hass-auth-synology (>=0.4.13, <=0.4.28), homeassistant-stubs (2022.12.9) potentially affected by CVE-2026-64825 via homeassistant (2022.12.9)

homeassistant PYPI version 2022.12.9 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - hass-auth-synology =0.4.13, =0.4.28 - homeassistant-stubs 2022.12.9 Source cves: CVE-2026-64825 Source advisory:...

Exploit for Code Injection in Craftcms Craft_Cms

CVE-2025-32432 Craft CMS Pre-Auth RCE PoC Critical Pre-Auth...

CVE-2026-47393

PraisonAI is a multi-agent teams system. CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator praisonai.deploy.api.generateapiservercode that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart praisonai deploy...

CVE-2026-47393 PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

PraisonAI is a multi-agent teams system. CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator praisonai.deploy.api.generateapiservercode that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart praisonai deploy...

EUVD-2026-46297

PraisonAI is a multi-agent teams system. CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator praisonai.deploy.api.generateapiservercode that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart praisonai deploy...

CVE-2026-47393 PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

PraisonAI is a multi-agent teams system. CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator praisonai.deploy.api.generateapiservercode that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart praisonai deploy...

ANT-2026-M8R2AWBV · linux · other

other high Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-M8R2AWBV: ksmbd SMB-Direct: pre-auth remote heap overflow via preferredsendsize signedness mintint Pre-auth remot...

CVE-2026-61096: Improper Access Control

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows...

CVE-2026-43945: Improper Control of Generation of Code

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution RCE as root. The exploit succeeds even when the platform is configured in its most secure state Secure Mode Enabled an...

GHSA-7Q8Q-RJ6J-MHJQ Axios: Nested axios option objects can consume polluted prototype values

Summary Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype. The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into ordinar...

GHSA-8WC8-HF36-MJH9 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

Wp2Shell

WordPress REST API Desync + SQL Injection Proof-of-concept fo...

NPM: Axios: Prototype pollution auth subfields can inject Basic auth

NPM: Axios: Prototype pollution auth subfields can inject Basic auth vulnerability discovered by ? in WordPress Npm axios versions = 1.15.2, 1.18.0...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the Basic authentication header construction in lib/adapters/http.js and lib/helpers/resolveConfig.js, which read the username and password from th...

GHSA-XJ6Q-8X83-JV6G Axios: Prototype pollution auth subfields can inject Basic auth

Summary Axios versions after the GHSA-q8qp-cvcw-x6jj fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype pollution and then makes an axios request with an own auth object that omits username or password,...

Axios: Prototype pollution auth subfields can inject Basic auth

Summary Axios versions after the GHSA-q8qp-cvcw-x6jj fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype pollution and then makes an axios request with an own auth object that omits username or password,...

CVE-2026-54538

CVE-2026-54538 affects xrdp up to version 0.10.6, where the server fails to validate the totalLength field in the RDP protocol control header. An unauthenticated attacker can send a crafted packet that makes the xrdp process enter an infinite, CPU‑bound loop, due to a pointer not advancing and by...

CVE-2026-54538 xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER

xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sendin...

CVE-2026-54538 xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER

xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sendin...

CVE-2026-58482

Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called ApprovalInbox lib/approval-inbox.ts. It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit human approval for high-risk operations...