Lucene search
+L

5641 matches found

Cvelist
Cvelist
•added 2026/07/11 1:01 p.m.•56 views

CVE-2026-61428 PraisonAI AgentMail before 4.6.78 Message Injection via Webhook

PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed sender addresses. Attackers can POST crafted message.received events to the webhook endpoint to inject arbitrary content into the agent and...

7.3CVSS0.00373EPSS
SaveExploits0References2
OSV
OSV
•added 2026/07/11 1:01 p.m.•23 views

CVE-2026-61428 PraisonAI AgentMail before 4.6.78 Message Injection via Webhook

PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed sender addresses. Attackers can POST crafted message.received events to the webhook endpoint to inject arbitrary content into the agent and...

6.9CVSS6.2AI score
SaveExploits0References4
CVE
CVE
•added 2026/07/11 1:01 p.m.•55 views

CVE-2026-61428

PraisonAI AgentMail is affected by CVE-2026-61428 in versions before 4.6.78, where webhook messages lack signature verification. This enables unauthenticated attackers to POST crafted message.received events to the webhook endpoint, injecting arbitrary content into the agent and triggering replie...

7.3CVSS6.2AI score0.00373EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
•added 2026/07/11 1:01 p.m.•11 views

CVE-2026-61428 PraisonAI AgentMail before 4.6.78 Message Injection via Webhook

PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed sender addresses. Attackers can POST crafted message.received events to the webhook endpoint to inject arbitrary content into the agent and...

7.3CVSS6.2AI score0.00373EPSS
SaveExploits0References2
attackerkb
attackerkb
•added 2026/07/11 1:01 p.m.•13 views

CVE-2026-61428

PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed sender addresses. Attackers can POST crafted message.received events to the webhook endpoint to inject arbitrary content into the agent and...

7.3CVSS6.2AI score0.00373EPSS
SaveExploits0References3
NVD
NVD
•added 2026/07/11 6:16 a.m.•18 views

CVE-2026-7655

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook...

8.1CVSS0.00469EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/07/11 4:32 a.m.•18 views

EUVD-2026-43148

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook...

8.1CVSS6.1AI score0.00469EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/07/11 4:32 a.m.•56 views

CVE-2026-7655 SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook...

8.1CVSS0.00469EPSS
SaveExploits0References2
attackerkb
attackerkb
•added 2026/07/11 4:32 a.m.•11 views

CVE-2026-7655

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook...

8.1CVSS6.1AI score0.00469EPSS
SaveExploits0References3
CVE
CVE
•added 2026/07/11 4:32 a.m.•36 views

CVE-2026-7655

The CVE identifies a vulnerability in the SureCart WordPress plugin up to version 4.2.3. It allows privilege escalation via account takeover by forged customer.updated webhook events because the plugin does not properly validate a user’s identity before updating details (e.g., email) during custo...

8.1CVSS6.1AI score0.00469EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
•added 2026/07/11 4:32 a.m.•9 views

CVE-2026-7655 SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook...

8.1CVSS6.1AI score0.00469EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/07/11 12:00 a.m.•0 views

CVE-2026-61428: Authentication Bypass by Spoofing

PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed sender addresses. Attackers can POST crafted message.received events to the webhook endpoint to inject arbitrary content into the agent and...

7.3CVSS5.9AI score0.00373EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/07/11 12:00 a.m.•23 views

PT-2026-57403

Name of the Vulnerable Software and Affected Versions SureCart versions prior to 4.2.4 Description An issue exists that allows privilege escalation via account takeover. The software fails to properly validate a user's identity when updating details, such as the email address, during customer...

8.1CVSS6.1AI score0.00469EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/07/11 12:00 a.m.•24 views

PT-2026-57435

PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed sender addresses. Attackers can POST crafted message.received events to the webhook endpoint to inject arbitrary content into the agent and...

7.3CVSS6.2AI score0.00373EPSS
SaveExploits0References3
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/07/11 12:00 a.m.•0 views

CVE-2026-7655: Weak Password Recovery Mechanism for Forgotten Password

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook...

8.1CVSS5.7AI score0.00469EPSS
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
•added 2026/07/10 10:43 p.m.•37 views

Malicious code in fkext-browser-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e56088bc1216133ce76ad6026b73c2fd6977f9c64ec1c2ab38234dc90403b2c The package runs vishu.js as a preinstall lifecycle hook on npm install. That script fetches the machine's public IP from api.ipify.org, collects...

6.1AI score
SaveExploits0References2
OSV
OSV
•added 2026/07/10 10:43 p.m.•19 views

MAL-2026-10183 Malicious code in fkext-browser-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e56088bc1216133ce76ad6026b73c2fd6977f9c64ec1c2ab38234dc90403b2c The package runs vishu.js as a preinstall lifecycle hook on npm install. That script fetches the machine's public IP from api.ipify.org, collects...

6.1AI score
SaveExploits0References2
Cvelist
Cvelist
•added 2026/07/10 9:31 p.m.•52 views

CVE-2026-59155 Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials, including Cloudflare API tokens, TencentCloud...

6.9CVSS0.00483EPSS
SaveExploits0References3
OSV
OSV
•added 2026/07/10 9:31 p.m.•19 views

CVE-2026-59155 Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials, including Cloudflare API tokens, TencentCloud...

6.9CVSS6.1AI score
SaveExploits0References5
Snyk
Snyk
•added 2026/07/10 4:36 p.m.•15 views

Server-side Request Forgery (SSRF)

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

7.2CVSS6.1AI score0.00301EPSS
SaveExploits0References2
Rows per page
Query Builder