PT-2026-38594

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21 Description A server-side request forgery SSRF issue exists in the notebook viewer. This occurs due to URL parser confusion between the validation layer and the HTTP request library, where the...

Cross-site Request Forgery (CSRF)

Overview misp-modules is a MISP modules are autonomous modules that can be used for expansion and other services in MISP Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the home blueprint, which was exempted from CSRF protection. An attacker can perform...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the processFuzzySearch function. An attacker can access and extract the entire database contents by supplying crafted input to the column parameter in the HTTP API, which is directly interpolated into raw SQL statement...

Arbitrary Code Injection

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

CVE-2026-45008

creationtimestamp| type| source ---|---|--- 2026-05-06 20:47:54+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-gh9p-q46p-57g2...

CVE-2026-46359

creationtimestamp| type| source ---|---|--- 2026-05-06 20:44:39+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-pm8c-3qq3-72w7...

CVE-2026-45009

creationtimestamp| type| source ---|---|--- 2026-05-06 20:37:42+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-jrc5-w569-h7h5...

CVE-2026-46361

creationtimestamp| type| source ---|---|--- 2026-05-06 20:31:54+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-pqh6-8fxf-jx22...

CVE-2026-45007

creationtimestamp| type| source ---|---|--- 2026-05-06 20:24:39+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-rm98-82fr-mcfx...

CVE-2026-46360

creationtimestamp| type| source ---|---|--- 2026-05-06 20:18:48+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-whqh-9pq5-c7r3...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the resetuserpassword and gympermissionsuseredit function when both the attacker and victim have gym=None. An attacker can gain unauthorized access to another user's account, obtain their new plaintext passwor...

CVE-2026-44483

creationtimestamp| type| source ---|---|--- 2026-05-06 19:32:52+00:00| published-proof-of-concept| https://github.com/airjp73/rvf/security/advisories/GHSA-c567-44rc-m5hq 2026-05-27 18:01:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmu3mrz7jk26...

GHSA-XP3W-R5P5-63RR vulnerabilities

Vulnerabilities for packages: sccache, bootc, rustup, typst, sdp-k8s-injector, komodo, rustls-openssl-client, rpm-sequoia, sentry-cli, vector, guestproxyagent, deno, ztunnel-fips, sqlx, valkey-ldap...

CVE-2026-42184

creationtimestamp| type| source ---|---|--- 2026-05-06 16:58:35+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-7gmj-67g7-phm9...

GHSA-FPJQ-C37H-CQCV vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno...

CVE-2026-42339

creationtimestamp| type| source ---|---|--- 2026-05-06 12:19:03+00:00| published-proof-of-concept| https://github.com/QuantumNous/new-api/security/advisories/GHSA-v5c3-6wvc-pc2q...

GHSA-FG3J-5W9G-HMG7

creationtimestamp| type| source ---|---|--- 2026-05-06 07:40:29+00:00| seen| https://gist.github.com/alon710/cdeb633d740e110eed8363124062a03a...

CVE-2026-44897

creationtimestamp| type| source ---|---|--- 2026-05-06 07:13:48+00:00| published-proof-of-concept| https://github.com/lepture/mistune/security/advisories/GHSA-v87v-83h2-53w7...

CVE-2026-44708

creationtimestamp| type| source ---|---|--- 2026-05-06 07:09:57+00:00| published-proof-of-concept| https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x...

PT-2026-38304

PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, CVE-2026-40287's fix gated tools.py auto-import behind PRAISONAI ALLOW LOCAL TOOLS=true in two files tool resolver.py, api/call.py. A third import sink in praisonai/templates/tool override.py was missed and...