PYSEC-2026-3895 PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

Summary praisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhook URLs by resolving the hostname and checking whether the IP is private. When DNS resolution fails socket.gaierror, the validator silently passes the URL via except socket.gaierror: pass. Additionally, even when...

praisonaiagents web_crawl vulnerable to SSRF via redirect-following

Summarywebcrawl an exported, model-callable tool validates only the INITIAL URL's resolved IP against a private/loopback blocklist, then fetches with httpx.Clientfollowredirects=True and never re-validates redirect targets. An attacker who controls the agent's crawl target a malicious task, or...

PYSEC-2026-3898 praisonaiagents web_crawl vulnerable to SSRF via redirect-following

Summary webcrawl an exported, model-callable tool validates only the INITIAL URL's resolved IP against a private/loopback blocklist, then fetches with httpx.Clientfollowredirects=True and never re-validates redirect targets. An attacker who controls the agent's crawl target a malicious task, or...

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Copier: trust-prefix bypass via path traversal runs tasks unprompted SummaryIn copier = 9.5.0,...

PYSEC-2026-3818 Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Copier: trust-prefix bypass via path traversal runs tasks unprompted Summary In copier = 9.5.0, = 9.15.1, the trust setting's prefix match copier/settings.py compares the template URL against a trusted prefix with a raw str.startswith and no path normalization, while the URL is normalized when th...

CVE-Requests-1896609

CVE Requests 1896609 - feiskyer/mcp-kubernetes-server Краткое изложение В этом отчете подробно описываются две критические уязвимости безопасности, обнаруженные в пакете feiskyer/mcp-kubernetes-server. При развертывании сервер предоставляет инструмент MCP с именем kubectl, который предназначен дл...

hydrafw

HydraFW 공식 펌웨어 - HydraBus v1용 HydraFW는 HydraBus v1 보드를 위한 네이티브 C및 어셈블리 기반 오픈 소스 펌웨어입니다. HydraBus v1 온라인 구매: http://hydrabus.com/buy-online HydraBus v1 시작하기: https://github.com/hydrabus/hydrafw/wiki/Getting-Started-with-HydraBus HydraFW 위키: https://github.com/hydrabus/hydrafw/wiki VT100 터미널에서...

Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6

Anthropic on Wednesday disclosed a fourth incident in which its artificial intelligence AI model broke into real third-party systems, marking the latest in a growing list of cases that have raised concerns about the security risks posed by autonomous AI agents. The AI company said the incident...

Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution

Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an unauthenticated XML entity injection attack that can lead to remote code execution. id: CVE-2022-28219 info: name: Zoho ManageEngine ADAudit Plus 7600 - XML Entity Injection/Remote Code Execution author: dwisiswant0 severity:...

Joomla! JCE extension < 2.9.99.5 unauthenticated RCE

Joomla JCE editor extension contains an unrestricted file upload vulnerability caused by allowing unauthenticated users to create new editor profiles, letting attackers upload and execute PHP code remotely, exploit requires no authentication. id: CVE-2026-48907 info: name: Joomla! JCE extension...

Palo Alto Networks Expedition - OS Command Injection

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls...

evmpatch-env

evmpatch-env An execution-verified RL environment for repai...

Orchestrated-Powershell-for-CVE-2023-24932

Secure Boot Orchestrator CVE-2023-24932 CVE-2023-24932BlackLotus에 대한 전체 Secure Boot 완화 절차를 자동화합니다. 모든 레지스트리 변경, 재부팅 및 검증을 자동으로 처리합니다. 요구 사항 Windows 10/11 또는 Server 2016+ 관리자 권한 Secure Boot 활성화 2024년 7월 이상 누적 업데이트 설치 BitLocker 사용 중인 경우 BitLocker 복구 키 백업 빠른 시작 단일 서버 root@kitploit: 1. 다운로드 및 설치 한 줄...

pixel-ksu-root

pixel-ksu-root Root a stock, locked-bootloader Google Pixel from an unprivileged adb shell, using a kernel CVE — no unlock, no flash, no vendor help. A userspace-reachable CVE gives a short-lived kernel read/write primitive, which late-loads a KernelSU module kernelsu.ko into the running GKI...

OrganizerTransaction

이것은 CVE-2021-39749에 대한 PoC로, Android 12L Beta에서 다른 앱의 permission 및 exported 설정과 관계없이 해당 앱의 Activity를 시작할 수 있게 해줍니다. Android 12L에서 TaskFragmentOrganizer 접근은 의도적으로 더 이상 MANAGEACTIVITYTASKS 권한을 요구하지 않습니다 여기 제공된 앱을 사용하려면 Hidden API Checks를 비활성화해야 하며, adb shell settings put global hiddenapipolicy 1을 통...

CVE-2026-20637-AppleSEPKeyStore-UAF

CVE-2026-20637 — AppleSEPKeyStore Use-After-Free CVE-2026-20637 · Enfilade · enfilade.io 구성 요소: AppleKeyStore 영향: 앱이 예기치 않은 시스템 종료를 유발할 수 있음. 설명: 향상된 메모리 관리를 통해 use-after-free 문제가 해결되었습니다. —Apple 보안 콘텐츠, iOS 26.3 및 iPadOS 26.3 대상 | ---|--- iOS| 26.1 – 26.2 테스트 완료 macOS| 26.1 – 26.2 테스트 완료 구성 요소|...

EUVD-2026-75208

In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...

Deep-Fake CAPTCHA: Mitigating Next-Generation Social Engineering Attacks

This paper presents DF-CAPTCHA, an active defense against real-time deepfake impersonation in voice and video calls. Instead of passively searching for artifacts, DF-CAPTCHA prompts the caller to perform simple challenge-response tasks that are easy for humans but difficult for current real-time...

PT-2026-89569

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

Linux Distros Unpatched Vulnerability : CVE-2026-80916

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kcov: fix data corruption and race conditions on PREEMPTRT syzbot is reporting KCOV state corruption on PREEMPTRT kernels, for the temporary storage used for...