PT-2026-46379

Unauthenticated Local File Inclusion in ITactics = 1.0 versions...

aimmo (>=0.69.9b442, <=0.69.10b450), cfl-common (>=4.30.9, <=4.30.10) +2 more potentially affected by CVE-2026-6873 via django (2.2.22)

django PYPI version 2.2.22 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.69.9b442, =4.30.9, =4.30.9, =4.30.10 - rapid-router 2.7.6 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

rapid-router (>=1.0.0.post0.dev74, <=1.0.0.post0.dev405) potentially affected by CVE-2026-6873 via django (1.8.2)

django PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - rapid-router =1.0.0.post0.dev74, =1.0.0.post0.dev405 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

aimmo (>=0.28.0b5241, <=0.61.8b52), cfl-common (>=3.1.4, <=4.14.2) +2 more potentially affected by CVE-2026-48587 via django (1.11.24)

django PYPI version 1.11.24 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.28.0b5241, =3.1.4, =2.19.0, =2.2.0, =2.4.12 Source cves: CVE-2026-48587 Source advisory: OSV:GHSA-923M-GV2P-W5QP...

aimmo (>=0.28.0b5241, <=0.61.8b52), cfl-common (>=3.1.4, <=4.14.2) +2 more potentially affected by CVE-2026-6873 via django (1.11.24)

django PYPI version 1.11.24 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.28.0b5241, =3.1.4, =2.19.0, =2.2.0, =2.4.12 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

aimmo (>=0.69.7b417, <=0.69.8), cfl-common (>=4.30.7, <=4.30.8) +2 more potentially affected by CVE-2026-8404 via django (2.2.21)

django PYPI version 2.2.21 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.69.7b417, =4.30.7, =4.30.7, =4.30.8 - rapid-router 2.7.5 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

rapid-router (>=1.0.0.post0.dev406, <=1.0.0.post0.dev408) potentially affected by CVE-2026-6873 via django (1.8.3)

django PYPI version 1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - rapid-router =1.0.0.post0.dev406, =1.0.0.post0.dev408 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

aimmo (>=0.28.0b5241, <=0.61.8b52), cfl-common (>=3.1.4, <=4.14.2) +2 more potentially affected by CVE-2026-8404 via django (1.11.24)

django PYPI version 1.11.24 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.28.0b5241, =3.1.4, =2.19.0, =2.2.0, =2.4.12 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

rapid-router (>=1.0.0.post0.dev74, <=1.0.0.post0.dev405) potentially affected by CVE-2026-48587 via django (1.8.2)

django PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - rapid-router =1.0.0.post0.dev74, =1.0.0.post0.dev405 Source cves: CVE-2026-48587 Source advisory: OSV:GHSA-923M-GV2P-W5QP...

rapid-router (>=1.0.0.post0.dev406, <=1.0.0.post0.dev408) potentially affected by CVE-2026-48587 via django (1.8.3)

django PYPI version 1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - rapid-router =1.0.0.post0.dev406, =1.0.0.post0.dev408 Source cves: CVE-2026-48587 Source advisory: OSV:GHSA-923M-GV2P-W5QP...

PT-2026-45052

Name of the Vulnerable Software and Affected Versions PraisonAI version 4.6.33 Description The code-generator praisonai.deploy.api.generate api server code creates a Flask API server with authentication disabled by default. When users deploy the server using the command praisonai deploy --type ap...

aiohttp-rapid (0.0.0), sap-computer-vision-package (>=1.0.12, <=1.1.7) potentially affected by CVE-2026-44660 via ujson (4.0.0)

ujson PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ujson and may be impacted: - aiohttp-rapid 0.0.0 - sap-computer-vision-package =1.0.12, =1.1.7 Source cves: CVE-2026-44660 Source advisory: OSV:PYSEC-2026-2293...

Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer

Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive credential-stealing framework. The affected packages include - laravel-lang/lang laravel-lang/http-statuses...

Verizon DBIR: AI Helped Hackers Exploit Vulnerabilities in 31% of Recent Breaches

Verizon DBIR 2026 reveals software vulnerabilities overtook stolen passwords in cyberattacks, with AI helping hackers exploit flaws within hours...

Malicious code in @antv/l7-extension-g-layer (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Exploit for Uncontrolled Resource Consumption in Siemens Simatic_S7-1500_Cpu_1518F-4_Pn\/Dp_Mfp_Firmware

CVE-2023-44487 — HTTP/2 Rapid Reset Test Lab Educational envi...

aiohttp-rapid (0.0.0), sap-computer-vision-package (>=1.0.12, <=1.1.7) potentially affected by CVE-2026-44660 via ujson (4.0.0)

ujson PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ujson and may be impacted: - aiohttp-rapid 0.0.0 - sap-computer-vision-package =1.0.12, =1.1.7 Source cves: CVE-2026-44660 Source advisory: OSV:GHSA-C38F-WX89-P2XG...

fast-xml-builder Comment Value regex can be bypassed

Summary The fix for https://github.com/advisories/GHSA-gh4j-gqv2-49f6 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace/--/g, '- -'. This skip the values containing three consecutive dashes e.g., ---..., allowing an attacker to break out of an XML comment and inject...

One Click, Total Shutdown: The "Patient Zero" Webinar on Killing Stealth Breaches

The hardest part of cybersecurity isn't the technology, it’s the people. Every major breach you’ve read about lately usually starts the same way: one employee, one clever email, and one "Patient Zero" infection. In 2026, hackers are using AI to make these "first clicks" nearly impossible to spot...

Cyber Insurance Requirements for Cybersecurity

Cyber Insurance Requirements for Cybersecurity Cyber insurance requirements cybersecurity teams face today are stricter than they were even a few years ago. Underwriters no longer accept a simple security questionnaire and a list of tools. They want evidence that your organization can identify...