171328 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-64781
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The issue was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macO...
SUSE SLES15 Security Update : kernel RT (Live Patch 14 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3694-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3694-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.51 fixes various security issues: The following security issues were fixed: -...
SUSE SLES15 Security Update : kernel (Live Patch 36 for SUSE Linux Enterprise 15 SP5) (SUSE-SU-2026:3724-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3724-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.141 fixes various security issues: The following security issues were fixed:...
PT-2026-82066
Name of the Vulnerable Software and Affected Versions TarsWeb affected versions not specified Description Improper authorization occurs because four methods in app/controller/patch/PatchController.js fail to call the AuthService to enforce per-application roles. This allows any authenticated user...
Linux Distros Unpatched Vulnerability : CVE-2026-79225
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Browser in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass syste...
Linux Distros Unpatched Vulnerability : CVE-2026-78946
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Select in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromiu...
Linux Distros Unpatched Vulnerability : CVE-2026-79007
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read...
CVE-2026-80195 Kimai before 2.63.0 Team Membership Removal via API
Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint PATCH /api/teams/id, which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead or other user with permission to edi...
CVE-2026-80195
Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint PATCH /api/teams/id, which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead or other user with permission to edi...
GO-2026-6282 Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server
Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server...
Exploit for CVE-2026-58073
Veeam Service Provider Console Agent Impersonation — Patch-Sta...
The patch window is collapsing: Why security needs a new control plane
For decades, cybersecurity defenders have relied on a relatively straightforward model: a vulnerability is disclosed, security teams assess exposure, test available fixes, deploy patches into production, and ultimately close the risk before attackers can exploit it at scale. That model increasing...
GHSA-6G6R-Q6GW-W8FG PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
Summary praisonai/browser/server.py validates incoming WebSocket connections using a Chrome extension Origin check. The regex chrome-extension://a-z0-932 is applied with re.match, which only anchors at the start of the string, not the end. Any Origin header with more than 32 alphanumeric characte...
PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
Summary praisonai/browser/server.py validates incoming WebSocket connections using a Chrome extension Origin check. The regex chrome-extension://a-z0-932 is applied with re.match, which only anchors at the start of the string, not the end. Any Origin header with more than 32 alphanumeric characte...
CVE-2026-55536 Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...
CVE-2026-55536
PraisonAI , a multi-agent teams system, contains a patch bypass (of CVE-2026-40289) in its Browser Server _handle_connection() method. The origin validation uses re.match() with the unanchored pattern chrome-extension://[a-z0-9]{32}, so extra trailing characters are ignored, allowing an attacker ...
CVE-2026-55536 Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...
EUVD-2026-65545
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...
CVE-2026-55536 Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...