OpenAI Rotates macOS Certificates Following Axios Supply Chain Breach

OpenAI rotates macOS certificates after downloading a compromised Axios version, urging users to update apps before revoked certificates are blocked in May 2026...

OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain Incident

OpenAI revealed a GitHub Actions workflow used to sign its macOS apps led to the download of the malicious Axios library on March 31, but noted that no user data or internal system was compromised. "Out of an abundance of caution, we are taking steps to protect the process that certifies our macO...

EUVD-2026-21162

PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits...

PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits

Summary The /media-stream WebSocket endpoint in PraisonAI's call module accepts connections from any client without authentication or Twilio signature validation. Each connection opens an authenticated session to OpenAI's Realtime API using the server's API key. There are no limits on concurrent...

GHSA-Q5R4-47M9-5MC7 PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits

Summary The /media-stream WebSocket endpoint in PraisonAI's call module accepts connections from any client without authentication or Twilio signature validation. Each connection opens an authenticated session to OpenAI's Realtime API using the server's API key. There are no limits on concurrent...

The Increasing Role of AI in Vulnerability Research

At Wordfence, we run a bug bounty program that pays out mid-six figures per year to researchers in bug bounties for WordPress related vulnerabilities. Funding this research helps us improve security for the WordPress community overall, and helps us secure our customers by rolling out protection f...

GHSA-PQ5C-RJHQ-QP7P vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-13.0, py3-vllm-cuda-12.4, vllm-openai-cuda-12.9...

GHSA-3MWP-WVH9-7528 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-13.0, py3-vllm-cuda-12.4, vllm-openai-cuda-12.9...

CVE-2026-34753 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, vllm-openai-cuda-12.9...

CVE-2026-34756 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-13.0, py3-vllm-cuda-12.4, vllm-openai-cuda-12.9...

GHSA-PF3H-QJGV-VCPR vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, vllm-openai-cuda-12.9...

CVE-2026-34755 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-13.0, py3-vllm-cuda-12.4, vllm-openai-cuda-12.9...

CVE-2026-39892 vulnerabilities

Vulnerabilities for packages: airflow, gitlab-cng-fips, apache-beam-python-3.13-sdk, localstack, py3-cassandra-medusa, kubeflow-volumes-web-app, ggshield, kserve, nemo, in-toto, openstack-kolla-toolbox-2025.1, k8s-sidecar, wazuh-manager, prefect, dagster, mitmproxy, authentik,...

GHSA-P423-J2CM-9VMQ vulnerabilities

Vulnerabilities for packages: airflow, gitlab-cng-fips, apache-beam-python-3.13-sdk, localstack, py3-cassandra-medusa, kubeflow-volumes-web-app, ggshield, kserve, nemo, in-toto, openstack-kolla-toolbox-2025.1, k8s-sidecar, wazuh-manager, prefect, dagster, mitmproxy, authentik,...

LiteLLM 安全漏洞

LiteLLM is an open-source application developed by Berri AI. It allows for the invocation of all LLM APIs in the OpenAI format. Versions of LiteLLM dated before April 8, 2026, contain a security vulnerability. This vulnerability stems from the /guardrails/testcustomcode URI, which allows arbitrar...

CVE-2026-40116

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /media-stream WebSocket endpoint in PraisonAI's call module accepts connections from any client without authentication or Twilio signature validation. Each connection opens an authenticated session to OpenAI's Realtime API using the...

CVE-2026-40113

PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openaimodel, openaikey, and openaibase without validating that these values do not contain commas. gcloud use...

CVE-2026-40116

CVE-2026-40116 affects PraisonAI prior to 4.5.128: the /media-stream WebSocket endpoint accepted unauthenticated connections and bypassed Twilio validation, proxying each connection to OpenAI’s Realtime API using the server key with no concurrency/rate/size limits. This could allow an unauthentic...

CVE-2026-40116

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /media-stream WebSocket endpoint in PraisonAI's call module accepts connections from any client without authentication or Twilio signature validation. Each connection opens an authenticated session to OpenAI's Realtime API using the...

CVE-2026-40116 PraisonAI's Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /media-stream WebSocket endpoint in PraisonAI's call module accepts connections from any client without authentication or Twilio signature validation. Each connection opens an authenticated session to OpenAI's Realtime API using the...