CVE-2026-54529 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...

Improper Input Validation

Overview org.apache.storm:storm-server is a distributed realtime computation system. Affected versions of this package are vulnerable to Improper Input Validation due to the lack of validation on the dependencyjars and dependencyartifacts lists during topology submission. An attacker can cause...

CVE-2026-90463 Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service DoS by crashing...

CVE-2026-90463

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service DoS by crashing...

EUVD-2026-77592

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service DoS by crashing...

CVE-2026-90463 Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service DoS by crashing...

CVE-2026-90463

sssd (System Security Services Daemon) contains an input validation flaw in its NSS responder , specifically in the sss_nss_protocol_parse_svc_name and sss_nss_protocol_parse_svc_port functions. A local unprivileged attacker can send specially crafted service lookup requests to the NSS responder'...

CVE-2026-7848

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters...

CVE-2026-59569

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...

CVE-2026-90947

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicio...

CVE-2026-57145

CVE-2026-57145 affects PraisonAI , an AI multi-agent framework. The multiedit tool in src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open() for reading and writing without path traversal rejection, symlink resolution, workspace boundary validat...

EUVD-2026-77543

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser.processfilemention accepts file-mention values and falls back from workspace-relative resolution to Pathfilepath without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or...

CVE-2026-59569 Android ZCC VPN API method privilege escalation

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...

EUVD-2026-77537

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...

CVE-2026-59569

CVE-2026-59569 is an improper input validation vulnerability in Zscaler Client Connector (ZCC) on Android and ChromeOS , specifically in the VPN API method , that allows a local attacker with high privileges to potentially bypass Zscaler controls and escalate privileges. The CVSS v3.1 score is 8....

CVE-2026-59569 Android ZCC VPN API method privilege escalation

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...

CVE-2026-57130 PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/emailtools.py interpolates LLM-controlled fromaddr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can...

CVE-2026-57130 PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/emailtools.py interpolates LLM-controlled fromaddr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can...

CVE-2026-57130 PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/emailtools.py interpolates LLM-controlled fromaddr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can...

CVE-2026-57130

PraisonAI (praisonaiagents) is a multi-agent framework. Prior to 1.6.59 , the file email_tools.py interpolates LLM-controlled parameters (from_addr, subject, query, search_id) directly into IMAP SEARCH criteria using f-string formatting with double-quote delimiters, with no escaping or sanitizati...