CVE-2026-49165: Use of Uninitialized Resource

Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally...

CVE-2026-42900: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows App Store allows an unauthorized attacker to elevate privileges over a network...

PT-2026-58122

Name of the Vulnerable Software and Affected Versions Windows App Store affected versions not specified Description A race condition occurs when multiple processes access a shared resource concurrently without proper synchronization. In the Windows App Store, this flaw allows an unauthorized...

PT-2026-58140

Name of the Vulnerable Software and Affected Versions Microsoft Windows App Store affected versions not specified Description The use of an uninitialized resource allows an authorized attacker to locally disclose sensitive information, which can impact the system. Recommendations At the moment,...

PT-2026-58158

Name of the Vulnerable Software and Affected Versions Microsoft Windows App Store affected versions not specified Description A race condition occurs when multiple processes access a shared resource concurrently without proper synchronization. In the Microsoft Windows App Store, this flaw allows ...

CVE-2026-52839: Authorization Bypass Through User-Controlled Key

Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the appointments/search response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints appointments/store and...

KLA91153 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of...

Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks

Summary SignedDataVerifier attempts to perform online revocation checking when enableonlinechecks=True, but its OCSP validation logic accepts stale GOOD responses as valid indefinitely. In appstoreserverlibrary/signeddataverifier.py, ChainVerifier.checkocspstatus verifies the OCSP response...

Improper Check for Certificate Revocation

Overview app-store-server-library is a The App Store Server Library Affected versions of this package are vulnerable to Improper Check for Certificate Revocation in the SignedDataVerifier process when online revocation checking is enabled. An attacker can cause the acceptance of revoked...

GHSA-8F6J-263M-G72X Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks

Summary SignedDataVerifier attempts to perform online revocation checking when enableonlinechecks=True, but its OCSP validation logic accepts stale GOOD responses as valid indefinitely. In appstoreserverlibrary/signeddataverifier.py, ChainVerifier.checkocspstatus verifies the OCSP response...

CVE-2026-50162

A flaw was found in oras-go. The file content store, intended to confine writes to a specified working directory, does not properly account for symbolic link symlink traversal. A remote attacker, by providing a specially crafted blob title, could exploit this vulnerability to create files outside...

PYSEC-2026-2581 Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent

Advisory Details Title: Sandbox Escape to Remote Code Execution via Incomplete eval Mitigation in TableChatAgent Description: Summary Langroid is vulnerable to a critical Sandbox Escape leading to Remote Code Execution RCE in its TableChatAgent and VectorStore capabilities. When these agents...

mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call

SummaryThe HTTP MCP JSON-RPC endpoint at /mcp requires only OAuth read scope for all requests, then dispatches tools/call directly to handlers that include mutating tools. A read-only OAuth client can call storememory and deletememory through MCP even though the corresponding REST endpoints requi...

PYSEC-2026-2622 mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call

Summary The HTTP MCP JSON-RPC endpoint at /mcp requires only OAuth read scope for all requests, then dispatches tools/call directly to handlers that include mutating tools. A read-only OAuth client can call storememory and deletememory through MCP even though the corresponding REST endpoints...

LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading

SummaryLangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in tur...

Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)

Hermes Agent before 0.16.0 creates responsestore.db and webhooksubscriptions.json with world-readable permissions mode 0o644, exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including...

PYSEC-2026-2511 Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)

Hermes Agent before 0.16.0 creates responsestore.db and webhooksubscriptions.json with world-readable permissions mode 0o644, exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including...

PYSEC-2026-2897 PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries

Summary PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names into these backends can trigger SQL or CQL injection. Details This issue affec...

PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries

SummaryPraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names into these backends can trigger SQL or CQL injection. DetailsThis issue affects...

PYSEC-2026-2729 Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search

Unauthorized File and Knowledge Base Content Access via RAG Vector Search Affected Component RAG source resolution in chat completion pipeline: - backend/openwebui/retrieval/utils.py lines 963-965, 1063-1068, 1126-1131 in getsourcesfromitems Affected Versions Current main branch commit 6fdd19bf1...