PT-2026-64107

PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal Summary PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The SDK reference describes the module as providing: - artifact storage for tool...

Security update for gawk (moderate)

openSUSE security update: security update for gawk ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21393-1 Rating: moderate References: bsc1271351 bsc1271352 bsc1271354 Cross-References: CVE-2026-40467 CVE-2026-40468 CVE-2026-40553 CVSS scores:...

Cisco IOS 12.4 HTTP Server Cross-Site Request Forgery (CVE-2008-4128)

According to its self-reported version, Cisco IOS 12.4 is affected by multiple cross-site request forgery CSRF vulnerabilities in the HTTP administration component. An unauthenticated, remote attacker can exploit these by persuading an authenticated user to follow a malicious link, allowing...

TencentOS Server 2: freerdp (TSSA-2026:0752)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0752 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

RHEL 9 : kpatch-patch-5_14_0-427_100_1, kpatch-patch-5_14_0-427_113_1, kpatch-patch-5_14_0-427_126_1, kpatch-patch-5_14_0-427_68_2, and kpatch-patch-5_14_0-427_84_1 (RHSA-2026:44006)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:44006 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

PT-2026-64113

DiscordApproval accepts unrelated channel messages as dangerous-tool approvals Summary praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. The decision is...

PT-2026-64131

Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the /api/v1/runs endpoint...

PT-2026-64046

Summary PhpSpreadsheet's Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data large...

TencentOS Server 2: freerdp (TSSA-2026:0754)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0754 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Security update for the Linux Kernel (important)

openSUSE security update: security update for the linux kernel ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21388-1 Rating: important References: bsc1149651 bsc1204315 bsc1236743 bsc1255029 bsc1257506 bsc1258538 bsc1259800 bsc1260565 bsc1261250...

Security update for libgcrypt (moderate)

openSUSE security update: security update for libgcrypt ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21387-1 Rating: moderate References: bsc1262684 Cross-References: CVE-2026-41989 CVSS scores: CVE-2026-41989 SUSE : 6.3...

Security update for ImageMagick (moderate)

openSUSE security update: security update for imagemagick ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21391-1 Rating: moderate References: bsc1268640 bsc1270006 bsc1270081 bsc1271100 bsc1271293 bsc1271294 bsc1271311 bsc1271312 bsc1271313...

Security update for gpg2 (low)

openSUSE security update: security update for gpg2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21385-1 Rating: low References: bsc1269279 Cross-References: CVE-2026-57062 CVSS scores: CVE-2026-57062 SUSE : 2.9...

SUSE SLES12 Security Update : joe (SUSE-SU-2026:3196-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3196-1 advisory. This update for joe fixes the following issue - CVE-2026-13412: arbitrary command execution via malicious tags file bsc1269379. Tenable has extracted t...

RHEL 9 : kpatch-patch-5_14_0-284_117_1, kpatch-patch-5_14_0-284_134_1, kpatch-patch-5_14_0-284_148_1, kpatch-patch-5_14_0-284_158_1, and kpatch-patch-5_14_0-284_172_1 (RHSA-2026:44003)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:44003 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module ...

RHEL 8 : kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_143_1, and kpatch-patch-4_18_0-477_97_1 (RHSA-2026:43847)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:43847 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module ...

RHEL 8 : kpatch-patch-4_18_0-553_109_1, kpatch-patch-4_18_0-553_125_1, kpatch-patch-4_18_0-553_53_1, kpatch-patch-4_18_0-553_72_1, and kpatch-patch-4_18_0-553_85_1 (RHSA-2026:44004)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:44004 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module ...

Command Injection

Overview @syncfusion/ej2-base is an A common package of Essential JS 2 base libraries, methods and class definitions Affected versions of this package are vulnerable to Command Injection via the use of childprocess.exec function which uses the package name from package.json without escaping befor...

CVE-2026-16631

A vulnerability was detected in publint up to 0.1.4. This impacts the function childprocess.exec of the file src/node/pack.js of the component package-manager Command Handler. The manipulation results in os command injection. Attacking locally is a requirement. The exploit is now public and may b...

CVE-2026-16631

The CVE-2026-16631 entry concerns publint up to version 0.1.4 where the pack.js file in the package-manager Command Handler uses child_process.exec, enabling os command injection. Local attack required; exploit is public. A patch identified as adf2d9a09945fc98c85a2520a89f441d78b2dbd8 exists and s...