https://vulnerability.circl.lu/cna-root/mitre/recent Most recent vulnerabilities from the mitre CNA root 2026-08-25T15:38:56.586124+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Latest vulnerabilities published by the CNAs operating under the mitre root of the CVE Program. https://vulnerability.circl.lu/vuln/cve-2026-55530 CVE-2026-55530 (GitHub_M) 2026-08-25T14:45:07.570000+00:00 PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool 2026-08-25T14:45:07.570000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-55534 CVE-2026-55534 (GitHub_M) 2026-08-25T14:41:13.869000+00:00 PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution 2026-08-25T14:41:13.869000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-55526 CVE-2026-55526 (GitHub_M) 2026-08-25T14:36:09.934000+00:00 PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) 2026-08-25T14:36:09.934000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-55531 CVE-2026-55531 (GitHub_M) 2026-08-25T14:33:51.733000+00:00 PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced) PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced) 2026-08-25T14:33:51.733000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-55528 CVE-2026-55528 (GitHub_M) 2026-08-25T14:32:05.929000+00:00 praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862) praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862) 2026-08-25T14:32:05.929000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-55529 CVE-2026-55529 (GitHub_M) 2026-08-25T14:26:30.692000+00:00 PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server 2026-08-25T14:26:30.692000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-16286 CVE-2026-16286 (TR-CERT) 2026-08-25T14:26:19.608000+00:00 File Upload in TRTEK Software's Software Repository Management File Upload in TRTEK Software's Software Repository Management 2026-08-25T14:26:19.608000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-16599 CVE-2026-16599 (CERT-PL) 2026-08-25T14:17:04.941000+00:00 Denial of Service in GNU wget Denial of Service in GNU wget 2026-08-25T14:17:04.941000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-55525 CVE-2026-55525 (GitHub_M) 2026-08-25T14:07:08.551000+00:00 PraisonAI: SSRF via redirect-following in praisonaiagents web_crawl PraisonAI: SSRF via redirect-following in praisonaiagents web_crawl 2026-08-25T14:07:08.551000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-79655 CVE-2026-79655 (redhat) 2026-08-25T13:49:37.593000+00:00 Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write 2026-08-25T13:49:37.593000+00:00