147 matches found
EUVD-2026-60739
A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing JavaScript HttpRequest logic, leading to potential confidentiality loss...
CVE-2026-23935 Use-after-free read in script item/preprocessing HttpRequest body
A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing JavaScript HttpRequest logic, leading to potential confidentiality loss...
PT-2026-76963
Name of the Vulnerable Software and Affected Versions Zabbix server or proxy affected versions not specified Description An authenticated administrator can cause a denial of service by creating specifically crafted JavaScript scripts within preprocessing or script items, which results in the cras...
CVE-2026-23938: Uncaught Exception
An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service...
CVE-2026-23935: Out-of-bounds Read
A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing JavaScript HttpRequest logic, leading to potential confidentiality loss...
PT-2026-76961
Name of the Vulnerable Software and Affected Versions Zabbix affected versions not specified Description A flaw in the script item or preprocessing JavaScript HttpRequest logic allows a Zabbix administrator to read out-of-bounds memory, which may result in a loss of confidentiality. Recommendatio...
The vulnerability of the library for acceleration of data loading and preprocessing in NVIDIA DALI, related to deficiencies in the deserialization mechanism, allows a hacker to execute arbitrary code.
The vulnerability of the library for acceleration of data loading and preprocessing in NVIDIA DALI is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code...
PYSEC-2026-3406 vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
Summary Issue 1: EXIF orientation not normalized → The image orientation processed by the model differs from how humans view it, introducing interpretation bias. Issue 2: PNG tRNS not explicitly flattened before converting to RGB → After conversion, transparent/semi-transparent pixels are rendere...
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
SummaryPraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins.If a prompt contains @url:, the CLI calls MentionsParser.process.... The @url: handler then performs a direct urllib.request.urlopen request to the attacker-controlled URL an...
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
SummaryPraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins.If a prompt contains @url:, the CLI calls MentionsParser.process.... The @url: handler then performs a direct urllib.request.urlopen request to the attacker-controlled URL an...
PYSEC-2026-2903 PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Summary PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls MentionsParser.process.... The @url: handler then performs a direct urllib.request.urlopen request to the attacker-controlled URL...
PT-2026-59540
Summary PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls MentionsParser.process.... The @url: handler then performs a direct urllib.request.urlopen request to the attacker-controlled URL...
PT-2026-59574
Summary PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls MentionsParser.process.... The @url: handler then performs a direct urllib.request.urlopen request to the attacker-controlled URL...
CVE-2026-55646
vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/translations routes call request.file.read to fully materialize an uploaded audio file into memory before vLLM checks the documented VLLMMAXAUDIOCLIPFILESIZEMB...
XXE Vulnerability in MerlinReader
Impact MPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file...
NCMD: Benign-Anchored Feature Selection for Imbalanced Network Intrusion Detection
Feature selection is critical for network intrusion detection systems NIDS operating under high-dimensional, highly imbalanced traffic, as found in operational and defense networks. Traditional filter methods rank features using global statistics computed symmetrically across classes and thus fai...
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Summary PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls MentionsParser.process.... The @url: handler then performs a direct urllib.request.urlopen request to the attacker-controlled URL...
CVE-2025-47390
Memory corruption while preprocessing IOCTL request in JPEG driver...