PT-2026-53145

Summary The execute code tool's subprocess sandbox advertises a three-layer defense AST validation, text-pattern blocklist, restricted builtins . In sandbox mode the default only two layers are active — the text-pattern blocklist is skipped — and both remaining layers are bypassed by combining tw...

PT-2026-50728

Name of the Vulnerable Software and Affected Versions affected versions not specified Description Database connection information, including the username and password, is logged at the debug level when using .pgpass. Recommendations Upgrade to version 2.7.1 or greater. Filter out debug-level logs...

PT-2026-53128

Summary PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allow dangerous tools=True. That policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, the actual execution path...

CVE-2026-49133

Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content directory by supplying traversal sequences in the path query parameter passed to Storage::getFile with an empty folder...

EUVD-2026-37681

Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service due to insecure deserialization in the .NET Remoting service. The service is configured with TypeFilterLevel.Full and is bound to local interfaces only through named pipes. A local...

CVE-2026-46929

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite component: Cost Planning. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management...

Malwarebytes earns AV-TEST Top Product award, aces other third-party tests

Our job is to protect people from online threats, and independent testing is one of the best ways to measure how well we’re doing. Malwarebytes nabbed AV-TEST's Top Product award after scoring 17.5 points out of a possible 18 in the research organization's most recent Windows security test. The...

[SECURITY] Fedora 44 Update: ldns-1.9.2-1.fc44

ldns is a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to for instance create or sign packets...

CVE-2026-7850

The WP Magnific Popup WordPress plugin (versions through 1.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly escape user-controlled link URLs before injecting them into the DOM when the plugin displays image load error messages. This flaw allows au...

PUFFERDOS: Efficient and Effective Attack String Generation for Regular Expression Denial of Service Vulnerabilities

ReDoS attacks constitute a critical class of resource-exhaustion vulnerabilities. In such attacks, adversaries exploit the pathological worst-case execution behavior of regular expression regex engines to induce highly asymmetric computational workloads, ultimately exhausting system resources and...

CVE-2026-54805: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Falang multilanguage = 1.4.2 versions...

CVE-2026-48967: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Geo Mashup = 1.13.19 versions...

CVE-2026-40749: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...

CVE-2026-39546: Incorrect Privilege Assignment

Subscriber Privilege Escalation in MultiLoca = 4.2.15 versions...

CVE-2026-39433: Missing Authorization

Subscriber Arbitrary Content Deletion in WPAMS 49.5.3 versions...

WordPress Plugin: wc-frontend-manager-ultimate: CVE-2026-22335: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate 6.7.7 versions...

CVE-2025-69137: Missing Authorization

Subscriber Broken Access Control in Genemy = 1.6.6 versions...

CVE-2025-69135: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin = 2.7.2 versions...

CVE-2025-60218: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in PT Luxa Addons = 1.2.2 versions...

CVE-2026-46965: Undefined Security Weakness

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Work Provider Site Level Administration. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi...