Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
9.1 CRITICAL
CVE-2026-57145 — PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without trav…

praisonai | Remote | Path Traversal
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
8.2 HIGH
CVE-2026-57132 — PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables aut…

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentica…

praisonai | Remote | Authentication
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
9.8 CRITICAL
CVE-2026-57131 — praisonai: Jobs API exposes agent-execution endpoints with no authentication

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorizatio…

praisonai | Remote | Authorization
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
9.8 CRITICAL
CVE-2026-57127 — praisonai: recipe serve auth middleware silently disables itself when no secret is set

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware f…

praisonai | Remote | Authentication
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
9.8 CRITICAL
CVE-2026-57124 — PraisonAI UI MCP connect endpoint allows unauthenticated local command execution

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args …

praisonai | Remote | Authentication
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
8.6 HIGH
CVE-2026-57122 — PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing…

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is configured and …

praisonai | Remote | Misconfiguration
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
7.5 HIGH
CVE-2026-57119 — PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs and passes it to the job executor without…

praisonai | Remote | Path Traversal
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
7.3 HIGH
CVE-2026-56839 — PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforc…

praisonai | Remote | Path Traversal
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
6.9 MEDIUM
CVE-2026-55795 — Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or G…

craft_commerce | Remote | Authentication
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
5.9 MEDIUM
CVE-2026-55236 — langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants…

langsmith | Remote | Authorization
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
5.9 MEDIUM
CVE-2026-55235 — langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes w…

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in…

langsmith | Remote | Authentication
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
3.7 LOW
CVE-2026-54542 — Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserializ…

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a craft…

core-rs-albatross nimiq_proof-of-stake | Remote | Memory Corruption
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
3.7 LOW
CVE-2026-54541 — Nimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keys

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a craft…

core-rs-albatross nimiq_proof-of-stake | Remote | Memory Corruption
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
5.3 MEDIUM
CVE-2026-54529 — SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enfo…

Remote | Information Disclosure
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
6.6 MEDIUM
CVE-2026-53708 — ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/t…

ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call s…

Remote | Server-Side Request Forgery
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
6.4 MEDIUM
CVE-2026-4103 — Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows…

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execut…

api_manager api_control_plane | Remote | Cross-Site Scripting
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
7.7 HIGH
CVE-2026-47701 — OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sen…

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to tr…

Remote | Authorization
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
6.8 MEDIUM
CVE-2025-24890 — gix-sec safe.directory protections absent for elevated administrators

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a …

gix-fs gitoxide | Misconfiguration
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
0.0 NA
CVE-2026-90801 — GNU Binutils ld cache.c cache_bwrite buffer overflow

A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cache_bwrite of the file bfd/cache.c of the component ld. The manipulation of the argument nbytes results in buffer…

binutils | Memory Corruption
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
0.0 NA
CVE-2026-54452 — safeurl: Missing IPv6 CIDR Ranges in Blocklist

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an …

| Server-Side Request Forgery
Sep 14, 2026 Sep 14, 2026
Sep 14, 2026
Sep 14, 2026
Showing 20 of 12547 Results