Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.15.0 release.

Red Hat Web Terminal Operator 1.15.0 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

catbyte-toolkit

cb - Binary Analysis Toolkit for macOS/iOS Security Research...

How Hackers Are Thinking About AI

Interesting paper: "What hackers talk about when they talk about AI: Early-stage diffusion of a cybercrime innovation." Abstract: The rapid expansion of artificial intelligence AI is raising concerns about its potential to transform cybercrime. Beyond empowering novice offenders, AI stands to...

CVE-2026-40287

PraisonAI is a multi-agent teams system. Versions 4.5.138 and below are vulnerable to arbitrary code execution through automatic, unsanitized import of a tools.py file from the current working directory. Components including call.py importtoolsfromfile, toolresolver.py loadlocaltools, and CLI...

OpenClaw-Security-Tools

No d...

CVE-2026-40287 PraisonAI has RCE via Automatic tools.py Import

PraisonAI is a multi-agent teams system. Versions 4.5.138 and below are vulnerable to arbitrary code execution through automatic, unsanitized import of a tools.py file from the current working directory. Components including call.py importtoolsfromfile, toolresolver.py loadlocaltools, and CLI...

CVE-2026-40287 PraisonAI has RCE via Automatic tools.py Import

PraisonAI is a multi-agent teams system. Versions 4.5.138 and below are vulnerable to arbitrary code execution through automatic, unsanitized import of a tools.py file from the current working directory. Components including call.py importtoolsfromfile, toolresolver.py loadlocaltools, and CLI...

http-tools (>=1.0.1, <=1.0.2), lyrebird (>=0.11.0, <=0.12.1) +2 more potentially affected by CVE-2026-40606 via mitmproxy (4.0.4)

mitmproxy PYPI version 4.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - http-tools =1.0.1, =0.11.0, =1.2.1, =1.5.33, =1.5.41 Source cves: CVE-2026-40606 Source advisory: OSV:GHSA-527G-3W9M-29HV...

comics-down (0.2.0), http-tools (1.1.0) potentially affected by CVE-2026-40606 via mitmproxy (5.0.1)

mitmproxy PYPI version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - comics-down 0.2.0 - http-tools 1.1.0 Source cves: CVE-2026-40606 Source advisory: OSV:GHSA-527G-3W9M-29HV...

http-tools (4.0.0) potentially affected by CVE-2026-40606 via mitmproxy (10.1.5)

mitmproxy PYPI version 10.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - http-tools 4.0.0 Source cves: CVE-2026-40606 Source advisory: OSV:GHSA-527G-3W9M-29HV...

http-tools (5.0.0), octotail (>=1.0.0, <=1.0.13) potentially affected by CVE-2026-40606 via mitmproxy (11.0.0)

mitmproxy PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - http-tools 5.0.0 - octotail =1.0.0, =1.0.13 Source cves: CVE-2026-40606 Source advisory: OSV:GHSA-527G-3W9M-29HV...

sandroid (2.0.0), ui-automation-tools-mbt (>=1.1.1, <=1.3.1) potentially affected by CVE-2026-40606 via mitmproxy (0.17.0)

mitmproxy PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - sandroid 2.0.0 - ui-automation-tools-mbt =1.1.1, =1.3.1 Source cves: CVE-2026-40606 Source advisory: OSV:GHSA-527G-3W9M-29HV...

libcurl DoS

The vulnerability of the libcurl library in software applications for interacting with servers via cURL is related to improper verification of certificate authenticity. Exploiting this vulnerability can allow an attacker to cause service failures...

Moderate: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: tornado-python: Tornado: Denial of Service via large multipart bodies CVE-2026-31958 For more details about the security issues, including the impact, a CVSS score,...

Amazon Linux 2 : cri-tools, --advisory ALAS2-2026-3236 (ALAS-2026-3236)

"The version of cri-tools installed on the remote host is prior to 1.32.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3236 advisory. The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negati...

PraisonAI security vulnerabilities

PraisonAI is a low-code multi-agent collaboration framework developed by Mervin Praison. Versions of PraisonAI 4.5.138 and earlier contained a security vulnerability. This vulnerability stemmed from the automatic and uncleanly import of the tools.py file from the current working directory, which...

KLA90982 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, cause denial of service, gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. An...

CVE-2026-40153

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the executecommand function in shelltools.py calls os.path.expandvars on every command argument at line 64, manually re-implementing shell-level environment variable expansion despite using shell=False line 88 for security. This...

CVE-2026-40149

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no authtoken is configured the default. By adding dangerous tool names e.g., shellexec, filewrite to the allowlist, a...

EUVD-2026-21974

An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted input file...