CVE-2026-46984

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Next Gen. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

CVE-2026-46986

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Next Gen. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

CVE-2026-46985

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Next Gen. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-67)

Missing Authorization in Kibana Leading to Unauthorized Information Disclosure Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space...

CVE-2026-50271 vulnerabilities

Vulnerabilities for packages: datadog-agent...

GHSA-MW54-J2V2-42HR vulnerabilities

Vulnerabilities for packages: datadog-agent...

CVE-2026-47419

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The agent CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/agents/agentid gate access on requireworkspacememberworkspaceid only, then...

CVE-2026-47419 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The agent CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/agents/agentid gate access on requireworkspacememberworkspaceid only, then...

CVE-2026-47419

CVE-2026-47419 concerns PraisonAI Platform where agent endpoints under /workspaces/{workspace_id}/agents/{agent_id} suffer an Insecure Direct Object Reference. The description and connected reports show that endpoints gate access with require_workspace_member(workspace_id) but the AgentService.ge...

CVE-2026-47419 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The agent CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/agents/agentid gate access on requireworkspacememberworkspaceid only, then...

CVE-2026-47396

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when CALLSERVERTOKEN is not configured. The affected component is the praisonai.api.agentinvoke router as mounted by praisonai.api.call. The...

CVE-2026-47391

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculateexpression tool implemented with Python eval. The example also binds to 0.0.0.0. A remote unauthenticated attacker...

CVE-2026-47396 PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when CALLSERVERTOKEN is not configured. The affected component is the praisonai.api.agentinvoke router as mounted by praisonai.api.call. The...

CVE-2026-47396 PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when CALLSERVERTOKEN is not configured. The affected component is the praisonai.api.agentinvoke router as mounted by praisonai.api.call. The...

CVE-2026-47396

Plausible vulnerability CVE-2026-47396 affects PraisonAI’s call server. Before version 4.6.40, the network-facing API under praisonai.api.agent_invoke (mounted by praisonai.api.call) authenticates fail-open when CALL_SERVER_TOKEN is not configured, exposing unauthenticated access on 0.0.0.0. Endp...

CVE-2026-47391

PraisonAI’s first-party A2A example exposes an unauthenticated /a2a JSON-RPC surface and registers a calculate(expression) tool implemented via Python eval(), bound to 0.0.0.0. A remote attacker can send message/send to a2a, causing the LLM to invoke the unsafe tool and potentially execute arbitr...

CVE-2026-47391 PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculateexpression tool implemented with Python eval. The example also binds to 0.0.0.0. A remote unauthenticated attacker...

GHSA-MW54-J2V2-42HR vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, datadog-agent, litellm...

CVE-2026-50271 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, datadog-agent, litellm...

Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs

An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more steps, and the same app is running commands on the PC driving the agent. Researchers demonstrated that chain, plus six...