209870 matches found
CVE-2026-57145
CVE-2026-57145 affects PraisonAI , an AI multi-agent framework. The multiedit tool in src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open() for reading and writing without path traversal rejection, symlink resolution, workspace boundary validat...
EUVD-2026-77543
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser.processfilemention accepts file-mention values and falls back from workspace-relative resolution to Pathfilepath without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or...
EUVD-2026-77537
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...
CVE-2026-59569 Android ZCC VPN API method privilege escalation
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...
CVE-2026-59569 Android ZCC VPN API method privilege escalation
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...
CVE-2026-59569
CVE-2026-59569 is an improper input validation vulnerability in Zscaler Client Connector (ZCC) on Android and ChromeOS , specifically in the VPN API method , that allows a local attacker with high privileges to potentially bypass Zscaler controls and escalate privileges. The CVSS v3.1 score is 8....
CVE-2026-57130 PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/emailtools.py interpolates LLM-controlled fromaddr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can...
CVE-2026-57130
PraisonAI (praisonaiagents) is a multi-agent framework. Prior to 1.6.59 , the file email_tools.py interpolates LLM-controlled parameters (from_addr, subject, query, search_id) directly into IMAP SEARCH criteria using f-string formatting with double-quote delimiters, with no escaping or sanitizati...
CVE-2026-57130 PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/emailtools.py interpolates LLM-controlled fromaddr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can...
CVE-2026-57130 PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/emailtools.py interpolates LLM-controlled fromaddr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can...
CVE-2026-82441
Description A submitted topology carries two lists of blobstore keys, dependencyjars and dependencyartifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup ...
CVE-2026-15600
The Alior Bank PrestaShop module "raty" for commercial partners is affected by a SQL Injection in the toggleCategoryPromotionAction method. The root cause is the unsanitized insertion of the POST parameter "status" into SQL UPDATE queries without validation. An attacker who already has access to ...
CVE-2026-15600 SQL Injection in Alior Bank raty PrestaShop module
Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotionAction method. The module inserts value of the POST parameter "status" into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
EUVD-2026-77486
Description A submitted topology carries two lists of blobstore keys, dependencyjars and dependencyartifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup ...
CVE-2026-90961 MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials
The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace CakePHP's FormAuthenticate class but fail to replicate its checkFields input validation guard. As a result, the email and password fields...
CVE-2026-90961 MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials
The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace CakePHP's FormAuthenticate class but fail to replicate its checkFields input validation guard. As a result, the email and password fields...
Astra Linux – Vulnerability in libssh2
The vulnerability of the libssh2packetadd function in the packet.c component of the SSH2 implementation library Libssh2 is related to insufficient input validation. Exploiting this vulnerability allows a remote attacker to cause service interruptions...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to version 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: HID: playstation: Added a missing check for inputffcreatememless. The psgamepadcreate function calls inputffcreatememless, without verifying its return value. This can lead to incorrect behavior or potential crashes when FF effec...