MINI-3V5J-3J8H-534H

Bulletin has no description...

MINI-RV8F-HJMX-58M5

Bulletin has no description...

MINI-G6HC-7P53-PJRQ

Bulletin has no description...

MINI-R7XW-M2C8-JGHP

Bulletin has no description...

MINI-VF86-8F5J-2GPW

Bulletin has no description...

MINI-C5H6-9V9P-8GHM

Bulletin has no description...

MINI-MRPM-Q7WV-VH3P

Bulletin has no description...

MINI-8PHX-C63C-64HF

Bulletin has no description...

MINI-3W3Q-C9XJ-6H2Q

Bulletin has no description...

MINI-H7F9-PVQH-CGFM

Bulletin has no description...

MINI-RJXF-M767-P3XW

Bulletin has no description...

MINI-P6F3-7X4G-H9X2

Bulletin has no description...

MINI-48HG-5PCG-CXJ7

Bulletin has no description...

MINI-WJQ3-X3P7-RJX2

Bulletin has no description...

CVE-2026-65689

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...

EUVD-2026-48242

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

PYSEC-2026-3500 PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

Summary The multiedit tool in src/praisonai/praisonai/tools/multiedit.py allows LLM-controlled arbitrary file read and write without any path validation, workspace boundary check, or protected path guard. This enables an attacker who can influence agent tool arguments via crafted prompts, user...

PYSEC-2026-3533 PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder

Summary The executecode tool's subprocess sandbox advertises a three-layer defense AST validation, text-pattern blocklist, restricted builtins. In sandbox mode the default only two layers are active — the text-pattern blocklist is skipped — and both remaining layers are bypassed by combining two...

PYSEC-2026-3521 PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools Summary praisonaiagents.mcp.ToolsMCPServer.runsse builds a Starlette MCP HTTP+SSE server around mcp.server.sse.SseServerTransport. The server exposes /sse and /messages/, but it does not valida...

PYSEC-2026-3510 PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

PraisonAI LinearBot processes unsigned webhooks when LINEARWEBHOOKSECRET is missing Summary PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEARWEBHOOKSECRET as optional. When the secret is absent, startup only logs a warning and handlewebhook skips Linear-Signature...