Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
6.9 MEDIUM
CVE-2026-7864 — Exposure of Sensitive Information to an Unauthorized Actor

SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the new GINA UI, allowing remote attackers to obtain sensitive system i…

Remote | Information Disclosure
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
8.7 HIGH
CVE-2026-44340 — PraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`

PraisonAI is a multi-agent teams system. Prior to version 4.6.37, the _safe_extractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member…

Remote | Path Traversal
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
8.6 HIGH
CVE-2026-44339 — PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__…

PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and praisonaiagents version 1.6.37, praisonaiagents resolves unresolved tool names against module globals and __main__ after…

Remote | Misconfiguration
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
7.3 HIGH
CVE-2026-44338 — PraisonAI ships and generates a legacy API server with authentication disabled by default…

PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any …

Remote | Authentication
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
6.3 MEDIUM
CVE-2026-44337 — PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and …

PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers …

Remote | Injection
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
9.4 CRITICAL
CVE-2026-44336 — PraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injection

PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (praisonai mcp serve) registers four file-handling tools by default — praisonai.rules…

Remote | Path Traversal
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
7.7 HIGH
CVE-2026-44335 — SSRF bypass in PraisonAI

PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. This issue has b…

Remote | Server-Side Request Forgery
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
8.4 HIGH
CVE-2026-44334 — PraisonAI: Unauthenticated RCE via `tool_override.py`

PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, CVE-2026-40287's fix gated tools.py auto-import behind PRAISONAI_ALLOW_LOCAL_TOOLS=true in two files (tool_reso…

| Misconfiguration
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
8.3 HIGH
CVE-2026-44129 — Server-side template injection

SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new GINA UI because an endpoint accepts attacker-controlled template, allowing remot…

Remote | Injection
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
9.3 CRITICAL
CVE-2026-44128 — Unauthenticated Remote Code Execution

SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a parameter to Perl's e…

Remote | Injection
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
8.8 HIGH
CVE-2026-44127 — Local File Inclusion (LFI) and Arbitrary File Deletion

SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the identifier parameter of /api.app/attachment/preview that allows remote attackers to…

Remote | Path Traversal
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
9.2 CRITICAL
CVE-2026-44126 — Insecure deserialization

SEPPmail Secure Email Gateway before version 15.0.4 insecurely deserializes untrusted data, which can be reached from the new GINA UI and may allow unauthenticated remote attackers to execute code vi…

Remote | Injection
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
9.3 CRITICAL
CVE-2026-44125 — Missing Authorization in GINAv2

SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multiple endpoints in the new GINA UI, allowing unauthenticated remote attackers to access functionality …

Remote | Authorization
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
0.0 NA
CVE-2026-43350 — smb: client: require a full NFS mode SID before reading mode bits

In the Linux kernel, the following vulnerability has been resolved: smb: client: require a full NFS mode SID before reading mode bits parse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an…

| Misconfiguration
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
0.0 NA
CVE-2026-43349 — f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer syzbot reported a f2fs bug as below: BUG: KMSAN: uninit-…

| Memory Corruption
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
0.0 NA
CVE-2026-43348 — mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER

In the Linux kernel, the following vulnerability has been resolved: mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER When registering VTL0 memory via MSHV_ADD_VTL0_MEMORY, the kernel computes …

| Misconfiguration
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
0.0 NA
CVE-2026-43347 — arm64: dts: qcom: monaco: Reserve full Gunyah metadata region

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region We observe spurious "Synchronous External Abort" exceptions (ESR=0x…

| Misconfiguration
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
0.0 NA
CVE-2026-43346 — ice: ptp: don't WARN when controlling PF is unavailable

In the Linux kernel, the following vulnerability has been resolved: ice: ptp: don't WARN when controlling PF is unavailable In VFIO passthrough setups, it is possible to pass through only a PF whic…

| Misconfiguration
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
0.0 NA
CVE-2026-43345 — net: ipa: fix event ring index not programmed for IPA v5.0+

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix event ring index not programmed for IPA v5.0+ For IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to …

| Misconfiguration
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
0.0 NA
CVE-2026-43344 — perf/x86/intel/uncore: Fix die ID init and look up bugs

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix die ID init and look up bugs In snbep_pci2phy_map_init(), in the nr_node_ids > 8 path, uncore_device_t…

| Misconfiguration
May 08, 2026 May 08, 2026
May 08, 2026
May 08, 2026
Showing 20 of 5794 Results