PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

The MCP SSE server started via ToolsMCPServer.runsse / launchtoolsmcpservertransport="sse"binds to 0.0.0.0 by default and builds its Starlette application with no authentication middlewareand no Origin-header validation. The module mcp/mcpsecurity.py provides exactly the needed controlsorigin...

PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint

SummaryThe SSE Server-Sent Events server in src/praisonai-agents/praisonaiagents/server/server.py exposes a /publish endpoint that broadcasts arbitrary messages to all connected clients without any authentication. The ServerConfig dataclass line 24 defines an authtoken field, but this token is...

gitpython: GitPython: Remote Code Execution via Newline Injection in config_writer()

A flaw was found in GitPython. This vulnerability allows attackers to inject newline characters into the section parameter of the configwriter function, leading to the injection of arbitrary section headers into the .git/config file. By forging a core section with a malicious hooksPath, an attack...

CVE-2026-16723 Remote Code Execution in fastjson 1.2.68–1.2.83

A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...

PT-2026-63975

Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential...

PT-2026-64008

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/RetentionPolicyWizard.aspx. The injected payload is stored by...

PT-2026-64010

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by...

PT-2026-64077

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

MAL-2026-11007 Malicious code in web3-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bff469765665422f3b9a6dd9978d99ddab9f853b02109f154c97b634977cf223 On npm install, package.json scripts.postinstall runs test.js, which invokes routines in index.js that 1 walk the current working directory for id.js...

GO-2026-6048 Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override in gitea.dev

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override in gitea.dev...

Malicious code in n8n-nodes-pwn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae8222d3f90f4cff83a0840ee03f4b127946274f0215a73eadd6008404a2276e The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP socket to 10.0.0.145:4444 an...

Malicious code in app-data-ist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37bd61826219d14386d02eed926659dfcfcac94d7b414ae6dd6bcdd4a039fab3 On npm install, the package's postinstall hook node test.js auto-executes multiple attacker-controlled operations against the installer's machine. 1...

CVE-2026-50540

A flaw was found in Kata Containers, affecting both its Rust and Go runtimes. An authenticated pod user can exploit this by setting the io.katacontainers.configpath annotation to an arbitrary configuration file on the host. This allows the attacker to control privileged runtime settings, leading ...

CVE-2026-13184

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock...

CVE-2026-44187

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

EUVD-2026-47653

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

[SECURITY] Fedora 44 Update: btrbk-0.32.7-1.fc44

Backup tool for btrfs sub-volumes, using a configuration file, allows creation of backups from multiple sources to multiple destinations, with ssh and flexible retention policy support hourly, daily, weekly, monthly...

EUVD-2026-47317

Vulnerability in Oracle GoldenGate component: Config Service Executable. Supported versions that are affected are 23.4-23.26.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability...

EUVD-2026-46479

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Enterprise Config Management. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

EUVD-2026-46480

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Enterprise Config Management. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where...