EUVD-2026-77597

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.createapp mounts praisonai.jobs.router.createrouter under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read job...

CVE-2026-57131

PraisonAI (a Python multi-agent framework on PyPI) ships a standalone async-jobs HTTP server whose /api/v1/runs/... endpoints are entirely unauthenticated prior to version 4.6.58 . The root cause is a missing authentication layer: create_app adds only CORS middleware (which lists Authorization in...

CVE-2026-57131 praisonai: Jobs API exposes agent-execution endpoints with no authentication

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.createapp mounts praisonai.jobs.router.createrouter under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read job...

CVE-2026-57123 PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.runsse and launchtoolsmcpserver bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable...

CVE-2026-57128 PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.authtoken before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast...

EUVD-2026-77533

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.authtoken before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Before versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache was originally designed to work without a challenge-response authentication model. This has been changed in versions 6.9.13-48 and...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the SESSIONREATTACH. An attacker can gain unauthorized access to an existing session and assume the privileges of a previously authenticated user by sending a specially crafted CORE...

CVE-2026-82784

Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. An attacker may execute a REST API without authentication, which could allow the attacker to retrieve I/O values and/or control the output...

CVE-2026-82787

Missing authentication for critical function vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an affected product may be operated by a remote attacker without authentication...

EUVD-2026-77241

Missing authentication for critical function vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an affected product may be operated by a remote attacker without authentication...

CVE-2026-82787

CVE-2026-82787 affects the CPSL-08P1EN (a Contec product) with a missing authentication for critical function vulnerability. A remote attacker may operate the affected product without authentication , leading to high impact on confidentiality, integrity, and availability. The vulnerability is rat...

CVE-2026-82787

Missing authentication for critical function vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an affected product may be operated by a remote attacker without authentication...

CVE-2026-82787

Missing authentication for critical function vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an affected product may be operated by a remote attacker without authentication...

CVE-2026-82784

A missing authentication vulnerability exists in the REST API of the Contec Remote I/O Coupler Unit (Server Type) CPSN-MCB271- *. Because the API does not require authentication, a remote attacker can retrieve I/O values and/or control the output of the device without prior access. The CVSS 3.1 b...

CVE-2026-82784

Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. An attacker may execute a REST API without authentication, which could allow the attacker to retrieve I/O values and/or control the output...

CVE-2026-82784

Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. An attacker may execute a REST API without authentication, which could allow the attacker to retrieve I/O values and/or control the output...

EUVD-2026-77237

Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. An attacker may execute a REST API without authentication, which could allow the attacker to retrieve I/O values and/or control the output...

CVE-2026-90620

A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...

CVE-2026-90620 0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication

A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...