CVE-2026-57132

PraisonAI is an AI multi-agent framework. Prior to 4.6.62 , setting the PRAISONAI_CALL_AUTH=disabled environment variable causes the verify_token function (in agent_invoke.py) to return immediately, unconditionally bypassing all authentication on the /api/v1/agents/{id}/invoke endpoint. Because t...

CVE-2026-57132 PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAICALLAUTH to disabled makes verifytoken accept requests to /api/v1/agents/id/invoke without CALLSERVERTOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their...

CVE-2026-57132 PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAICALLAUTH to disabled makes verifytoken accept requests to /api/v1/agents/id/invoke without CALLSERVERTOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their...

CVE-2026-12003

A flaw was found in Python. On Windows systems utilizing legacy installers, a low-privilege user can exploit insecure handling of the VPATH variable. This allows the user to create a specific landmark file outside the Python installation directory. Consequently, an alternative Lib folder can be...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Firmware: csdsp: Prevent buffer overflows when processing V2 algorithm headers. It is necessary to ensure that all fields of a V2 algorithm header fit within the available firmware data buffer. The wmfw V2 format introduced...

Astra Linux – Vulnerability in underscore

The package underscore from 1.13.0-0 and before 1.13.0-2, as well as from 1.3.2 and before 1.12.1, are vulnerable to Arbitrary Code Injection via the template function, especially when a variable property is passed as an argument without proper sanitization...

Astra Linux – Vulnerability in mtr

In certain privileged contexts, mtr improperly handles the execution of a program specified by the MTRPACKET environment variable. NOTE: On macOS, mtr may often be subject to sudo rules, as a result of Homebrew not installing setuid binaries...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mtd: nand: ecc-mxic: Fixed the use of an uninitialized variable ret. If ctx-steps is zero, the loop that processes ECC steps is skipped, and the variable ret remains uninitialized. This variable is later checked and returned, whi...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject variable offset alu on PTRTOFLOWKEYS For PTRTOFLOWKEYS, the checkflowkeysaccess function only uses a fixed offset for validation. However, the variable offset ptr isn’t prohibited for this type of pointer. Therefore,...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 7.17, and 7.0 contain AppArmor SAUCE patches that, under certain circumstances, may use an uninitialized variable in notification handling code. This bug can be triggered by a non-privileged local user, and it can lead to incorrect caching of AppArmor notification responses...

Astra Linux – Vulnerability in wavpack

WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variables. The impact includes unexpected control flow, crashes, and segfaults. The affected component is ParseCaffHeaderConfig caff.c:486. The attack vector is a maliciously crafted .wav file. The fixed version is after the...

Astra Linux – Vulnerability in Vim

Vim is vulnerable to use of uninitialized variables...

Astra Linux – Vulnerability in wavpack

WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variables. The impact includes unexpected control flow, crashes, and segfaults. The affected component is: ParseWave64HeaderConfig wave64.c:211. The attack vector is a maliciously crafted .wav file. The fixed version is: Afte...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RISCV: Fixed a race condition when vmap stack overflow occurs. Currently, when detecting vmap stack overflow, RISCV first switches to the so-called shadow stack, and then uses this shadow stack to call getoverflowstack, in order ...

cve-2013-4660_PoC

Docker 构建 构建为具有漏洞环境的 Docker 环境。 docker build -f cve-2013-4660 -t cve-2013-4660 . 为了演示攻击成功时服务器内部敏感信息如何泄露，注入虚拟数据库和虚拟数据库密码以及 AWS 密钥后运行容器。 sudo docker run -d --name yaml-lab -e DBPASSWORD="SuperSecretPassword123!" -e AWSACCESSKEYID="AKIAIOSFODNN7EXAMPLE" cve-2013-4660-test 将 PoC.yaml 文件复制到 Docker 容器内...

EUVD-2026-77213

Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla 7.0.0, Snippets Pro extension for Joomla 11.0.0 - Snippets substitutes variable values supplied by an article tag into saved Snippet content. The affected versions do not consider the...

CVE-2026-84564: Use of Uninitialized Variable

An uninitialized memory issue was addressed with improved memory initialization. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may result i...

CVE-2026-84564: Use of Uninitialized Variable

An uninitialized memory issue was addressed with improved memory initialization. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may result i...

CVE-2026-65405: Use of Uninitialized Variable

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to determine kernel memory layout...

ROS-20260914-73-0127

The vulnerability of the Codecs components in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created video file...