https://vulnerability.circl.lu Latest vulnerabilities published by the CNAs operating under the mitre root of the CVE Program. http://www.rssboard.org/rss-specification python-feedgen en Tue, 25 Aug 2026 15:38:55 +0000 https://vulnerability.circl.lu/vuln/cve-2026-55530 PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool https://vulnerability.circl.lu/vuln/cve-2026-55530 Tue, 25 Aug 2026 14:45:07 +0000 https://vulnerability.circl.lu/vuln/cve-2026-55534 PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution https://vulnerability.circl.lu/vuln/cve-2026-55534 Tue, 25 Aug 2026 14:41:13 +0000 https://vulnerability.circl.lu/vuln/cve-2026-55526 PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) https://vulnerability.circl.lu/vuln/cve-2026-55526 Tue, 25 Aug 2026 14:36:09 +0000 https://vulnerability.circl.lu/vuln/cve-2026-55531 PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced) PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced) https://vulnerability.circl.lu/vuln/cve-2026-55531 Tue, 25 Aug 2026 14:33:51 +0000 https://vulnerability.circl.lu/vuln/cve-2026-55528 praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862) praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862) https://vulnerability.circl.lu/vuln/cve-2026-55528 Tue, 25 Aug 2026 14:32:05 +0000 https://vulnerability.circl.lu/vuln/cve-2026-55529 PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server https://vulnerability.circl.lu/vuln/cve-2026-55529 Tue, 25 Aug 2026 14:26:30 +0000 https://vulnerability.circl.lu/vuln/cve-2026-16286 File Upload in TRTEK Software's Software Repository Management File Upload in TRTEK Software's Software Repository Management https://vulnerability.circl.lu/vuln/cve-2026-16286 Tue, 25 Aug 2026 14:26:19 +0000 https://vulnerability.circl.lu/vuln/cve-2026-16599 Denial of Service in GNU wget Denial of Service in GNU wget https://vulnerability.circl.lu/vuln/cve-2026-16599 Tue, 25 Aug 2026 14:17:04 +0000 https://vulnerability.circl.lu/vuln/cve-2026-55525 PraisonAI: SSRF via redirect-following in praisonaiagents web_crawl PraisonAI: SSRF via redirect-following in praisonaiagents web_crawl https://vulnerability.circl.lu/vuln/cve-2026-55525 Tue, 25 Aug 2026 14:07:08 +0000 https://vulnerability.circl.lu/vuln/cve-2026-79655 Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write https://vulnerability.circl.lu/vuln/cve-2026-79655 Tue, 25 Aug 2026 13:49:37 +0000