CVE-2026-75007

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation...

CVE-2026-75007

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation...

PT-2026-76648

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.18 Roundcube Webmail versions 1.7.x prior to 1.7.3 Description An LDAP search filter injection exists due to unescaped %u, %fu, and %d substitutions. This flaw could allow an attacker to cause informatio...

PYSEC-2026-2954 PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution

Summary runpython in praisonai constructs a shell command string by interpolating user-controlled code into python3 -c "" and passing it to subprocess.run..., shell=True. The escaping logic only handles \ and ", leaving $ and backtick substitutions unescaped, allowing arbitrary OS command executi...

CVE-2026-34937

PRAISONAI: The run_python() function constructs a shell command by interpolating user code into python3 -c "" and passes it to subprocess.run(..., shell=True). The escape logic only handles \ and ", leaving $() and backtick substitutions unescaped, enabling arbitrary OS command execution before P...