Lucene search
+L

4690 matches found

OSV
OSV
added 2026/07/21 4:15 p.m.5 views

CVE-2026-47399 PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to...

8.8CVSS5.5AI score
SaveExploits0References5
CVE
CVE
added 2026/07/21 4:15 p.m.39 views

CVE-2026-47399

Summary of vulnerability (CVE-2026-47399): PraisonAI Platform prior to version 0.1.4 exposes a systemic object-level authorization flaw where workspace-scoped REST routes verify only that a caller is in the URL workspace, but the service layer resolves objects (e.g., agents, projects, issues, com...

8.8CVSS5.4AI score0.0029EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/21 3:57 p.m.4 views

CVE-2026-47397 PraisonAI has an Arbitrary File Write in Python API

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, hidden metadata in a webpage causes PraisonAI agents to write attacker-controlled content to arbitrary paths. writefile skips path validation when workspace=None always None in production. Version 4.6.40 fixes the issue...

7.1CVSS5.5AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/21 3:57 p.m.25 views

CVE-2026-47397 PraisonAI has an Arbitrary File Write in Python API

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, hidden metadata in a webpage causes PraisonAI agents to write attacker-controlled content to arbitrary paths. writefile skips path validation when workspace=None always None in production. Version 4.6.40 fixes the issue...

7.1CVSS0.00381EPSS
SaveExploits0References3
CERT
CERT
added 2026/07/21 12:0 a.m.7 views

Plane contains multi-tenant authorization bypass vulnerability

Overview The project management tool Plane, versions 1.3.0 and earlier, contains a multi-tenant authorization bypass vulnerability in its asset-management API that allows unauthorized users to access, delete, or duplicate assets that belong to other workspaces. Description Plane is an open-source...

6.5CVSS5.5AI score0.00225EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/20 4:16 p.m.6 views

CVE-2026-25039

Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount the workspace of an...

8.8CVSS0.00344EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/20 2:53 p.m.16 views

CVE-2026-25039

Summary (CVE-2026-25039): Parsec, a cloud-based file sharing app, does not sanitize the workspace name when creating a mountpoint in Windows, allowing a UNC path to be used as the workspace name. The root cause is that UNC paths may contain backslashes, and if the UNC target is invalid or unavail...

8.8CVSS5.4AI score0.00344EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/20 2:53 p.m.12 views

EUVD-2026-45968

Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount the workspace of an...

8.8CVSS5.4AI score0.00344EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/20 2:53 p.m.39 views

CVE-2026-25039 The application evaluate UNC path in workspace name

Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount the workspace of an...

8.8CVSS0.00344EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/20 2:53 p.m.6 views

CVE-2026-25039 The application evaluate UNC path in workspace name

Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount the workspace of an...

8.8CVSS5.3AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/20 12:0 a.m.9 views

PT-2026-61598

Name of the Vulnerable Software and Affected Versions Parsec affected versions not specified Description Parsec is a cloud-based application for secure file sharing. The application fails to sanitize the workspace name when creating a mountpoint in the Windows filesystem to mount an organization'...

8.8CVSS5.9AI score0.00344EPSS
SaveExploits0References7
Fedora
Fedora
added 2026/07/19 3:56 a.m.21 views

[SECURITY] Fedora 43 Update: uv-0.11.28-1.fc43

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...

5.4AI score
SaveExploits0
NVD
NVD
added 2026/07/17 2:18 a.m.16 views

CVE-2026-62222

OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control over configured input paths can execute or persist actions beyond their intended authorization level...

7.8CVSS0.00118EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/17 12:7 a.m.45 views

CVE-2026-62222 OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode

OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control over configured input paths can execute or persist actions beyond their intended authorization level...

7.8CVSS0.00118EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/17 12:7 a.m.11 views

CVE-2026-62222 OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode

OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control over configured input paths can execute or persist actions beyond their intended authorization level...

7.1CVSS5.4AI score
SaveExploits0References5
OSV
OSV
added 2026/07/16 2:42 p.m.13 views

CVE-2026-59863 Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pu...

7CVSS6.2AI score
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/07/16 2:42 p.m.9 views

CVE-2026-59863

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pu...

7CVSS6.2AI score0.01123EPSS
SaveExploits0References5Affected Software1
Positive Technologies
Positive Technologies
added 2026/07/16 12:0 a.m.19 views

PT-2026-60482

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.5 Description Kiota, an OpenAPI based HTTP Client code generator, fails to validate outputPath values for clients and plugins within the .kiota/workspace.json configuration file. This allows a malicious repository ...

7CVSS5.9AI score0.01123EPSS
SaveExploits0References9
NVD
NVD
added 2026/07/15 12:18 p.m.11 views

CVE-2026-61440

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to...

7.1CVSS0.00213EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/15 11:25 a.m.13 views

EUVD-2026-44644

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to...

7.1CVSS6.1AI score0.00213EPSS
SaveExploits0References3
Rows per page
Query Builder