CVE-2026-60088 PraisonAI before 4.6.78 Path Traversal via Custom Commands

PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include path traversal sequences like @../outsidesecret.txt or absolute paths in project command files to exfiltrate process-readable...

MINI-66FP-PX28-Q95M

Bulletin has no description...

MINI-MMQM-F59M-5R7R

Bulletin has no description...

MINI-48WF-7V29-X3W2

Bulletin has no description...

MINI-Q52F-CMX7-283Q

Bulletin has no description...

MINI-2RC3-G385-9PFR

Bulletin has no description...

MINI-M8CW-8R22-PVG9

Bulletin has no description...

MINI-CMQ5-WPX7-76GG

Bulletin has no description...

MINI-87RC-V2PX-GQX2

Bulletin has no description...

Which Neurons Detect Malicious Code? A Probing Study of LLM Security Knowledge

Background. Large language models LLMs have become increasingly capable of understanding and generating source code, leading to their widespread adoption in software engineering tasks such as code completion, repair, and vulnerability detection. However, despite their strong empirical performance...

MINI-V24C-42Q7-57V4

Bulletin has no description...

MINI-4G55-MWP2-G23P

Bulletin has no description...

MINI-325V-J386-XPWP

Bulletin has no description...

MINI-VF49-W625-XF64

Bulletin has no description...

MINI-MX7M-CRMC-8M4C

Bulletin has no description...

MINI-FPPM-XG8Q-2MP8

Bulletin has no description...

MINI-R4F5-W25Q-GQWJ

Bulletin has no description...

MINI-MX62-MR68-8VW3

Bulletin has no description...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through the image process in open-sse/translator/concerns/image.js. An attacker can access internal-only HTTP services by...

CVE-2026-56676

9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy ca...