Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-19 15:03Z
3w ago
2026-08-25 16:16Z
HIGH

CVE-2026-55581 — MCP: A caller of the shell_exec MCP tool can provide the command argument `/bin/bash -c

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-55581

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash in allowed_executables, while security.go validates only the first token and checkBlockedPatternsAndCommands does not reject the shell command-mode flag -c. A caller of the shell_exec MCP tool can provide the command argument `/bin/bash -c <arbitrary-command>`, which passes validation and reaches executor.go, where parse CVSSv3.1 8.4 (HIGH)

CWECWE 78CWECWE 1188CWECWE 183VNDMcpTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
3w ago
2026-08-25 16:16Z
CRIT

CVE-2026-55546 — QWED: Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-55546

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to SymPy's parse_expr() after only normalizing caret syntax to Python exponent syntax, without restricting global_dict, removing Python built-ins, or validating the expression AST. Because parse_expr() calls Python's eval() with built-ins available, an attacker who ca CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDQwedTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-25 16:16Z
HIGH

CVE-2026-55539 — PraisonAI: Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-55539

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAI_JOBS_API_KEY middleware for Authorization or X-API-Key. This issue is fixed in version 4.6.58. CVSSv3.1 8.6 (HIGH)

CWECWE 306VNDPraisonaiTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
3w ago
2026-08-25 16:16Z
CRIT

CVE-2026-55536 — PraisonAI: Extra trailing characters pass before websocket.accept(), allowing start_session commands and unauthorized browser automation.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-55536

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expression chrome-extension://[a-z0-9]{32}. Extra trailing characters pass before websocket.accept(), allowing start_session commands and unauthorized browser automation. This issue is fixed in version 4.6.58. CVSSv3.1 9.1 (CRITICAL)

CWECWE 284CWECWE 625VNDPraisonaiTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
3w ago
2026-08-25 16:16Z
HIGH

CVE-2026-55533 — PraisonAI: Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-55533

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests despite authentication being enabled. This issue is fixed in version 4.6.58. CVSSv3.1 8.2 (HIGH)

CWECWE 306CWECWE 287VNDPraisonaiTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
3w ago
2026-08-25 16:16Z
CRIT

CVE-2025-71407 — Nokogiri: before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71407

Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DTD content or untrusted XSD files to cause denial of service or potential code execution. CVSSv3.1 9.8 (CRITICAL)

CWECWE 787VNDNokogiriTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-25 16:16Z
CRIT

CVE-2024-58378 — Nokogiri: before 1.15.6 and 1.16.x before 1.16.2 (CRuby, when using the packaged libxml2) is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-58378

Nokogiri before 1.15.6 and 1.16.x before 1.16.2 (CRuby, when using the packaged libxml2) is affected by a use-after-free vulnerability in libxml2 (CVE-2024-25062) in the xmlTextReader module, which underlies Nokogiri::XML::Reader. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing a crafted XML document can lead to an xmlValidatePopElement use-after-free. Nokogiri 1.15.6 and 1.16.2 resolve this by upgrading the packaged libxml2 CVSSv3.1 9.8 (CRITICAL)

CWECWE 416VNDNokogiriTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
3w ago
2026-08-25 16:16Z
CRIT

CVE-2022-51000 — Nokogiri: Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-51000

Nokogiri before 1.13.2 (CRuby, when using packaged libraries) ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack. Via CVE-2022-23308 in libxml2, an application parsing an untrusted document with parse option DTDVALID set to true and NOENT set to false may be vulnerable to denial of service, memory dis CVSSv3.1 9.8 (CRITICAL)

CWECWE 416VNDNokogiriTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-25 16:16Z
HIGH

CVE-2022-50999 — Nokogiri: versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-50999

Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information disclosure, data modification, or denial of service. CVSSv3.1 8.6 (HIGH)

CWECWE 119VNDNokogiriTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
3w ago
2026-08-25 15:16Z
HIGH

CVE-2026-70551 — A user who can read an existing remote VCS repository can replace its configured

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-70551

A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL. CVSSv3.1 8.5 (HIGH)

CWECWE 918TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
3w ago
2026-08-25 15:16Z
HIGH

CVE-2026-55534 — PraisonAI: From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-55534

PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. A network caller can invoke configured agents without credentials even when an API key was supplied. This issue is fixed in version 4.6.58. CVSSv3.1 8.6 (HIGH)

CWECWE 306VNDPraisonaiTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
3w ago
2026-08-25 15:16Z
HIGH

CVE-2026-55528 — PraisonAI: Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-55528

