Lucene search
+L

4679 matches found

Fedora
Fedora
added 2026/07/19 3:56 a.m.21 views

[SECURITY] Fedora 43 Update: uv-0.11.28-1.fc43

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...

5.4AI score
SaveExploits0
NVD
NVD
added 2026/07/17 2:18 a.m.15 views

CVE-2026-62222

OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control over configured input paths can execute or persist actions beyond their intended authorization level...

7.8CVSS0.00118EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/17 12:7 a.m.11 views

CVE-2026-62222 OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode

OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control over configured input paths can execute or persist actions beyond their intended authorization level...

7.1CVSS5.4AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/17 12:7 a.m.45 views

CVE-2026-62222 OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode

OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control over configured input paths can execute or persist actions beyond their intended authorization level...

7.8CVSS0.00118EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/16 2:42 p.m.13 views

CVE-2026-59863 Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pu...

7CVSS6.2AI score
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/07/16 2:42 p.m.9 views

CVE-2026-59863

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pu...

7CVSS6.2AI score0.01123EPSS
SaveExploits0References5Affected Software1
Positive Technologies
Positive Technologies
added 2026/07/16 12:0 a.m.19 views

PT-2026-60482

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.5 Description Kiota, an OpenAPI based HTTP Client code generator, fails to validate outputPath values for clients and plugins within the .kiota/workspace.json configuration file. This allows a malicious repository ...

7CVSS5.9AI score0.01123EPSS
SaveExploits0References9
NVD
NVD
added 2026/07/15 12:18 p.m.11 views

CVE-2026-61440

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to...

7.1CVSS0.00213EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/15 11:25 a.m.13 views

EUVD-2026-44644

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to...

7.1CVSS6.1AI score0.00213EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/15 11:25 a.m.19 views

CVE-2026-61440

CVE-2026-61440 affects the PraisonAI Platform prior to 0.1.9. The issue is an authorization flaw in label and issue-label mutations that lets workspace members with basic privileges rename and recolor shared labels and add/remove labels on owner-created issues. The root cause is improper authoriz...

7.1CVSS6.1AI score0.00213EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/15 11:25 a.m.41 views

CVE-2026-61440 PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to...

7.1CVSS0.00213EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/15 11:25 a.m.10 views

CVE-2026-61440 PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to...

7.1CVSS6.1AI score
SaveExploits0References5
Veracode
Veracode
added 2026/07/15 7:12 a.m.10 views

Path Traversal

SiYuan is vulnerable to Path Traversal. The vulnerability is due to improper validation of double URL-encoded path traversal sequences in the /assets/path route, where attackers can bypass path restrictions to read arbitrary files within the workspace directory, exposing sensitive configuration...

7.5CVSS6.2AI score0.01892EPSS
SaveExploits0References2Affected Software1
NVD
NVD
added 2026/07/14 5:16 a.m.15 views

CVE-2026-15629

A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The...

6.5CVSS0.00288EPSS
SaveExploits0References6
NVD
NVD
added 2026/07/14 4:17 a.m.17 views

CVE-2026-15626

A vulnerability was determined in nextlevelbuilder GoClaw 3.13.3-beta.3. This affects the function writeFile of the file internal/providers/acp/toolbridge.go of the component ACP ToolBridge Workspace Handler. This manipulation causes path traversal. The attack is possible to be carried out...

6.5CVSS0.00294EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/07/14 3:30 a.m.10 views

EUVD-2026-43618

A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The...

6.5CVSS6.3AI score0.00288EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/14 3:30 a.m.7 views

CVE-2026-15629 louisho5 picobot Workspace filesystem.go GetSkill link following

A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The...

5.3CVSS6.3AI score
SaveExploits0References8
NVD
NVD
added 2026/07/14 2:16 a.m.14 views

CVE-2026-15622

A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function getworkspacefile of the file executormanager/app/api/v1/workspace.py of the component Workspace API. Executing a manipulation of the argument userid can lead to authorization bypass. The attack may be launched...

6.9CVSS0.00353EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/07/14 2:15 a.m.8 views

EUVD-2026-43615

A vulnerability was determined in nextlevelbuilder GoClaw 3.13.3-beta.3. This affects the function writeFile of the file internal/providers/acp/toolbridge.go of the component ACP ToolBridge Workspace Handler. This manipulation causes path traversal. The attack is possible to be carried out...

6.5CVSS6.3AI score0.00294EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/14 2:15 a.m.7 views

CVE-2026-15626 nextlevelbuilder GoClaw ACP ToolBridge Workspace tool_bridge.go writeFile path traversal

A vulnerability was determined in nextlevelbuilder GoClaw 3.13.3-beta.3. This affects the function writeFile of the file internal/providers/acp/toolbridge.go of the component ACP ToolBridge Workspace Handler. This manipulation causes path traversal. The attack is possible to be carried out...

5.3CVSS6.3AI score
SaveExploits0References9
Rows per page
Query Builder