PT-2026-59013

A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function parse url/prepare image/openai audio to text of the file src/agentscope/tool/ multi modality/ openai tools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument...

PT-2026-59214

A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function get file id of the file libs/chatchat-server/chatchat/server/api server/openai routes.py of the component Uploaded File Handler. Performing a manipulation results in insufficiently...

PT-2026-59229

A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function create upload file of the file src/backend/base/Langflow/api/v1/endpoints.py of the component API Endpoint. The manipulation results in unrestricted upload. It is possible to launch the attack...

PT-2026-59222

A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove api keys/has api terms of the file src/backend/base/langflow/api/utils/core.py of the component Flow Using API. This manipulation causes unprotected storage of credentials. The attack can be...

PT-2026-59291

A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1. Impacted is the function get mime type of the file metagpt/utils/common.py. The manipulation results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The project was...

PT-2026-59150

A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api generate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be...

PT-2026-59177

A vulnerability was found in NousResearch hermes-agent 2026.4.23. The impacted element is the function scan context content of the file agent/prompt builder.py. The manipulation results in injection. The attack may be performed from remote. The exploit has been made public and could be used. The...

PT-2026-60009

A flaw has been found in vanna-ai vanna up to 2.0.2. This impacts the function remove training data of the file src/vanna/legacy/google/bigquery vector.py. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be...

PT-2026-59293

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. The impacted element is the function evaluateCode of the file metagpt/environment/minecraft/mineflayer/index.js of the component Mineflayer HTTP API. Executing a manipulation can lead to cross-site request forgery. The attack...

PT-2026-57608

A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the file build/server.cjs of the component update node from file. The manipulation of the argument filePath leads to path traversal. An attack has to be approached locally. The exploit...

PT-2026-57613

A flaw has been found in augmnt augments-mcp-server 7.1.0. This issue affects the function scanProjectDeps of the file src/tools/v4/scan-project-deps.ts of the component scan project deps. Executing a manipulation of the argument packageJsonPath can lead to path traversal. The attack can only be...

PT-2026-57862

A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFromStorageKey in the library src/lib/media/hash.ts of the component Media Handler. The manipulation of the argument storageKey results in improper authorization. The attack may be performed from...

PT-2026-57868

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /subject.php. Such manipulation of the argument subject leads to cross site scripting. It is possible to launch the attack remotely. The exploit is...

PT-2026-57876

Name of the Vulnerable Software and Affected Versions EIPStackGroup OpENer version 2.3.0 commit 76b95cf Description An out-of-bounds read occurs in the Connection Manager when handling ForwardOpen requests during the processing of short malformed packets. An unauthenticated remote attacker can...

PT-2026-57808

Name of the Vulnerable Software and Affected Versions CodeAstro Simple Online Leave Management System version 1.0 Description Remote SQL injection is possible due to improper handling of the ID variable in the '/SimpleOnlineLeave/admin/deletemp.php' endpoint. SQL injection is a technique where an...

PT-2026-59109

A vulnerability has been found in datapizza-labs datapizza-ai 0.0.7. Affected by this vulnerability is the function RedisCache of the file datapizza-ai-cache/redis/datapizza/cache/redis/cache.py. Such manipulation leads to deserialization. The attack requires being on the local network. A high...

PT-2026-57582

A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/install/controller/Index.php of the component Installation Module. The manipulation results in authorization bypass. The attack may be launched remotely. The attack requires a...

PT-2026-59589

A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be...

PT-2026-57649

A vulnerability was determined in Shibby Tomato up to 1.28.0000. Affected is the function getupsvar of the file www/apcupsd/tomatodata.cgi of the component apcupsd. This manipulation of the argument Field causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has be...

PT-2026-59590

A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validate restricted url of the component Webhook/Notification. The manipulation leads to time-of-check time-of-use. It is possible to initiate the attack remotely. The attack is...