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when authentication is configured. This issue is fixed in version 1.6.58. CVSSv3.1 8.2 (HIGH)

CWECWE 862CWECWE 306VNDPraisonaiTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
3w ago
2026-08-25 15:16Z
HIGH

CVE-2026-55526 — PraisonAI: Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_page fetches them.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-55526

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_page fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permitting internal HTTP access. The fix uses socket.getaddrinfo and fails closed on DNS errors. This issue is fixed in version 1.6.58. CVSSv3.1 8.5 (HIGH)

CWECWE 918CWECWE 350VNDPraisonaiTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
3w ago
2026-08-25 15:16Z
CRIT

CVE-2026-16286 — Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-16286

Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This issue affects Software Repository Management: before 2fb4acee. CVSSv3.1 9.8 (CRITICAL)

CWECWE 434TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-25 13:19Z
CRIT

CVE-2026-75803 — Issue: summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD cip CVSSv3.1 9.1 (CRITICAL) · EPSS 2th percentile

CWECWE 354TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
3w ago
2026-08-25 13:19Z
CRIT

CVE-2026-63073 — Issue: The reliable consequence is a denial of service, when the response comes from a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63073

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_ms CVSSv3.1 9.8 (CRITICAL) · EPSS 34th percentile

CWECWE 134TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-25 13:19Z
HIGH

CVE-2026-57863 — Crater: Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57863

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit unsanitized ZIP entry names passed to PHP's ZipArchive::extractTo() to write arbitrary PHP files into the web-accessible public directory and achieve remote code execution on the ser CVSSv3.1 8.8 (HIGH)

CWECWE 22VNDCraterTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
3w ago
2026-08-25 12:16Z
HIGH

CVE-2026-79665 — Ech0: before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-79665

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket logs by sending authenticated session tokens to unprotected endpoints. CVSSv3.1 8.8 (HIGH)

CWECWE 862VNDEch0TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
3w ago
2026-08-25 12:16Z
HIGH

CVE-2026-79662 — Ech0: through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (internal/service/auth/auth.go) that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-79662

Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (internal/service/auth/auth.go) that compares only the scheme and host of the client-supplied redirect_uri against the admin-configured allowlist, ignoring path, query, and fragment components. The redirect_uri is embedded into the signed state JWT at login time without validation. An attacker can craft a redirect_uri whose host matches an allowed origin but whose path CVSSv3.1 8.0 (HIGH)

CWECWE 601VNDEch0TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
3w ago
2026-08-25 12:16Z
CRIT

CVE-2026-79657 — NLTK: versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-79657

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer._execute and numpy.f2py.crackfortran.myeval through pickle REDUCE to execute arbitrary commands during model or tokenizer artifact loading. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502VNDNltkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-25 12:16Z
HIGH

CVE-2026-19949 — One: The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19949

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This CVSSv3.1 8.8 (HIGH)

CWECWE 89VNDOneTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
3w ago
2026-08-25 11:16Z
HIGH

CVE-2026-59335 — CWE: Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-59335

Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to the privileged uaa (system) identity zone, by referring to the zone identifier in a non-lowercase form (e.g. UAA) in the request path and body. The authorization layer performs a cas CVSSv3.1 8.7 (HIGH)

CWECWE 178VNDCweTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
3w ago
2026-08-25 11:16Z
CRIT

CVE-2026-55976 — Server: Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-55976

Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is subsequently queried. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity. Users are recommended to upgrade to ver CVSSv3.1 9.1 (CRITICAL)

CWECWE 918TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
3w ago
2026-08-25 11:16Z
CRIT

CVE-2026-49845 — SQL: injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-49845

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes t CVSSv3.1 9.8 (CRITICAL)

CWECWE 94TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-25 11:00Z
CRIT

State divergence enables unauthorized access

Trail of Bits·blog.trailofbits.com

Trail of Bits disclosed a critical authorization bypass in Provenance Blockchain's marker module (versions before 1.28.0) that allowed any user to grant themselves admin control over marker accounts without holding tokens. The vulnerability stemmed from state divergence: the authorization check compared against a stale supply field (always 0 for non-fixed markers) rather than the live bank module supply, making the condition 0 == 0 unconditionally true. The bug affected 82 live markers representing ~$500k in escrowed assets and multiple tokenized financial instruments; exploitation required only two transactions.

SRFApplicationTACTA0001SWCosmos SdkVNDProvenanceTYPResearchTYPVulnerabilitySTGInitial AccessSTGImpact
88
Edit Score