CVE-2026-40114

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endpoint accepts an arbitrary webhookurl in the request body with no URL validation. When a submitted job completes success or failure, the server makes an HTTP POST request to this URL using httpx.AsyncClient. An...

CVE-2026-40114 PraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs API

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endpoint accepts an arbitrary webhookurl in the request body with no URL validation. When a submitted job completes success or failure, the server makes an HTTP POST request to this URL using httpx.AsyncClient. An...

CVE-2026-40114 PraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs API

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endpoint accepts an arbitrary webhookurl in the request body with no URL validation. When a submitted job completes success or failure, the server makes an HTTP POST request to this URL using httpx.AsyncClient. An...

CVE-2026-40114

PraisonAI's /api/v1/runs accepts an arbitrary webhook_url in requests and, before version 4.5.128, posts results to that URL after job completion using httpx.AsyncClient. This enables SSRF from an unauthenticated attacker to reach internal or external destinations, including cloud metadata servic...

CVE-2026-35556

creationtimestamp| type| source ---|---|--- 2026-04-09 21:07:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3po5bxx427 2026-04-09 21:22:18+00:00| published-proof-of-concept| Telegram/J52JBZg8WrLGGx6kRSNOXLCMOEds74O2ZZxihtNidTT3Fd0...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40107

SiYuan is a personal knowledge management system. Prior to 3.6.4, SiYuan configures Mermaid.js with securityLevel: "loose" and htmlLabels: true. In this mode, tags with src attributes survive Mermaid's internal DOMPurify and land in SVG blocks. The SVG is injected via innerHTML with no secondary...

CVE-2026-39943

creationtimestamp| type| source ---|---|--- 2026-04-09 20:36:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3nx5k5gh2i...

CVE-2026-25435

creationtimestamp| type| source ---|---|--- 2026-04-09 20:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mj3nkwqtre2w...

Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing

A flaw was found in Node.js. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a malformed Internationalized Domain Name IDN to the url.format function. When processed, this malformed input triggers an internal error, causing the Node.js application to crash. Thi...

CVE-2026-40089

Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The Sonicverse Radio Audio Streaming Stack dashboard contains a Server-Side Request Forgery SSRF vulnerability in its API client apps/dashboard/lib/api.ts. Installations created using the provided install.sh script includi...

UBUNTU-CVE-2026-25854

Occasional URL redirection to untrusted Site 'Open Redirect' vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other,...

CVE-2026-40077 Beszel has an IDOR in hub API endpoints that read system ID from URL parameter

Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they kno...

CVE-2026-40069

creationtimestamp| type| source ---|---|--- 2026-04-09 19:23:14+00:00| seen| Telegram/Y2UpQC9zCL6PqNfAxsSoQJ7YUumR5oW0JI3RILB7SgtOVH4 2026-04-12 08:45:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjbxku5rs424...

GHSA-2679-6MX9-H9XC

creationtimestamp| type| source ---|---|--- 2026-04-09 19:23:14+00:00| seen| Telegram/Y2UpQC9zCL6PqNfAxsSoQJ7YUumR5oW0JI3RILB7SgtOVH4 2026-04-10 07:00:23+00:00| seen| https://bsky.app/profile/hendryadrian.bsky.social/post/3mj4qrwhxfm2f 2026-04-13 02:18:17+00:00| seen|...

CVE-2026-35486

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, he superbooga and superboogav2 RAG extensions fetch user-supplied URLs via requests.get with zero validation — no scheme check, no IP filtering, no hostname allowlist. An attacker can access clo...

EUVD-2025-209392

Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Boxtitle and boxurl parameters...

CVE-2025-70797

Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Boxtitle and boxurl parameters...

CVE-2026-35204

creationtimestamp| type| source ---|---|--- 2026-04-09 17:56:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3ez4ayie2i 2026-07-13 22:00:07+00:00| seen| https://t.me/GithubRedTeam/92498 2026-07-14 00:00:18+00:00| seen| https://t.me/GithubRedTeam/92498 2026-07-15 00:00:32+00:00|...

CVE-2026-39853

creationtimestamp| type| source ---|---|--- 2026-04-09 17:23:27+00:00| seen| Telegram/UYy9QXiDWOzFY7CBVA8MS0Xr-No70LVttPhqPBLktKhMGyQ 2026-04-12 11:36:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjcb5bt4ru2w 2026-04-18 03:37:07+00:00| seen|...