9426 matches found
PT-2026-68302
Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.40 Description The bundled Claude GitHub Actions workflow is susceptible to command injection. This occurs because the workflow embeds a pull request branch name into a Bash run: block without proper quoting or...
PT-2026-68198
Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow version 26.0.0 IBM Business Automation Workflow versions 25.0.0 through 25.0.0 Interim Fix 005 IBM Business Automation Workflow versions 24.0.1 through 24.0.1 Interim Fix 007 IBM Business Automation Workflow...
Linux Distros Unpatched Vulnerability : CVE-2026-67855
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UAENABLEGDSPUSHMANAGEMENT is enabled. This allows a remote...
CVE-2026-48168: Missing Authorization
PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow...
PT-2026-68307
Name of the Vulnerable Software and Affected Versions praisonai versions 3.9.26 through 4.6.57 praisonaiagents versions 0.12.12 through 1.6.57 Description The workflow include feature allows for arbitrary Python code execution. The Workflow. execute include function implicitly imports and runs a...
UBUNTU-CVE-2026-67855
open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UAENABLEGDSPUSHMANAGEMENT is enabled. This allows a remote attacker to cause a denial of service...
Authorization Bypass Through User-Controlled Key
Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the GraphQL node's Authentication parameter, which accepts expression values and, when several credentials of different types are attached in...
EUVD-2026-52871
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission middleware that protects other execution endpoints. Any authenticated use...
PT-2026-68034
Name of the Vulnerable Software and Affected Versions AI Chatbot & Workflow Automation by AIWU versions prior to 1.4.7 Description An issue exists where the getCurrentTaskResults function in modules/workspace/controller.php is accessible without authentication or authorization. This occurs becaus...
CVE-2026-70475: Missing Authorization
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission middleware that protects other execution endpoints. Any authenticated use...
Langflow agent Function Bypass
The vulnerability of the getflowbyidorendpointname function in the Langflow agent and workflow creation/execution tools relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions using an...
spotlight
Spotlight by CMUL8 The AI security engineer. Phase 1 MVP — ve...
exploitarium
Statement This repo was incomplete when published. In regar...
Exploit for CVE-2026-58424
CVE-2026-58424 - Gitea Fork PR Workflow Approval Gate Bypass...
@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification
Summary A template injection vulnerability in the createworkflowfornotification tool lets a caller embed Jinja2 expressions that the Dynatrace workflow engine evaluates at runtime, exfiltrating event data to attacker-controlled destinations through a workflow that persists in the tenant after the...
GHSA-XRMJ-5G4G-8987 @dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification
Summary A template injection vulnerability in the createworkflowfornotification tool lets a caller embed Jinja2 expressions that the Dynatrace workflow engine evaluates at runtime, exfiltrating event data to attacker-controlled destinations through a workflow that persists in the tenant after the...
CVE-2026-68577
Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked...
CVE-2026-68576
Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked...