Lucene search
+L

60582 matches found

OSV
OSV
added 2026/06/18 5:22 p.m.10 views

GHSA-HXPF-9XVQ-WPH8 netlicensing-mcp: REST Path Traversal Bypasses Token Redaction

REST Path Traversal Bypasses Token Redaction in netlicensing-mcp Summary The netlicensinggetproduct MCP tool in netlicensing-mcp interpolates a caller-controlled productnumber argument directly into a REST URL path without any validation. Passing ../token as the product number causes httpx to...

9.6CVSS5.6AI score
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/06/18 5:22 p.m.22 views

netlicensing-mcp: REST Path Traversal Bypasses Token Redaction

REST Path Traversal Bypasses Token Redaction in netlicensing-mcp Summary The netlicensinggetproduct MCP tool in netlicensing-mcp interpolates a caller-controlled productnumber argument directly into a REST URL path without any validation. Passing ../token as the product number causes httpx to...

5.5AI score
SaveExploits0References2Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/18 5:20 p.m.20 views

AgenticMail: Cross-agent task authorization bypass in AgenticMail API

Summary A low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=. The returned task objects include the task IDs and payloads. The same task IDs can then be used with the...

7.1CVSS5.7AI score0.0022EPSS
SaveExploits0References2Affected Software1
NVD
NVD
added 2026/06/18 5:16 p.m.22 views

CVE-2026-11982

Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting XSS vulnerability in the Admin2 Pages API save flow...

5.1CVSS0.00475EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/06/18 4:22 p.m.40 views

CVE-2026-11982 Stored XSS via missing XSS safety check in Admin2 Pages API partial validation

Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting XSS vulnerability in the Admin2 Pages API save flow...

5.1CVSS0.00475EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/06/18 4:22 p.m.18 views

EUVD-2026-37916

Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting XSS vulnerability in the Admin2 Pages API save flow...

5.1CVSS4.8AI score0.00475EPSS
SaveExploits0References4
CVE
CVE
added 2026/06/18 4:22 p.m.34 views

CVE-2026-11982

Technical details about this CVE are not publicly available in the provided documents. Monitor for updates and refer to the cited references for any forthcoming specifics.

5.1CVSS4.8AI score0.00475EPSS
SaveExploits0References4
OSV
OSV
added 2026/06/18 4:22 p.m.7 views

CVE-2026-11982 Stored XSS via missing XSS safety check in Admin2 Pages API partial validation

Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting XSS vulnerability in the Admin2 Pages API save flow...

5.1CVSS5.8AI score
SaveExploits0References6
Snyk
Snyk
added 2026/06/18 3:5 p.m.10 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the /api/site/find route. An attacker can access sensitive page information, including full content and metadata, by sending requests with known or guessed page IDs or UUIDs as an authenticated user. This is on...

7.1CVSS5.9AI score0.00269EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/06/18 3:5 p.m.22 views

Kirby: `pages.access` permission is not checked in the `site/find` REST API route

TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access pages pages.access permission is disabled. This can be due to configuration in the user blueprints, options in the model blueprints, or a combination of both settings. It was possible to...

7.1CVSS5.4AI score0.00269EPSS
SaveExploits0References4Affected Software1
OSV
OSV
added 2026/06/18 3:5 p.m.16 views

GHSA-R3W8-2C5R-H9J9 Kirby: `pages.access` permission is not checked in the `site/find` REST API route

TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access pages pages.access permission is disabled. This can be due to configuration in the user blueprints, options in the model blueprints, or a combination of both settings. It was possible to...

7.1CVSS5.5AI score0.00269EPSS
SaveExploits0References4
OSV
OSV
added 2026/06/18 2:27 p.m.18 views

GHSA-JXCW-QP4H-6JFQ PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

Summary The published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint: text praisonai serve...

7.5CVSS5.5AI score
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/06/18 1:57 p.m.27 views

PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints

PraisonAI AgentTeam.launch exposes unauthenticated remote agent invocation endpoints Summary PraisonAI's documented Python AgentTeam.launch / Agents.launch HTTP server starts externally reachable agent invocation endpoints without any authentication enforcement. The current implementation registe...

5.7AI score
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/06/18 1:57 p.m.17 views

GHSA-RJVW-7VVW-549V PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

Jobs webhook SSRF protection bypass via DNS rebinding Summary PraisonAI's Async Jobs API validates webhookurl when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network reques...

7.2CVSS5.6AI score
SaveExploits0References2
OSV
OSV
added 2026/06/18 1:57 p.m.18 views

GHSA-FQ2M-6WQH-X44G PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

praisonai: Jobs API exposes agent-execution endpoints with no authentication Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai on PyPI Affected version empirically tested: 4.6.48...

9.8CVSS6.6AI score
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/06/18 1:56 p.m.23 views

praisonai: recipe serve auth middleware silently disables itself when no secret is set

praisonai: recipe serve authentication middleware silently disables itself when no secret is set Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai on PyPI Version tested: 4.6.48...

6AI score
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/06/18 1:56 p.m.24 views

GHSA-P4PJ-VH7H-6CQH PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API

Summary An unauthenticated attacker can read arbitrary files on the server by supplying an absolute filesystem path in the agentfile field of the Jobs API. The field has no path validation, no allowlist, and no authentication is required to submit jobs. Details The agentfile field in...

7.5CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/18 1:56 p.m.10 views

Directory Traversal

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

8.7CVSS6.5AI score
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/06/18 1:52 p.m.18 views

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard Summary PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in...

6.3AI score
SaveExploits0References2Affected Software1
Snyk
Snyk
added 2026/06/18 1:52 p.m.8 views

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error in the JWT validation process. An attacker can gain unauthorized access by presenting a validly signed token from a trusted issuer, originally intended for a different service, to the authentication system. This ...

4.2CVSS6AI score0.00112EPSS
SaveExploits0References2
Rows per page
Query Builder