21972 matches found
CVE-2026-41497
PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI's MCP command handling does not add a command allowlist or argument validation to parsemcpcommand, allowing arbitrary executables like bash, python, or /bin/sh with inline code execution flags to pass through t...
CVE-2026-41679
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in authenticated mode with default configuration...
CVE-2026-46493 haxtheweb/haxcms-php uses insecure method for generating salt
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use uniqid for generating salts, which is unsuitable. Version 26.0.1 fixes the issue...
CVE-2026-46493 haxtheweb/haxcms-php uses insecure method for generating salt
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use uniqid for generating salts, which is unsuitable. Version 26.0.1 fixes the issue...
EUVD-2026-34896
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use uniqid for generating salts, which is unsuitable. Version 26.0.1 fixes the issue...
CVE-2026-5935
IBM Total Storage Service Console TSSC / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC could allow an unauthenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input...
CVE-2026-10056
CORS misconfiguration in the REST API of Network Optix Nx Witness VMS before version 6.1.2, when running in the default Standard security mode, on Linux and Windows allows an unauthenticated remote attacker to steal the session token of an authenticated user and perform Administrator Account...
CVE-2026-45055
CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CCSTOREURL directly from the Host request header at bootstrap, with no allowlist. The constant is embedded verbatim into transactional email links, most critically the password-reset link in...
GHSA-PXHF-QG7H-8X8M vulnerabilities
Vulnerabilities for packages: openjdk-11-openj9, openjdk-26-openj9, openjdk-25-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9...
GHSA-RP3Q-RW9W-295J vulnerabilities
Vulnerabilities for packages: openjdk-11-openj9, openjdk-26-openj9, openjdk-25-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9...
GHSA-X7PQ-J293-X4P5 vulnerabilities
Vulnerabilities for packages: openjdk-11-openj9, openjdk-26-openj9, openjdk-25-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9...
GHSA-XVMR-9P7M-JMWV vulnerabilities
Vulnerabilities for packages: openjdk-11-openj9, openjdk-26-openj9, openjdk-25-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk...
GHSA-Q4WQ-4WHJ-CXHX vulnerabilities
Vulnerabilities for packages: openjdk-11-openj9, openjdk-26-openj9, openjdk-25-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9...
GHSA-VWJG-VPWQ-RXVV vulnerabilities
Vulnerabilities for packages: openjdk-11-openj9, openjdk-26-openj9, openjdk-25-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9...
GHSA-PFR6-J3GF-9M85 vulnerabilities
Vulnerabilities for packages: openjdk-11-openj9, openjdk-26-openj9, openjdk-25-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9...
GHSA-XXCM-X786-Q6GG vulnerabilities
Vulnerabilities for packages: openjdk-11-openj9, openjdk-26-openj9, openjdk-25-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9...
GHSA-P45X-6RJM-X9QF vulnerabilities
Vulnerabilities for packages: openjdk-11-openj9, openjdk-26-openj9, openjdk-25-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9...
GHSA-RXF7-P2JR-3VF7 vulnerabilities
Vulnerabilities for packages: openjdk-11-openj9, openjdk-26-openj9, openjdk-25-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9...