170873 matches found
PYSEC-2026-3890 PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation
Summary The webhookurl field in the Jobs API silently passes validation when DNS resolution fails socket.gaierror, enabling DNS rebinding attacks. An attacker's domain can initially resolve to a public IP passing validation then switch to an internal IP before the server makes the HTTP request...
PYSEC-2026-3904 praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)
The webcrawl tool performs its SSRF check only on the initial URL: it resolves the hostname once with socket.gethostbyname and rejects private/loopback/link-local results. It then passes the URL to a fetcher that uses httpx.Clientfollowredirects=True - or urllib.request.urlopen when httpx is...
PYSEC-2026-3895 PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
Summary praisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhook URLs by resolving the hostname and checking whether the IP is private. When DNS resolution fails socket.gaierror, the validator silently passes the URL via except socket.gaierror: pass. Additionally, even when...
PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation
SummaryThe webhookurl field in the Jobs API silently passes validation when DNS resolution fails socket.gaierror, enabling DNS rebinding attacks. An attacker's domain can initially resolve to a public IP passing validation then switch to an internal IP before the server makes the HTTP request...
praisonaiagents web_crawl vulnerable to SSRF via redirect-following
Summarywebcrawl an exported, model-callable tool validates only the INITIAL URL's resolved IP against a private/loopback blocklist, then fetches with httpx.Clientfollowredirects=True and never re-validates redirect targets. An attacker who controls the agent's crawl target a malicious task, or...
PYSEC-2026-3898 praisonaiagents web_crawl vulnerable to SSRF via redirect-following
Summary webcrawl an exported, model-callable tool validates only the INITIAL URL's resolved IP against a private/loopback blocklist, then fetches with httpx.Clientfollowredirects=True and never re-validates redirect targets. An attacker who controls the agent's crawl target a malicious task, or...
asteval has a Sandbox Escape via BaseException Subclasses
SummaryAn attacker who can supply expressions to asteval.Interpreter.eval can raise SystemExit,KeyboardInterrupt, GeneratorExit, or BaseException from inside the sandbox. Theseexceptions are subclasses of BaseException but not Exception, so they bypass theexcept Exception: safety net in both run...
PYSEC-2026-3807 asteval has a Sandbox Escape via BaseException Subclasses
Summary An attacker who can supply expressions to asteval.Interpreter.eval can raise SystemExit, KeyboardInterrupt, GeneratorExit, or BaseException from inside the sandbox. These exceptions are subclasses of BaseException but not Exception, so they bypass the except Exception: safety net in both...
ONNX: TOCTOU arbitrary file read/write in save_external_dat
SummaryThe saveexternaldata method seems to include multiple issues introducing a local TOCTOU vulnerability, an arbitrary file read/write on any system. It potentially includes a path validation bypass on Windows systems.Regarding the TOCTOU, an attacker seems to be able to overwrite victim's...
PYSEC-2026-3876 ONNX: TOCTOU arbitrary file read/write in save_external_dat
Summary The saveexternaldata method seems to include multiple issues introducing a local TOCTOU vulnerability, an arbitrary file read/write on any system. It potentially includes a path validation bypass on Windows systems. Regarding the TOCTOU, an attacker seems to be able to overwrite victim's...
CVE-2023-5612
Disclosure of the public email in Tags RSS Feed https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ root@kitploit: An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possibl...
Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues: The following security issues were fixed: CVE-2024-57841: net: fix memory leak in tcpconnrequest bsc1235944. CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync bsc1255225. CVE-2025-7107...
Security Bulletin: Multiple security vulnerabilities are addressed with Cloud Pak foundational services 4.19.0 shipped with IBM Cloud Pak for Business Automation iFixes for August 2026
Summary IBM Cloud Pak for Business Automation includes IBM Cloud Pak foundational services. IBM Cloud Pak for Business Automation August 2026 security fixes update this dependency beyond 4.19.0 to address security vulnerabilities. Vulnerability Details CVEID:CVE-2026-27135 DESCRIPTION: nghttp2 is...
github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object
A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...
Security Bulletin: Multiple security vulnerabilities are addressed with Cloud Pak foundational services 4.19 shipped with IBM Business Automation Workflow containers August 2026
Summary IBM Business Automation Workflow containers include IBM Cloud Pak foundational services. IBM Business Automation Workflow containers August 2026 security fixes update this dependency beyond 4.19 to address security vulnerabilities. Vulnerability Details CVEID:CVE-2026-27135 DESCRIPTION:...
What Is ISPM? How It Differs from IAM, PAM, IGA, and IDaaS
Key Takeaways Identity Security Posture Management ISPM is the continuous risk and posture layer of the identity stack not a replacement for Identity and Access Management IAM, Privileged Access Management PAM, Identity Governance and Administration IGA, or Identity-as-a-Service IDaaS, but the...
Exploit for Unsafe Reflection in Progress Telerik_Ui_For_Asp.Net_Ajax
Telerik RadAsyncUpload RCE Exploit CVE-2026-13181 through 1...
CVE-2026-53613-poc
CVE-2026-53613 PoC TOCTOU vulnerability in mount8 allowing local privilege escalation to root. Vulnerable Versions util-linux 2.41.0 through 2.41.4 util-linux 2.42.0 through 2.42.1 Exploits File| Method| Target ---|---|--- exploitshell.sh| SSH key extraction| /root exploitdirectshell.sh| Direct...
PNGboomer-CVE-2026-77622
PNGboomer — CVE-2026-77622 Denial-of-service exploit for Sliver C2's HTTPS listener. Brute-forces the per-session PNG encoding nonce and delivers a decompression bomb that exhausts server memory. Published as GHSA-663m-7x7m-g4fw. Summary Sliver's HTTPS C2 channel wraps messages inside PNG images...