a11ywatch_cli (>=0.0.26, <=0.7.16), aap (>=0.4.0, <=0.4.1) +3743 more potentially affected by unknown CVE via rustls-webpki (>=0.100.3, <=0.102.8)

rustls-webpki CARGO version =0.100.3, =0.0.26, =0.4.0, =0.1.0, =0.21.0-alpha.1, =0.1.11, =0.12.1, =0.2.0, =0.5.1, =0.0.1, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0099...

CVE-2026-40313

PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to ArtiPACKED attack, a known credential leakage vector caused by using actions/checkout without setting persist-credentials: false. By default, actions/checkout writes the...

CVE-2026-40313 PraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential Persistence

PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to ArtiPACKED attack, a known credential leakage vector caused by using actions/checkout without setting persist-credentials: false. By default, actions/checkout writes the...

EUVD-2026-22214

PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to ArtiPACKED attack, a known credential leakage vector caused by using actions/checkout without setting persist-credentials: false. By default, actions/checkout writes the...

CVE-2026-40313

Summary: PraisonAI versions ≤ 4.5.139 expose GitHub Actions credential leakage via ArtiPACKED attack due to actions/checkout persisting GITHUB_TOKEN (and sometimes ACTIONS_RUNTIME_TOKEN) in the repository’s .git/config when artifacts are uploaded from workflows. This can allow read-access users t...

PraisonAI 安全漏洞

PraisonAI is a low-code multi-agent collaboration framework developed by Mervin Praison. Versions of PraisonAI 4.5.139 and earlier contained security vulnerabilities. These vulnerabilities stemmed from known credential exposure risks in GitHub Actions workflows, which could allow attackers to...

3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +607 more potentially affected by CVE-2026-28291 via simple-git (>=3.0.3, <=3.31.1)

simple-git NPM version =3.0.3, =1.0.1, =1.0.1, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =23.0.0, =35.0.0, =1.4.0, =0.1.5-alpha.0, =1.0.2, =8.7.2, =39.0.2, =39.0.3 and more Source cves: CVE-2026-28291 Source advisory: OSV:GHSA-JCXM-M3JX-F287...

OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain Incident

OpenAI revealed a GitHub Actions workflow used to sign its macOS apps led to the download of the malicious Axios library on March 31, but noted that no user data or internal system was compromised. "Out of an abundance of caution, we are taking steps to protect the process that certifies our macO...

sigma-audit

Sigma Stack Audit Full-spectrum security audit combining five...

nimiq-blockchain is missing a wall-clock upper bound on block timestamps

Impact Block timestamp validation enforces that timestamp = parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MINPRODUCERTIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps...

GHSA-PJ2R-F9MW-VRCQ PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution

PraisonAI’s MCP Model Context Protocol integration allows spawning background servers via stdio using user-supplied command strings e.g., MCP"npx -y @smithery/cli ...". These commands are executed through Python’s subprocess module. By default, the implementation forwards the entire parent proces...

GHSA-PV9Q-275H-RH7X PraisonAI Vulnerable Untrusted Remote Template Code Execution

PraisonAI treats remotely fetched template files as trusted executable code without integrity verification, origin validation, or user confirmation, enabling supply chain attacks through malicious templates. --- Description When a user installs a template from a remote source e.g., GitHub,...

PraisonAI Vulnerable Untrusted Remote Template Code Execution

PraisonAI treats remotely fetched template files as trusted executable code without integrity verification, origin validation, or user confirmation, enabling supply chain attacks through malicious templates. --- Description When a user installs a template from a remote source e.g., GitHub,...

EUVD-2026-21212

PraisonAI Vulnerable Untrusted Remote Template Code Execution...

@alexaegis/svelte-config (>=0.9.2, <=0.15.0), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +17 more potentially affected by CVE-2026-40073 via @sveltejs/kit (>=2.0.0, <=2.55.0)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =10.0.1, =0.1.0, =0.0.1-alpha.26, =0.4.1, =5.0.0-alpha.1, =0.0.1, =1.0.1-next.0, =0.0.10, =1.0.54 and more Source cves: CVE-2026-40073 Source advisory: OSV:GHSA-2CRG-3P73-43XP...

CVE-2026-40159

PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI’s MCP Model Context Protocol integration allows spawning background servers via stdio using user-supplied command strings e.g., MCP"npx -y @smithery/cli ...". These commands are executed through Python’s subprocess module. By...

CVE-2026-40159 PraisonAI Exposes Sensitive Environment Variable via Untrusted MCP Subprocess Execution

PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI’s MCP Model Context Protocol integration allows spawning background servers via stdio using user-supplied command strings e.g., MCP"npx -y @smithery/cli ...". These commands are executed through Python’s subprocess module. By...

CVE-2026-40159

PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI’s MCP Model Context Protocol integration allows spawning background servers via stdio using user-supplied command strings e.g., MCP"npx -y @smithery/cli ...". These commands are executed through Python’s subprocess module. By...

CVE-2026-40159 PraisonAI Exposes Sensitive Environment Variable via Untrusted MCP Subprocess Execution

PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI’s MCP Model Context Protocol integration allows spawning background servers via stdio using user-supplied command strings e.g., MCP"npx -y @smithery/cli ...". These commands are executed through Python’s subprocess module. By...

@1eg/theme-editor-cli (>=0.13.0, <=1.17.0), @aicontextlab/cli (>=0.0.0-dev, <=0.2.2) +313 more potentially affected by CVE-2026-5986 via js-video-url-parser (>=0.2.8, <=0.5.1)

js-video-url-parser NPM version =0.2.8, =0.13.0, =0.0.0-dev, =0.2.5, =1.0.103, =0.12.77-beta.1, =0.1.0, =0.1.136, =1.2.8, =1.2.8, =1.2.8, =1.2.8, =1.2.8, =1.2.8, =1.2.10 and more Source cves: CVE-2026-5986 Source advisory: SNYK:JS-JSVIDEOURLPARSER-15995499...