PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools Summarypraisonaiagents.mcp.ToolsMCPServer.runsse builds a Starlette MCPHTTP+SSE server around mcp.server.sse.SseServerTransport. The server exposes/sse and /messages/, but it does not validate...

PYSEC-2026-3514 PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage

PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage Summary PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.gettools: python ctx = setupdynamiccontext agent = Agent instructions="You are a data analyst.",...

PraisonAI: Compute-bridged file tools allow shell command injection

Compute-bridged file tools allow shell command injection SummaryLocalManagedAgent / SandboxedAgent compute bridging wrapsreadfile, listfiles, and writefile when a compute provider isattached. The bridge converts those file operations into shell command stringsusing raw path arguments, then sends...

PYSEC-2026-3503 PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools

HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools Summary praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into...

PYSEC-2026-3534 PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools Summary praisonaiagents.mcp.ToolsMCPServer.runsse builds a Starlette MCP HTTP+SSE server around mcp.server.sse.SseServerTransport. The server exposes /sse and /messages/, but it does not valida...

PYSEC-2026-3499 PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal

PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal Summary PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The SDK reference describes the module as providing: - artifact storage for tool...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: Low...

RHSA-2026:41948 Red Hat Security Advisory: javapackages-tools:201801 security update

Bulletin has no description...

acl security update

An update is available for acl. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Access Control Lists ACLs are used to define fine-grained discretionary access...

agent-bom v0.97.4

Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure. 15 package ecosystems · 16 compliance surfaces · 77 MCP tools · no account required Quick start · Live demo · Docs What it is agent-bom scans repositories, images, and cloud accounts, then correlates what i...

SUSE-SU-2026:22862-1 Security update for net-tools

This update for net-tools fixes the following issue: - CVE-2024-58251: denial of service via terminal escape sequences bsc1254323...

SUSE-SU-2026:22936-1 Security update for net-tools

This update for net-tools fixes the following issue: - CVE-2024-58251: denial of service via terminal escape sequences bsc1254323...

OPENSUSE-SU-2026:21429-1 Security update for net-tools

This update for net-tools fixes the following issue: - CVE-2024-58251: denial of service via terminal escape sequences bsc1254323...

PT-2026-64133

SpiderTools redirect-target SSRF protection bypass Summary SpiderTools.scrape page validates the initial URL and rejects direct loopback, private, link-local, metadata, and internal hostnames. It then calls requests.Session.get without disabling automatic redirects or validating redirect Location...

CVE-2026-65698: Improper Limitation of a Pathname to a Restricted Directory

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file://...

ToolGuardian: Declarative Security for AI Agent-Tool Interactions

LLM agents increasingly rely on external tools, expanding capability while creating a new security boundary: third-party tools may appear benign at the interface level while embedding unsafe behavior in implementation. Existing defenses rely on weak metadata, collapse characterization and policy...

PT-2026-64131

Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the /api/v1/runs endpoint...

PT-2026-64111

HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools Summary praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into...

CVE-2026-65695: Improper Limitation of a Pathname to a Restricted Directory

Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute...

PT-2026-64089

Impact LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key...