CVE-2026-55535 PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validatewebhookurl path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhookurl can later resolve to 127.0.0.1, 169.254.169.254, or another internal address...

CVE-2026-55535 PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validatewebhookurl path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhookurl can later resolve to 127.0.0.1, 169.254.169.254, or another internal address...

CVE-2026-55535 PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validatewebhookurl path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhookurl can later resolve to 127.0.0.1, 169.254.169.254, or another internal address...

EUVD-2026-65516

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validatewebhookurl path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhookurl can later resolve to 127.0.0.1, 169.254.169.254, or another internal address...

CVE-2026-55537 PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validatewebhookurl accepts webhookurl when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. JobExecutor.sendwebhook later performs a fresh lookup, allowing DNS chang...

Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.

Summary Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced CVE-2026-14981, CVE-2026-15064, CVE-2026-15328, CVE-2026-15325, CVE-2026-15057, CVE-2026-11897, CVE-2026-10842, CVE-2026-9563, CVE-2026-50645, CVE-2026-9322, CVE-2026-9171,...

EUVD-2026-65493

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the webcrawl function validates only the initial URL before crawlwithhttpx uses httpx.Clientfollowredirects=True. Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL ...

Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with TXSeries for Multiplatforms.

Summary Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with TXSeries for Multiplatforms CVE-2026-14981, CVE-2026-15064, CVE-2026-15328, CVE-2026-15325, CVE-2026-15057, CVE-2026-11897, CVE-2026-10842, CVE-2026-9563, CVE-2026-50645, CVE-2026-9322, CVE-2026-9171,...

Vulnerabilities are handled in GitLab through GitLab Inc.

GitLab Inc. has identified vulnerabilities in the GitLab Community Edition CE and Enterprise Edition EE. These vulnerabilities reside in the GraphQL implementation of GitLab. The first vulnerability allowed unauthorized users to perform unauthorized modifications or deletions on public projects a...

EUVD-2026-65490

A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-request Endpoint. Executing a manipulation of the argument outputFile/outputDir can lead to path traversal. It is possible to launch...

CVE-2026-79622 dekdee adobe-xd-mcp file-access-from-request Endpoint xd-parser.ts path traversal

A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-request Endpoint. Executing a manipulation of the argument outputFile/outputDir can lead to path traversal. It is possible to launch...

CVE-2026-79622

A path traversal vulnerability was identified in dekdee/adobe-xd-mcp version 1.0.0 , specifically in the file src/parsers/xd-parser.ts within the file-access-from-request Endpoint component. A remote attacker can manipulate the outputFile/outputDir argument to traverse the file system, leading to...

assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)

A flaw was found in AssertJ. An XML External Entity XXE vulnerability exists in the XmlStringPrettyFormatter component, which is used by the isXmlEqualToCharSequence assertion. If an application processes untrusted XML input using these methods, a remote attacker could exploit this flaw to read...

SUSE-SU-2026:3797-1 Security update for sssd

This update for sssd fixes the following issue: - CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds read and a process crash when a crafted protocol v1 request is processed bsc1273925...

WordPress Podcast Player plugin < 8.3.1 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by ApogeeBytes in WordPress Plugin Podcast Player versions 8.3.1...

CVE-2026-79671

Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function webhooksettingservice.go, which only validates literal IP addresses via net.ParseIP and fails to reject hostnames that DNS-resolve to private or internal IPs e.g., 169.254.169.254.nip.io. An...

RLSA-2026:58819 Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

CVE-2026-79671 Ech0 before 4.4.3 SSRF via DNS Resolution Bypass

Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function webhooksettingservice.go, which only validates literal IP addresses via net.ParseIP and fails to reject hostnames that DNS-resolve to private or internal IPs e.g., 169.254.169.254.nip.io. An...

CVE-2026-79659 Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata...

CVE-2026-79659 Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata...