20108 matches found
K000162282: Node.js vulnerabilities CVE-2026-48931 and CVE-2026-48934
Security Advisory Description CVE-2026-48931 A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26. CVE-2026-48934 A flaw in...
CVE-2026-61435
PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints src/praisonai/praisonai/api/agentinvoke.py when PRAISONAICALLAUTH=disabled is configured. The safeguard intended to restrict the disabled-auth opt-out to localhost binding derives the bind host fr...
undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy
A flaw was found in undici. When undici's ProxyAgent is configured with a SOCKS5 proxy Uniform Resource Identifier URI, it silently ignores Transport Layer Security TLS options, such as custom Certificate Authorities CAs. This allows a remote attacker to perform a Man-in-the-Middle MITM attack,...
EUVD-2026-44641
PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints src/praisonai/praisonai/api/agentinvoke.py when PRAISONAICALLAUTH=disabled is configured. The safeguard intended to restrict the disabled-auth opt-out to localhost binding derives the bind host fr...
CVE-2026-61435 PraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing
PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints src/praisonai/praisonai/api/agentinvoke.py when PRAISONAICALLAUTH=disabled is configured. The safeguard intended to restrict the disabled-auth opt-out to localhost binding derives the bind host fr...
CVE-2026-61435
PraisionAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints (src/praisonai/praisonai/api/agent_invoke.py) when PRAISONAI_CALL_AUTH=disabled is configured. The localhost-only restriction is derived from request.url.hostname via the client-controlled Host h...
CVE-2026-61435 PraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing
PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints src/praisonai/praisonai/api/agentinvoke.py when PRAISONAICALLAUTH=disabled is configured. The safeguard intended to restrict the disabled-auth opt-out to localhost binding derives the bind host fr...
CVE-2026-56699
Wazuh Manager before 5.0.0-beta3 has a vulnerability where the DataValue.index field is not escaped when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed und...
CVE-2026-56699 Wazuh Manager - NDJSON Injection in inventory_sync via Agent-Controlled DataValue.index
Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin...
Exploit for CVE-2025-60357
CVE-2025-60357- NoSQLMongoDB Injection Vulnerab...
PT-2026-60186
Name of the Vulnerable Software and Affected Versions NGINX Agent affected versions not specified Description An issue exists where the config dirs directive allows a remotely authenticated low-privileged attacker to obtain limited read and write access to files located outside of the designated...
DEBIAN-CVE-2026-48125
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application th...
nebula-mesh: Certificate revocation is never enforced at the mesh
Summary nebula-mesh revokes a host by adding its certificate fingerprint to a per-CA blocklist and shipping that list to every other agent on each poll. Slack's Nebula enforces certificate revocation ONLY through the pki.blocklist list in config.yml no CRL/OCSP. The project's own code states this...
GHSA-CM26-5974-52H8 nebula-mesh: Certificate revocation is never enforced at the mesh
Summary nebula-mesh revokes a host by adding its certificate fingerprint to a per-CA blocklist and shipping that list to every other agent on each poll. Slack's Nebula enforces certificate revocation ONLY through the pki.blocklist list in config.yml no CRL/OCSP. The project's own code states this...
EUVD-2026-37897
Woodpecker gRPC agentid metadata can be spoofed- cross-tenant agent impersonation...
GHSA-G7MM-9VX7-JM7H Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation
Impact A vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged agentid value into outgoing gRPC metadata. The server correctly verified the JWT token but then discarded the verified agent identity in fav...
EUVD-2026-43792
Improper certificate validation in Azure Monitor Agent allows an unauthorized attacker to elevate privileges over an adjacent network...
Vulnerabilities in Microsoft Azure
Microsoft has identified vulnerabilities in various Azure components. Malicious actors could exploit these vulnerabilities to cause denial-of-service attacks, circumvent security measures, or gain elevated privileges, potentially allowing them to access data that they were not originally authoriz...