PraisonAI 安全漏洞

PraisonAI is a low-code multi-agent collaboration framework developed by Mervin Praison. Versions of PraisonAI prior to 4.5.97 contained security vulnerabilities. These vulnerabilities stemmed from the lack of authentication for WebSocket connections and information endpoints on the PraisonAI...

PT-2026-30003

Name of the Vulnerable Software and Affected Versions Electron versions prior to 38.8.6, 39.8.1, 40.8.1, and 41.0.0 Description On Windows, the app.setAsDefaultProtocolClientprotocol function did not validate the protocol name before writing to the registry. Passing untrusted input as the protoco...

Security update for keybase-client (important)

openSUSE Security Update: Security update for keybase-client Announcement ID: openSUSE-SU-2026:0117-1 Rating: important References: 1253563 1253864 1254023 Cross-References: CVE-2025-47913 CVE-2025-47914 CVE-2025-58181 CVSS scores: CVE-2025-47913 SUSE: 8.7...

PT-2026-30014

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.2.8 Description Ech0, a self-hosted publishing platform, has an unsafe link preview feature. The GET /api/website/title endpoint is unauthenticated and accepts attacker-controlled URLs. It performs a server-side GET...

The vulnerability of the TrueConf Client software lies in the fact that code can be loaded without checking its integrity, allowing an attacker to execute arbitrary code.

The vulnerability of the TrueConf Client software lies in the fact that the code is loaded without any checks for its integrity. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by introducing a specially crafted DLL file...

The vulnerability in the function `drcm_client_modeset_probe()` of the `drivers/gpu/drm/drm_client_modeset.c` file, a part of the Direct Rendering Infrastructure (DRI) driver for the Linux operating system, allows a hacker to cause a service failure.

The vulnerability of the drmclientmodesetprobe function in the drivers/gpu/drm/drmclientmodeset.c file of the Direct Rendering Infrastructure DRI driver module in the Linux operating system is related to improper memory release memory leak. Exploiting this vulnerability could allow an attacker to...

The vulnerability of the cifs_readpage_worker() function in the fs/smb/client/file.c module of the SMB client support library in Linux kernel allows a hacker to cause a service failure.

The vulnerability of the cifsreadpageworker function in the fs/smb/client/file.c module of the SMB client support library in Linux kernel involves the occurrence of mutual locking. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the bl_unregister_scsi() function in the fs/nfs/blocklayout/dev.c module, which is part of the NFS client support in Linux kernel, allows a attacker to cause a service failure.

The vulnerability of the blunregisterscsi function in the fs/nfs/blocklayout/dev.c module, which is part of the NFS client support in Linux kernel, relates to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

SUSE CVE-2026-34517

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking clientmaxsize. This issue has been patched in version 3.13.4...

CVE-2025-43187

creationtimestamp| type| source ---|---|--- 2026-04-02 22:19:09+00:00| seen| Telegram/t8lhBZO3-bZ9TFsvX2iDt2pY-voUNRZC7A74h2p8is6Io 2026-04-02 22:19:32+00:00| seen| Telegram/twQJKlobqCRh9RL5tSZmpMuaBSUEPIk0d1syiBwJwFL7d0...

CVE-2025-24229

creationtimestamp| type| source ---|---|--- 2026-04-02 22:14:33+00:00| seen| Telegram/2E5zGnFDFPvCqW-8Fv5TCu3RrGIbsxTzgaNWgYN4u84o0k...

EUVD-2026-18554

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials...

CVE-2026-35467

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials...

@jsprismarine/client (>=0.12.2-unstable-20250320195345, <=0.13.1), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.13.1) +1 more potentially affected by CVE-2026-34950 via fast-jwt (>=6.0.0, <=6.0.1)

fast-jwt NPM version =6.0.0, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.13.1 Source cves: CVE-2026-34950 Source advisory: OSV:GHSA-MVF2-F6GM-W987...

CVE-2026-35467

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials...

CVE-2026-5418

A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java of the component Dashboard. Such manipulation leads to server-side request forgery. The...

GO-2026-4911 Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF) in github.com/docker/model-runner

Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery SSRF in github.com/docker/model-runner...

EUVD-2026-18362

A weakness has been identified in Trendnet TEW-657BRM 1.00.1. This affects the function addwpsclient of the file /setup.cgi. This manipulation of the argument wlenroleepin causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and coul...

CVE-2026-5418

The CVE affects appsmith.org Appsmith Dashboard up to version 1.97, specifically the computeDisallowedHosts function in WebClientUtils.java. The issue enables server-side request forgery (SSRF) and may be exploitable remotely; an exploit is publicly available. Mitigation provided in the sources i...

CVE-2026-5418 appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery

A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java of the component Dashboard. Such manipulation leads to server-side request forgery. The...