Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by a Resource Allocation Vulnerability in Netty (CVE-2026-45416)

Summary Netty is used by IBM UrbanCode Deploy UCD for network communication. CVE-2026-45416. Vulnerability Details CVEID:CVE-2026-45416 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by an HTTP Request/Response Splitting Vulnerability in Netty (CVE-2026-42578)

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD for network communication. CVE-2026-42578. Vulnerability Details CVEID:CVE-2026-42578 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is is susceptible to multiple Netty vulnerabilities CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD for network communication. CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585. Vulnerability Details CVEID:CVE-2026-42580 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by an Improper Input Validation Vulnerability in Netty (CVE-2026-42579)

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD for network communication. CVE-2026-42579. Vulnerability Details CVEID:CVE-2026-42579 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the JWT authorization. An attacker can gain unauthorized access to LFS objects belonging to other repositories by leveraging a write deploy key and knowledge of valid object...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the JWT authorization. An attacker can gain unauthorized access to LFS objects belonging to other repositories by leveraging a write deploy key and knowledge of valid object...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the JWT authorization. An attacker can gain unauthorized access to LFS objects belonging to other repositories by leveraging a write deploy key and knowledge of valid object...

GHSA-RH79-75QM-GWJR Gitea LFS Deploy-Key Privilege Escalation

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location |...

Gitea LFS Deploy-Key Privilege Escalation

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location |...

CVE-2026-47394

CVE-2026-47394 describes an unauthenticated file-read vulnerability in PraisonAI’s MCP server. The issue stems from a dispatcher in server.py that enforces no strict schema on JSON arguments fed to handlers (via kwargs ), allowing tools like workflow.show, workflow.validate, and deploy.validate t...

CVE-2026-47394 PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in mcpserver/adapters/clitools.py. Commit 68cc9427 "fixsecurity: harden MCP rules path handling…" adde...

CVE-2026-47394 PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in mcpserver/adapters/clitools.py. Commit 68cc9427 "fixsecurity: harden MCP rules path handling…" adde...

CVE-2026-47394 PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in mcpserver/adapters/clitools.py. Commit 68cc9427 "fixsecurity: harden MCP rules path handling…" adde...

PT-2026-63301

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.5 Description An insufficient authorization issue exists in the LFS server where the system uses the UserID embedded in an LFS JWT to make cross-repository authorization decisions via the LFSObjectAccessible function. When a...

Malicious code in @public-for-cdao/deploy (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10886 Malicious code in @public-for-cdao/deploy (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in twilio-deploy (npm)

The twilio-deploy package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

GO-2026-5938 Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy...

CVE-2026-61433

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agentsfile configuration parameters that execute when the generated server starts or...

EUVD-2026-44640

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agentsfile configuration parameters that execute when the generated server starts or...