CVE-2026-49803: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally...

Xalgorix Autonomous AI Pentesting Agent 4.5.59

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

PT-2026-58175

Name of the Vulnerable Software and Affected Versions Windows AppX Deployment Service affected versions not specified Description A race condition exists in the Windows AppX Deployment Service. This occurs when concurrent execution using a shared resource lacks proper synchronization, allowing an...

Veeam Management Pack for Microsoft System Center / Veeam Backup & Replication 13 Compatibility

Article Applicability The patch on this article only enables monitoring of Windows-based Veeam Backup & Replication 13.x deployments. Veeam Management Pack for Microsoft System Center 9a does not support monitoring Veeam Software Appliance. Challenge After Veeam Backup & Replication is upgraded t...

Veeam Software Appliance/Veeam Infrastructure Appliance — Updater Component Vulnerability

Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program VDP for all Veeam products and perform extensive internal code audits. When a vulnerability is...

EUVD-2026-43530

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWEDEXTENSIO...

Malicious code in polymarket-math-stake-kelly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 408b5fd87b4b328671330e1ddb9333eb5d68d9a873f30237bd886a7632f038b5 [email protected] runs scripts/install-check.cjs as a postinstall hook. The script reads a config URL defaulting to...

MAL-2026-10466 Malicious code in polymarket-math-stake-kelly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 408b5fd87b4b328671330e1ddb9333eb5d68d9a873f30237bd886a7632f038b5 [email protected] runs scripts/install-check.cjs as a postinstall hook. The script reads a config URL defaulting to...

PYSEC-2026-2470 ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override

Summary fides.js is the script that renders Fides's consent banner on customer websites. It lets the embedding page override the banner's description text at runtime via a URL query parameter, a JavaScript global, or a cookie. On sites that have opted into HTML-formatted descriptions, the...

PYSEC-2026-2910 PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)

Summary The Flask API endpoint in src/praisonai/api.py renders agent output as HTML without effective sanitization. The sanitizehtml function relies on the nh3 library, which is not listed as a required or optional dependency in pyproject.toml. When nh3 is absent the default installation, the...

Werkzeug possible resource exhaustion when parsing file data in forms

Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.maxformmemorysize setting.The Request.maxcontentlength setting, as well as resource limits provided by deployment software and platforms, a...

PYSEC-2026-3417 Werkzeug possible resource exhaustion when parsing file data in forms

Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.maxformmemorysize setting. The Request.maxcontentlength setting, as well as resource limits provided by deployment software and platforms,...

PT-2026-59274

Summary An unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL by supplying two custom HTTP headers without an Authorization header. No authentication is required. The...

PT-2026-59545

Summary The Flask API endpoint in src/praisonai/api.py renders agent output as HTML without effective sanitization. The sanitize html function relies on the nh3 library, which is not listed as a required or optional dependency in pyproject.toml. When nh3 is absent the default installation, the...

MTD-Playground: An Attacker-Aware Evaluation Framework for Network Moving Target Defense

Moving Target Defense MTD has emerged as a proactive network cyber defense paradigm that increases attacker uncertainty through dynamic network reconfiguration techniques such as Software-Defined Networking SDN-enabled path randomization. However, existing evaluations remain fragmented due to...

PT-2026-59553

Summary The AgentOS deployment platform exposes a GET /api/agents endpoint that returns agent names, roles, and the first 100 characters of agent system instructions to any unauthenticated caller. The AgentOS FastAPI application has no authentication middleware, no API key validation, and default...

Securing LLMs in the Wild: Privacy and Security Challenges at the Edge

Large Language Models LLMs are rapidly moving from research settings into the wild, deployed on enterprise infrastructure, personal devices, and edge platforms. While cloud deployments offer scalable compute, concerns over data sovereignty, compliance, latency, and third-party dependence are...

PT-2026-59559

Summary Type: Insecure Direct Object Reference. The GET /workspaces/workspace id/issues/issue id/activity endpoint is gated by require workspace memberworkspace id and dispatches to ActivityService.list for issueissue id, which executes SELECT FROM activity WHERE issue id = :issue id with no...

SoK: Federated Learning for Intrusion Detection in Vehicular Networks

Modern vehicular networks face an expanding attack surface across internal Electronic Control Units ECUs and external Vehicle-to-Everything V2X communication. Federated Learning FL has emerged as a decentralized paradigm to deploy Intrusion Detection Systems IDS without compromising data privacy...

Symlink Attack

Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...