24849 matches found
CVE-2026-13149
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attacker who passes a crafted string to expand, directly or transitively, can cause significant CPU consumption...
CVE-2026-45822
decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode function splits input on '%' producing N tokens and calls decodeComponents, exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately...
Oracle Linux 9 : kernel (ELSA-2026-25217)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-25217 advisory. - net/sched: fix pedit partial COW leading to page cache corruption Ivan Vecera RHEL-177392 CVE-2026-46331 - scsi: qla2xxx: Completely fix fcport doub...
PT-2026-53953
Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.4 Description An authenticated user can obtain sensitive information from the monitoring and event tables in IBM Db2 for Linux, UNIX, and Windows, including Db2 Connec...
PT-2026-53825
Name of the Vulnerable Software and Affected Versions decode-uri-component versions 0.4.1 and earlier Description A denial of service issue exists where the decode function splits input based on the '%' character, creating N tokens that are then processed by decodeComponents. This process results...
CVE-2026-13149
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attacker who passes a crafted string to expand, directly or transitively, can cause significant CPU consumption...
CVE-2026-43724
creationtimestamp| type| source ---|---|--- 2026-06-29 22:34:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphkcoxiw522 2026-06-30 14:43:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116839587167771946 2026-06-30 22:19:34+00:00| seen|...
CVE-2026-43721
creationtimestamp| type| source ---|---|--- 2026-06-29 22:34:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphkbgawne2b 2026-07-01 02:50:06+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0818 2026-07-01 16:01:00+00:00| seen|...
CVE-2026-53434
creationtimestamp| type| source ---|---|--- 2026-06-29 21:39:26+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mphh7h4ldu2c 2026-06-29 22:23:42+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mphjomprh623 2026-06-29 23:09:17+00:00| seen|...
CVE-2026-52760
creationtimestamp| type| source ---|---|--- 2026-06-29 21:38:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mphh55tg752z...
CVE-2026-50734
creationtimestamp| type| source ---|---|--- 2026-06-29 21:23:11+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mphgcet34j2s 2026-07-03 10:59:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqfd3inka2b...
CVE-2026-39031
creationtimestamp| type| source ---|---|--- 2026-06-29 20:02:51+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mphbsqpagi2y 2026-06-29 21:41:53+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphhdtfuob2e 2026-07-13 22:00:21+00:00| seen|...
CVE-2026-56782
creationtimestamp| type| source ---|---|--- 2026-06-29 18:34:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph4uzdfuk25 2026-06-29 22:40:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphkmtrak22m 2026-07-01 12:00:04+00:00| confirmed|...
CVE-2026-57959
Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob increments it, allowing attackers to redeem limited promo codes unlimited times. Attackers can sequentially reserve multiple orders with the...
CVE-2026-57953
Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations by accessing the eventingimportautomaticwebhook endpoint registered under spectator-permitted middleware. Attackers with spectator role can...
CVE-2026-57334
creationtimestamp| type| source ---|---|--- 2026-06-29 16:57:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgxhwfjod25 2026-06-29 20:40:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphdweu6zk2k 2026-07-31 16:44:08+00:00| seen|...
CVE-2026-13561
creationtimestamp| type| source ---|---|--- 2026-06-29 15:42:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgtam2pkz2d 2026-06-29 20:08:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphc5ek3da2o...
CVE-2026-13560
creationtimestamp| type| source ---|---|--- 2026-06-29 12:42:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgja2ndnm2n 2026-06-29 20:16:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphclnasu625...
PYSEC-2026-487 PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)
Summary The memory hooks executor in praisonaiagents passes a user-controlled command string directly to subprocess.run with shell=True at src/praisonai-agents/praisonaiagents/memory/hooks.py lines 303 to 305. No sanitization, no shlex.quote, no character filter, and no allowlist check exists...