EUVD-2026-65545

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...

CVE-2026-55536 Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...

CVE-2026-55536

PraisonAI , a multi-agent teams system, contains a patch bypass (of CVE-2026-40289) in its Browser Server _handle_connection() method. The origin validation uses re.match() with the unanchored pattern chrome-extension://[a-z0-9]{32}, so extra trailing characters are ignored, allowing an attacker ...

CVE-2026-55536 Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...

Exploit for CVE-2026-69414

ShieldBreak - Windows Defender 0day vulnerability Microsoft h...

ShieldBreak bypasses Microsoft’s patch for earlier Defender flaw

Microsoft Defender’s latest patch bypass shows a familiar problem. A newly disclosed Microsoft Defender flaw called ShieldBreak shows that fixing one attack path doesn't always close every route to the same result. Microsoft has assigned ShieldBreak the identifier CVE-2026-69414 and confirmed it ...

ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access

The security researcher going by the name Chaotic Eclipse aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse has released a proof-of-concept PoC for a new Microsoft zero-day called ShieldBreak. The vulnerability, rooted in Microsoft Defender for Windows, demonstrates a patch bypass for...

ShieldBreak

ShieldBreak - Windows Defender 0day vulnerability Microsoft h...

NPM: Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

NPM: Flowise: CVE-2025-8943 Patch Bypass: npmconfigyes bypasses MCP environment variable blocklist Unauthenticated RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

CVE-2026-69263 Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LDLIBRARYPATH, DYLDLIBRARYPATH, and NODEOPTIONS by exact...

VulnCheck KEV: CVE-2025-68686

Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An...

CVE-2026-47767 Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty$GET, but parsestr and the web SAPI can disagree, allowing a crafted query string to...

CVE-2026-47767

CVE-2026-47767 consolidates multiple disclosures of CVE-2024-50340: the vulnerability stems from a mismatch between parse_str()-built $_GET and web SAPI argv parsing when register_argc_argv=On, allowing crafted GET requests to flip APP_ENV/APP_DEBUG via SymfonyRuntime::getInput. Affected implemen...

CVE-2026-55570

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-44791

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could bypass the patch for CVE-2026-42232 in the XML node. When combined with other nodes, this could lead to RCE on the n8n host. This...

CVE-2026-44791 n8n: XML Node Prototype Pollution Patch Bypass

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could bypass the patch for CVE-2026-42232 in the XML node. When combined with other nodes, this could lead to RCE on the n8n host. This...

CVE-2026-44791 n8n: XML Node Prototype Pollution Patch Bypass

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could bypass the patch for CVE-2026-42232 in the XML node. When combined with other nodes, this could lead to RCE on the n8n host. This...

CVE-2026-53663 React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass

React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight,...

CVE-2026-53663 React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass

React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight,...

cve-2026-41728 - HIGH - Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections

cve-2026-41728 - HIGH - Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections...