miasm

What is Miasm? Miasm is a free and open source GPLv2 reverse engineering framework. Miasm aims to analyze / modify / generate binary programs. Here is a non exhaustive list of features: Opening / modifying / generating PE / ELF 32 / 64 LE / BE Assembling / Disassembling X86 / ARM / MIPS / SH4 /...

CVE-2014-0472

CVE-2014-0472 Use docker-compose up -d Access localhost:8083 Reference: https://www.djangoproject.com/weblog/2014/apr/21/security/ 1. One or more views are present which construct a URL based on user input commonly, a "next" parameter in a querystring indicating where to redirect upon successful...

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Summary When processing an attacker-controlled Protobuf schema, vulnerable versions of datamodel-code-generator could write a generated weak-import stub outside the intended weakimports temporary directory. Absolute import paths and relative paths containing .. could escape this directory. An...

CVE-2026-107292 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.toweb and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a...

PT-2026-108047

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.34.0 through 1.107.4 Pydantic AI versions 2.0.0 through 2.29.9 Description The Agent.to web and clai web development chat server fails to validate the Host header of incoming requests. This allows a malicious website...

EUVD-2026-92790

Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/flowid/vertices endpoints...

CVE-2026-105698 Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/flowid/vertices and POST /api/v1/build/flowid/vertices/vertexid handlers. Through version 1.7.1, an unauthenticated...

CVE-2026-105698

Langflow (versions 1.0.0 through 1.10.0) is vulnerable to cross-user flow access and unauthorized vertex execution due to a missing ownership check in deprecated handlers. Specifically, the POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} endpoints faile...

CVE-2026-105698 Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/flowid/vertices and POST /api/v1/build/flowid/vertices/vertexid handlers. Through version 1.7.1, an unauthenticated...

CVE-2026-105698 Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/flowid/vertices and POST /api/v1/build/flowid/vertices/vertexid handlers. Through version 1.7.1, an unauthenticated...

PT-2026-106233

Name of the Vulnerable Software and Affected Versions Langflow versions 1.0.0 through 1.10.0 Description Langflow fails to verify flow ownership in the deprecated 'POST /api/v1/build/flow id/vertices' and 'POST /api/v1/build/flow id/vertices/vertex id' endpoints. In versions prior to 1.7.2, these...

PT-2026-98197

Name of the Vulnerable Software and Affected Versions DBHub versions prior to 0.22.6 Description Setting readonly = true on the execute sql tool fails to enforce a read-only connection. The database-level read-only controls are not activated because the required configuration value is never...

CVE-2026-57137

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that...

CVE-2026-57137

PraisonAI (npm:praisonai) is a TypeScript AI agent framework. In versions 1.4.0 through 1.7.1 , the createAgentLoop() function passes executable tool handlers to the AI SDK's generateText() before invoking the onToolCall approval callback. Because the AI SDK executes tools during generation, a ca...

EUVD-2026-78422

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that...

CVE-2026-57137 PraisonAI AgentLoop onToolCall approval runs after tool execution

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that...

CVE-2026-57137 PraisonAI AgentLoop onToolCall approval runs after tool execution

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that...

CVE-2026-57137: Protection Mechanism Failure

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that...

CVE-2026-73657 Trigger.dev: Cross-tenant payload poisoning via packet write + replay

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, POST /api/v1/runs/:runParam/replay in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses prisma.taskRun.findUnique where: friendlyId: runParam without a...

Malicious code in chai-as-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e93684202a75938b3139b209943cf55c34ea8ff9a215a6ead907e36d8ab953 The package presents itself as a chai-related utility name chai-as-map, keywords logger/stream/json, description referencing vulnerability management...