37 matches found
rdesktop
IMPORTANTE: rdesktop ya no recibe mantenimiento Por favor, tenga en cuenta que este proyecto ya no recibe mantenimiento y no ha recibido parches en muchos años. Se han reportado vulnerabilidades de seguridad, pero estas no han sido revisadas. Úselo con precaución y bajo su propio riesgo. rdesktop...
EUVD-2026-44637
PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments...
EUVD-2026-87520
OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewed files or repositories with materiall...
CVE-2026-100530
Versions of OpenClaw before 2026.8.1 are vulnerable to an issue where the software fails to bind the working directory context to reusable exec approvals . This oversight allows approved commands to execute in different directories than originally intended. An attacker possessing an allow-always ...
BIT-PARSE-2021-47987 Parse Server - Arbitrary Code Execution via Malicious Version Tags
Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it define...
CVE-2026-82982
The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...
EUVD-2026-82619
The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...
CVE-2026-19410: Time-of-check Time-of-use (TOCTOU) Race Condition
An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and...
bitchat-android v2.0.1
!WARNING This software has not received external security review and may contain vulnerabilities and may not necessarily meet its stated security goals. Do not use it for sensitive use cases, and do not rely on its security until it has been reviewed. Work in progress. bitchat for Android A secur...
BIT-PARSE-2021-47986 Parse Server - Unreviewed Code Execution via Malicious Version Tags
Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in dependency declarations to execute unreviewed and...
Incorrect Authorization
Overview praisonaiagents is a Praison AI agents for completing complex tasks with Self Reflection Agents Affected versions of this package are vulnerable to Incorrect Authorization via the tool approval process. An attacker can perform unauthorized actions by reusing an initial approval for a...
CVE-2026-60087
PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers can exploit this by obtaining approval for a benign operation and then executing dangerous file write operations with...
CVE-2026-60087
PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers can exploit this by obtaining approval for a benign operation and then executing dangerous file write operations with...
CVE-2026-60087
PRAISONAI v1.6.78 and earlier are affected: PraisonAI caches tool approvals by tool name, enabling reuse of initial approvals for subsequent calls with arbitrary arguments. This can allow an attacker to obtain approval for a benign operation and then execute dangerous file write operations within...
CVE-2026-60087 PraisonAI before 1.6.78 Tool Approval Cache Bypass
PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers can exploit this by obtaining approval for a benign operation and then executing dangerous file write operations with...
PT-2026-60134
Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.6.78 Description PraisonAI caches tool approval decisions using only the tool name, which allows the reuse of an initial approval for subsequent calls with arbitrary arguments. An attacker can obtain approval for ...
MAL-2026-6588 Malicious code in endpointmap (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa2ddbcbdd90508af14415a021644c1ab8a57e432b526425e4c5128b23f897bb endpointmap advertises itself as a REST endpoint registry but exhibits a two-package smuggle pattern. lib/registry.js exports two non-printable byte...
CVE-2021-47986
Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in dependency declarations to execute unreviewed and...
CVE-2021-47987
Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it define...
CVE-2021-47986
Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in dependency declarations to execute unreviewed and...