PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling

SummaryThe MultiAgentLedger and MultiAgentMonitor components in the provided code exhibit vulnerabilities that can lead to context leakage and arbitrary file operations. Specifically:1. Memory State Leakage via Agent ID Collision: The MultiAgentLedger uses a dictionary to store ledgers by agent I...

PYSEC-2026-2943 PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling

Summary The MultiAgentLedger and MultiAgentMonitor components in the provided code exhibit vulnerabilities that can lead to context leakage and arbitrary file operations. Specifically: 1. Memory State Leakage via Agent ID Collision: The MultiAgentLedger uses a dictionary to store ledgers by agent...

Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check

Vulnerability IDOR in GET/PATCH/DELETE /api/v1/flow/flowidThe readflow helper in src/backend/base/langflow/api/v1/flows.py branched on the AUTOLOGIN setting to decide whether to filter by userid. When AUTOLOGIN was False i.e., authentication was enabled, neither branch enforced an ownership check...

Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check

Vulnerability IDOR in GET/PATCH/DELETE /api/v1/flow/flowidThe readflow helper in src/backend/base/langflow/api/v1/flows.py branched on the AUTOLOGIN setting to decide whether to filter by userid. When AUTOLOGIN was False i.e., authentication was enabled, neither branch enforced an ownership check...

MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability

ImpactCritical Sandbox Escape & Server Takeover:A critical security vulnerability exists in mcp-run-python due to a lack of isolation between the Python runtime Pyodide and the host JavaScript environment.The runPython and runPythonAsync functions execute Python code using Pyodide without...

PYSEC-2026-2627 MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access

Impact Server-Side Request Forgery SSRF: A security vulnerability exists in the mcp-run-python tool specifically within the Pydantic-AI integration due to an overly permissive Deno sandbox configuration. The tool configures the Deno runtime—which is intended to isolate the execution of untrusted...

PYSEC-2026-2968 Azure PromptFlow remote code execution related to Jinja templates

Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network...

Azure PromptFlow remote code execution related to Jinja templates

Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network...

CVE-2026-62147

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces...

CVE-2026-62147

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces. Mitigation There is no mitigation or workarou...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the gateway component's authorization handling when the query RBAC feature is enabled. An attacker can access sensitive span attributes from other tenants' namespaces by sending crafted requests to the query...

PT-2026-59599

Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network...

PT-2026-60071

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.31.5 Decidim version 0.32.0.rc1 Description JWT-backed API authentication is not sufficiently bound to the organization selected by the current host. This allows a JSON Web Token JWT, which is a compact, URL-safe...

PT-2026-57809

Name of the Vulnerable Software and Affected Versions Tempo Operator affected versions not specified Description The gateway component fails to consistently apply namespace-scoped redaction on certain query API response paths when query RBAC Role-Based Access Control is enabled. This allows an...

PT-2026-60067

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.9 Decidim versions 0.31.0 through 0.31.4 Decidim version 0.32.0.rc1 Description Identity-document verification admin controllers load pending authorization records using a raw identifier without verifying ownersh...

PT-2026-59562

Summary PraisonAI Platform's workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to another workspace by supplying the victim object's global UUID. The affected pattern...

PT-2026-59575

Summary The MultiAgentLedger and MultiAgentMonitor components in the provided code exhibit vulnerabilities that can lead to context leakage and arbitrary file operations. Specifically: 1. Memory State Leakage via Agent ID Collision: The MultiAgentLedger uses a dictionary to store ledgers by agent...

PT-2026-59224

Vulnerability IDOR in GET/PATCH/DELETE /api/v1/flow/flow id The read flow helper in src/backend/base/langflow/api/v1/flows.py branched on the AUTO LOGIN setting to decide whether to filter by user id. When AUTO LOGIN was False i.e., authentication was enabled, neither branch enforced an ownership...

PT-2026-59227

Vulnerability IDOR in GET/PATCH/DELETE /api/v1/flow/flow id The read flow helper in src/backend/base/langflow/api/v1/flows.py branched on the AUTO LOGIN setting to decide whether to filter by user id. When AUTO LOGIN was False i.e., authentication was enabled, neither branch enforced an ownership...

PT-2026-59555

Summary SubprocessSandbox in all modes BASIC, STRICT, NETWORK ISOLATED calls subprocess.run with shell=True and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include sh or bash as standalone executables, allowing trivial sandbox escape in STRICT mode...