GHSA-892R-P3JQ-JP24 PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation

AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation Summary PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The publi...

PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

Jobs webhook SSRF protection bypass via DNS rebinding Summary PraisonAI's Async Jobs API validates webhookurl when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network reques...

CVE-2026-8461

creationtimestamp| type| source ---|---|--- 2026-06-18 13:33:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokwvxbso52s 2026-06-22 22:30:16+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3movwrv5h7f2m 2026-06-22 22:30:19+00:00| seen|...

CVE-2026-55806

creationtimestamp| type| source ---|---|--- 2026-06-18 13:15:20+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mokvvvrfyl2z 2026-06-22 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1933 2026-07-11 03:30:45+00:00| seen|...

CVE-2026-11718

creationtimestamp| type| source ---|---|--- 2026-06-18 13:13:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokvs5esly2y 2026-06-18 14:00:17+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mokygbvzep2c 2026-06-18 14:00:30+00:00| seen|...

CVE-2026-20265

creationtimestamp| type| source ---|---|--- 2026-06-18 13:10:36+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mokvncudk626 2026-07-13 20:09:05+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mqkiorr2f22u...

CVE-2026-54219

UBB.threads is vulnerable to Stored XSS via user posts and user profile fields. The application fails to properly sanitize user input, allowing low privileged attackers to inject arbitrary JavaScript that executes in a victim's browser upon viewing. Because vendor contact attempts were...

EUVD-2026-37874

An SQL Injection vulnerability exists in LMS LAN Management System before commit 4cb30a7 within the "tarifflist.php" module due to insufficient sanitization of the POST "tg" parameter. The application directly concatenates user-supplied array values into an SQL query using "implode", allowing...

CVE-2026-55742

creationtimestamp| type| source ---|---|--- 2026-06-18 08:48:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokgyupp3y2v...

CVE-2026-55744

creationtimestamp| type| source ---|---|--- 2026-06-18 08:38:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokggxn5qs27...

CVE-2026-10623

creationtimestamp| type| source ---|---|--- 2026-06-18 08:01:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokeer2icw2k...

CVE-2026-12111

creationtimestamp| type| source ---|---|--- 2026-06-18 07:53:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokdwruxn624...

CVE-2026-9815

creationtimestamp| type| source ---|---|--- 2026-06-18 07:50:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokdob7lp52d...

CVE-2026-12098

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed' Episode Meta Field in all versions up to, and including, 11.16.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2026-55740

Nur-Alam39 bus-ticket no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad contains an unauthenticated SQL injection vulnerability in businfo.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query select from businfo where id= without...

CVE-2026-54224

creationtimestamp| type| source ---|---|--- 2026-06-18 05:55:00+00:00| seen| https://cert.pl/en/posts/2026/06/CVE-2026-54219...

CVE-2026-54222

creationtimestamp| type| source ---|---|--- 2026-06-18 05:55:00+00:00| seen| https://cert.pl/en/posts/2026/06/CVE-2026-54219 2026-06-18 15:53:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mol6qkof7z2j...

CVE-2026-54221

creationtimestamp| type| source ---|---|--- 2026-06-18 05:55:00+00:00| seen| https://cert.pl/en/posts/2026/06/CVE-2026-54219 2026-06-18 15:58:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mol6zj5mne2o...

CVE-2026-54220

creationtimestamp| type| source ---|---|--- 2026-06-18 05:55:00+00:00| seen| https://cert.pl/en/posts/2026/06/CVE-2026-54219 2026-06-18 15:43:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mol66nmcxv2t...

EUVD-2026-37851

Nur-Alam39 bus-ticket no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad contains an unauthenticated SQL injection vulnerability in businfo.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query select from businfo where id=$busid...