miasm

What is Miasm? Miasm is a free and open source GPLv2 reverse engineering framework. Miasm aims to analyze / modify / generate binary programs. Here is a non exhaustive list of features: Opening / modifying / generating PE / ELF 32 / 64 LE / BE Assembling / Disassembling X86 / ARM / MIPS / SH4 /...

CVE-2014-0472

CVE-2014-0472 Usa docker-compose up -d Accede a localhost:8083 Referencia: https://www.djangoproject.com/weblog/2014/apr/21/security/ 1. Una o más vistas están presentes que construyen una URL basada en la entrada del usuario comúnmente, un parámetro "next" en una cadena de consulta que indica a...

PT-2026-98197

Name of the Vulnerable Software and Affected Versions DBHub versions prior to 0.22.6 Description Setting readonly = true on the execute sql tool fails to enforce a read-only connection. The database-level read-only controls are not activated because the required configuration value is never...

CVE-2026-57137

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that...

EUVD-2026-78422

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that...

CVE-2026-57137

PraisonAI (npm:praisonai) is a TypeScript AI agent framework. In versions 1.4.0 through 1.7.1 , the createAgentLoop() function passes executable tool handlers to the AI SDK's generateText() before invoking the onToolCall approval callback. Because the AI SDK executes tools during generation, a ca...

CVE-2026-57137 PraisonAI AgentLoop onToolCall approval runs after tool execution

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that...

CVE-2026-57137 PraisonAI AgentLoop onToolCall approval runs after tool execution

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that...

CVE-2026-57137: Protection Mechanism Failure

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that...

CVE-2026-73657 Trigger.dev: Cross-tenant payload poisoning via packet write + replay

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, POST /api/v1/runs/:runParam/replay in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses prisma.taskRun.findUnique where: friendlyId: runParam without a...

Malicious code in devplatform-jscodeshift-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...

PT-2026-64071

Summary Anki launches a local HTTP server to serve media files and web pages for parts of its interface. While the server has a CORS setup, requests from other origins were not blocked, allowing malicious websites to potentially trigger side-effecting requests. Browser impact The severity varies ...

MAL-2026-10529 Malicious code in @wrenfield/abitype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d1b16f2fdde2184bdcfb6f2c91f18c328dee9aa1bb111f86d3130f47c42c9e5 Package @wrenfield/abitype impersonates the well-known wevm/abitype library: it copies the upstream README verbatim links to abitype.dev, wevm.eth,...

MAL-2026-10109 Malicious code in validator-string (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41a95b09ecd097cf7db1496950d26195169adb7ad2d8065a3458771389094be4 Package name validator-string impersonates the widely-used npm package validator and copies its README, homepage, and API surface. package.json...

CVE-2026-56776

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/workflowId/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real...

CVE-2026-56776 n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/workflowId/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real...

CVE-2026-56776 n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/workflowId/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real...

UBUNTU-CVE-2026-59153

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting...

EUVD-2026-42112

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting...

Vyper's `slice()` may elide side-effects when output length is 0

Impactthe slice builtin can elide side effects when the output length is 0, and the source bytestring is a builtin msg.data or .code. the reason is that for these source locations, the check that length = 1 is...