PT-2026-59600

psd-tools: arbitrary file write/read via smart-object path traversal Summary In psd-tools all releases exposing the SmartObject API through v1.17.0, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitise...

PT-2026-59568

Summary PraisonAI Platform has a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to owner. The issue is caused by privileged workspace-management routes using the shared dependency require workspace member... without...

PT-2026-59391

Model Import Overwrites Any Model Without Ownership Check Affected Component Model import endpoint: - backend/open webui/routers/models.py lines 254-308, import models Affected Versions Current main branch commit 6fdd19bf1 and likely all versions with model import functionality. Description The...

PT-2026-59574

Summary PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls MentionsParser.process.... The @url: handler then performs a direct urllib.request.urlopen request to the attacker-controlled URL...

PT-2026-59344

IDOR: Retrieval API Bypasses Knowledge Base Access Controls Author: Andrew Orr Summary validate collection access PR 22109 checks the user-memory- and file- collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any authenticated user who...

PT-2026-59625

Impact pyp2spec was writing PyPI package metadata e.g. the summary field into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine. The macro...

PT-2026-58960

Summary Path Traversal to Arbitrary File Deletion in the Edit Comment admin function. An authenticated administrator can delete arbitrary files within the application root e.g., config.php by injecting a crafted attach parameter, rendering the application inoperable. Affected Component...

PT-2026-59349

Summary Pin/Unpin is a write operation modifies the message's is pinned , pinned by, pinned at fields, but in standard channels it only checks read permission, allowing users with read-only access to pin/unpin any message. Details...

PT-2026-59402

Summary Open WebUI lets a user who can create, update, or import workspace models store arbitrary meta.knowledge entries on their model without checking whether they own or can read the referenced files. Open WebUI then treats meta.knowledge entries of type file as an authorization source in two...

PT-2026-59228

Summary Multiple critical API endpoints in Langflow are missing authentication controls, allowing any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal dat...

PT-2026-59818

Impact If SparseFillEmptyRowsGrad is given empty inputs, TensorFlow will crash. python import tensorflow as tf tf.raw ops.SparseFillEmptyRowsGrad reverse index map=, grad values=, name=None Patches We have patched the issue in GitHub commit af4a6a3c8b95022c351edae94560acc61253a1b8. The fix will b...

PT-2026-59816

Impact When tf.quantization.fake quant with min max vars per channel gradient receives input min or max of rank other than 1, it gives a CHECK fail that can trigger a denial of service attack. python import tensorflow as tf arg 0=tf.random.uniformshape=1,1, dtype=tf.float32, maxval=None arg...

PT-2026-59559

Summary Type: Insecure Direct Object Reference. The GET /workspaces/workspace id/issues/issue id/activity endpoint is gated by require workspace memberworkspace id and dispatches to ActivityService.list for issueissue id, which executes SELECT FROM activity WHERE issue id = :issue id with no...

PT-2026-59481

Summary While fuzzing openexr exrcheck fuzzer, Valgrind reports a conditional branch depending on uninitialized data inside generic unpack. This indicates a use of uninitialized memory CWE-457. The issue is reproducible with the current OSS-Fuzz harness and a single-file PoC. Details Environment:...

PT-2026-59515

Development Runner Telephony WebSocket /ws Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID Summary The pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without any authentication. An unauthenticated remote attacker who...

PT-2026-59538

Summary The gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no auth token is configured the default. By adding dangerous tool names e.g., shell exec, file write to the allowlist, an attacker can cause the ExecApprovalManager to...

PT-2026-60021

Summary A Server Side Request Forgery SSRF vulnerability in download bytes from url allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain restrictions. This can be used to target...

PT-2026-59671

Summary An Authorization Bypass vulnerability in rfc3161-client's signature verification allows any attacker to impersonate a trusted TimeStamping Authority TSA. By exploiting a logic flaw in how the library extracts the leaf certificate from an unordered PKCS7 bag of certificates, an attacker ca...

PT-2026-59113

Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens Summary The local OAuth helper FastAPI server bundled with dbt-mcp exposes the GET /dbt platform context endpoint without any form of authentication or host-origin validation. After a user completes the OAuth login flow against dbt...

PT-2026-59247

Summary The LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. Since the jwt.decode call does not explicitly deny the 'none' algorithm, a crafted token without a signature will be accepted as valid,...