PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)

Summary The PraisonAI MCP HTTP-stream server creates a new in-memory session on every initialize request and never removes it. The cleanup routine that would expire sessions cleanupsessions is defined but never called anywhere in the codebase, and the configured session TTL is never enforced. The...

CVE-2026-55531 PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcppost handler creates a new sessions entry for every initialize request but does not call cleanupsessions or enforce a maximum. An unauthenticated caller can exhaust memory. The fix invokes cleanup and limit...

CVE-2026-55531

PraisonAI 's MCP HTTP Stream server (prior to 4.6.58 ) suffers from unbounded in-memory session accumulation. Each unauthenticated initialize request creates a new entry in the _sessions dictionary, but the existing _cleanup_sessions method is never invoked and no maximum session cap is enforced,...

EUVD-2026-65498

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcppost handler creates a new sessions entry for every initialize request but does not call cleanupsessions or enforce a maximum. An unauthenticated caller can exhaust memory. The fix invokes cleanup and limit...

CVE-2026-55531 PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcppost handler creates a new sessions entry for every initialize request but does not call cleanupsessions or enforce a maximum. An unauthenticated caller can exhaust memory. The fix invokes cleanup and limit...

EUVD-2026-53582

praisonaiagents has a webcrawl SSRF protection bypass via unchecked redirect targets...

EUVD-2026-65493

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the webcrawl function validates only the initial URL before crawlwithhttpx uses httpx.Clientfollowredirects=True. Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL ...

react2shell-rce-autobot

🔍 React2Shell Dork Scanner 🚨 Über die Schwachstelle React2Shell ist eine kritische Remote Code Execution RCE -Schwachstelle, die folgende Komponenten betrifft: Ziel| Verwundbare Versionen ---|--- ⚛️ react-server-dom-webpack| 19.0.0, 19.1.0, 19.1.1, 19.2.0 ⚛️ react-server-dom-turbopack| 19.0.0,...

CVE-2026-48099

A flaw was found in WsgiDAV, a WebDAV server. A remote attacker could exploit this vulnerability by sending a specially crafted WebDAV request path containing encoded parent-directory segments. This could allow the attacker to escape the configured filesystem share root, potentially leading to...

CVE-2026-14457 RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate

Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated certificate configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted...

CVE-2026-14457 RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate

Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated certificate configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted...

CVE-2026-14457

CVE-2026-14457 is a NULL pointer dereference (CWE-476) in OpenSSL's TLS implementation affecting configurations that use RFC 7250 Raw Public Keys (RPKs) with only a private key configured and no associated certificate. When a remote peer solicits RPKs and also sends the "signature_algorithms_cert...

Libssh-server-CVE-2018-10933

Libssh-server-CVE-2018-10933...

assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)

A flaw was found in AssertJ. An XML External Entity XXE vulnerability exists in the XmlStringPrettyFormatter component, which is used by the isXmlEqualToCharSequence assertion. If an application processes untrusted XML input using these methods, a remote attacker could exploit this flaw to read...

CVE-2022-29056

CVE-2022-29056 Exploit-Automatisierung für Bildungszwecke 🚨 📌 Beschreibung Dies ist ein Python-Skript mit grafischer Oberfläche Tkinter, das es dem Benutzer ermöglicht, automatisierte Anforderungssendungen an einen Login-Endpunkt zu testen. Ziel ist es zu simulieren, wie Server auf verschiedene...

Security update for rmt-server

This update for rmt-server fixes the following issue: Update to version 3.1 bsc1274715. CVE-2026-42256: net-imap: hostile server can perform a DoS on client authenticating a connection with SCRAM-SHA1 or SCRAM-SHA2 bsc1265369. Changes for rmt-server: Version 3.1: Remove all errors and warnings du...

CVE-2021-41773

HTTP Apache Path Traversal NSE-Skript CVE-2021-41773 Beschreibung Dieses NSE-Skript prüft, ob ein Apache-HTTP-Server anfällig für die Path Traversal -Schwachstelle CVE-2021-41773 ist. Ein anfälliger Server ermöglicht es Angreifern, ohne Anmeldung auf Dateien zuzugreifen, auf die sie keinen Zugrif...

CVE-2026-79671

Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function webhooksettingservice.go, which only validates literal IP addresses via net.ParseIP and fails to reject hostnames that DNS-resolve to private or internal IPs e.g., 169.254.169.254.nip.io. An...

CVE-2026-79669

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...

httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration

A flaw was found in Apache HTTP Server when using the modldap module in a per-directory configuration. This use-after-free vulnerability allows a remote attacker to potentially execute arbitrary code or cause a denial of service DoS due to improper memory handling. This could lead to system...