy code generator embeds unescaped YAML fields into Python source Summary PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...

CVE-2026-96795

Horilla , an HR and CRM software, is vulnerable to Remote Code Execution (RCE) in versions prior to 2.0.0 . The flaw exists in HorillaListView.export_data (located in horilla_views/generic/cbv/views.py), where the application accepts an authenticated user's columns POST parameter and takes field_...