GHSA-2JGC-F764-C5R2 PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

Summary PraisonAI's async Jobs API the FastAPI service in praisonai/jobs/ installs its router with no authentication middleware, no router-level dependency, and no per-route auth check. Any caller who can reach the jobs server can submit agent jobs executed against the operator's configured LLM...

PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

Summary PraisonAI's async Jobs API the FastAPI service in praisonai/jobs/ installs its router with no authentication middleware, no router-level dependency, and no per-route auth check. Any caller who can reach the jobs server can submit agent jobs executed against the operator's configured LLM...

PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated

Summary praisonai serve agents exposes HTTP routes that invoke registered agents. The CLI advertises --api-key with help text "API key for authentication", parses it, and forwards it into ServeHandler. But createagentsapp never reads config"apikey" again and installs no auth dependency or...

GHSA-R7V3-X45F-G7HP PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated

Summary praisonai serve agents exposes HTTP routes that invoke registered agents. The CLI advertises --api-key with help text "API key for authentication", parses it, and forwards it into ServeHandler. But createagentsapp never reads config"apikey" again and installs no auth dependency or...

PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

Summary PraisonAI's praisonai.code tool wrappers exported as CODETOOLS for agents expose a workspace setting that the module itself treats as a path-traversal security boundary — readfile, writefile, applydiff, and searchreplace explicitly call ispathwithindirectory and return "… is outside the...

GHSA-CH89-H4R2-C8F8 PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

Summary PraisonAI's praisonai.code tool wrappers exported as CODETOOLS for agents expose a workspace setting that the module itself treats as a path-traversal security boundary — readfile, writefile, applydiff, and searchreplace explicitly call ispathwithindirectory and return "… is outside the...

Exploit for Use After Free in Linux Linux_Kernel

pixel-ksu-root An adb-driven tool that turns a stock, locked-...

E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands

Cybersecurity researchers are calling attention to a new campaign that employs FTP banners as dead drop resolvers DDRs to deliver two previously unreported remote access trojans RATs tracked as E4del and PINHOLE. While threat actors are known to abuse legitimate services to point to additional...

Design-and-Evaluation-of-an-MCP-Governed-Pentest-Agent

Design-and-Evaluation-of-an-MCP-Governed-Pentest-Agent Dissert...

Malicious code in hydration-cls-ui (npm)

Source: amazon-inspector 01c60e3a0dd707077bad78ec7f0e5f79032dc9b86814d65bfd0083275a6059de The package advertises itself as a dependency-free streak/date-math library but ships an x8664 Linux ELF at dist/internal/calc.dat and auto-launches it. The main module dist/index.mjs contains a top-level II...

Malicious code in hydration-cls-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c60e3a0dd707077bad78ec7f0e5f79032dc9b86814d65bfd0083275a6059de The package advertises itself as a dependency-free streak/date-math library but ships an x8664 Linux ELF at dist/internal/calc.dat and auto-launches...

MAL-2026-14489 Malicious code in hydration-cls-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c60e3a0dd707077bad78ec7f0e5f79032dc9b86814d65bfd0083275a6059de The package advertises itself as a dependency-free streak/date-math library but ships an x8664 Linux ELF at dist/internal/calc.dat and auto-launches...

lenovo-a1000g-mt8317-A412_01_09_130907-kernel-3.4.0-root-cve-2016-5195

Lenovo IdeaTab A1000G — Root Nota: Questa documentazione e il codice exploit sono stati generati con l'assistenza dell'AI Kiro. Verifica prima dell'uso — l'AI può e commette errori. Dispositivo Campo| Valore ---|--- Modello| Lenovo IdeaTab A1000G SoC| MediaTek MT8317 = MT6517 CPU| Dual-core...

Untrusted Search Path

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Untrusted Search Path through the dot2img function in nltk/parse/dependencygraph.py and the AlignedSent.reprsvg method in nltk/translate/api.py...

Duplicate Advisory: Uncontrolled search path when invoking the Graphviz 'dot' binary (CWE-426/CWE-427)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6hwm-xvph-95vm. This link is maintained to preserve external references. Original Description NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in...

GHSA-54XP-3WW7-6WJG Duplicate Advisory: Uncontrolled search path when invoking the Graphviz 'dot' binary (CWE-426/CWE-427)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6hwm-xvph-95vm. This link is maintained to preserve external references. Original Description NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in...

bearer v2.1.1

Scan your source code against top security and privacy risks. Bearer is a static application security testing SAST tool designed to scan your source code and analyze data flows to identify, filter, and prioritize security and privacy risks. Bearer offers a free, open solution, Bearer CLI, and a...

DEBIAN-CVE-2026-78680

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...

CVE-2026-78680

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...

CVE-2026-78680

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...