{"vulnerability": "CVE-2026-5554", "sightings": [{"uuid": "727c2b06-60d0-4117-b087-8433a829b05e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5554", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miqpyw73fj2n", "content": "", "creation_timestamp": "2026-04-05T12:14:27.272821Z"}, {"uuid": "b5cd5f62-d5fc-4aee-8531-f62a7ec4eecc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5554", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3miqrja4uit2n", "content": "", "creation_timestamp": "2026-04-05T12:41:28.004167Z"}, {"uuid": "0d531674-09c4-447d-b0f5-e0c1dc3fb6f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5554", "type": "published-proof-of-concept", "source": "Telegram/8Kty84VYI9Md0M9SNY3xGd7cM29Jpy_2z-fm4_LFUn2UMmE", "content": "", "creation_timestamp": "2026-04-05T11:15:53.000000Z"}, {"uuid": "25b9b975-b8ac-4119-9aad-04728341d098", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55542", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq6a62hksq2l", "content": "CVE-2026-55542 - Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL\nCVE ID : CVE-2026-55542\n \n Published : July 8, 2026, 8:32 p.m. | 27\u00a0minutes ago\n \n Description : Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, Snipe-I...", "creation_timestamp": "2026-07-08T23:04:37.076456Z"}, {"uuid": "10ed5722-7853-4768-bc44-a693a0cebd90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55546", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2kkjtwu7rva4w", "content": "CVE-2026-55546 - QWED-MCP: Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input\nCVE ID : CVE-2026-55546\n \n Published : Aug. 25, 2026, 3:25 p.m. | 40\u00a0minutes ago\n \n Description : QWED-MCP is a deterministic verification gateway for MCP. Prior ...", "creation_timestamp": "2026-08-25T16:20:45.940793Z"}, {"uuid": "5e1bcab0-f755-4652-9a4f-489df62bf99e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55540", "type": "published-proof-of-concept", "source": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8", "content": "", "creation_timestamp": "2026-08-25T16:35:37.336184Z"}, {"uuid": "8b10a15e-2373-41db-8efe-3fe16829af77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55546", "type": "published-proof-of-concept", "source": "https://github.com/QWED-AI/qwed-mcp/security/advisories/GHSA-mw6r-2hvm-4rp2", "content": "", "creation_timestamp": "2026-08-25T16:35:12.596639Z"}, {"uuid": "0d9e744f-cc71-4461-be15-73154aca3249", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55541", "type": "published-proof-of-concept", "source": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pvxx-r596-f5qj", "content": "", "creation_timestamp": "2026-08-25T16:35:26.278959Z"}, {"uuid": "c12ca132-f37e-4fab-a383-88a0d75a39cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55546", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtwfyjq4ga2b", "content": "\ud83d\udea8 CVE-2026-55546 \u2014 CVSS 9.8 CRITICAL\n\nQWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/q...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-55546\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-25T18:08:22.676426Z"}, {"uuid": "b821c5d6-c2c0-4edb-b5af-c410ecd6c842", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55540", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mtwgc6uuyp2g", "content": "CVE-2026-55540 - Arbitrary File Read in PraisonAI via symlink path traversal. CVSS 7.1. Update to version 4.6.58 immediately. #CVE #PraisonAI #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-55540/", "creation_timestamp": "2026-08-25T18:13:47.294392Z"}, {"uuid": "48c20221-9ea2-4b31-8e79-a76bbab4e3b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55540", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117157503109943772", "content": "CVE-2026-55540 - Arbitrary File Read in PraisonAI via symlink path traversal. CVSS 7.1. Update to version 4.6.58 immediately. #CVE #PraisonAI #infosec\nhttps://www.valtersit.com/cve/CVE-2026-55540/", "creation_timestamp": "2026-08-25T18:13:53.133907Z"}, {"uuid": "801587f9-f5f0-4d84-8170-0cd834940fc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55544", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4fkeqfif2u", "content": "\ud83d\udfe0 CVE-2026-55544 - High (7.6)\n\nNextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MC...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55544/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-20T23:00:51.795858Z"}, {"uuid": "34f2156c-8978-4413-b2de-a730fc0da29d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55546", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtwvqamtmb2b", "content": "CVE-2026-55546 - qwed-mcp\nThe qwed-mcp tool (version 0.2.0) processes math expressions without checking them, letting a malicious user insert code that the system will execute. This can give an attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#qwedmcp #qwedai #pip #CVE #infosec", "creation_timestamp": "2026-08-25T22:50:04.576312Z"}, {"uuid": "5c1782a1-423c-45ad-bb8d-5e782c4667e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55541", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtx4gsv7ss2f", "content": "CVE-2026-55541 - praisonai\nThe PraisonAI command that should require an API key does not actually check it, leaving the server accessible to anyone. This affects versions from 4.6.34 onward,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#praisonai #mervinpraison #pip #CVE #infosec", "creation_timestamp": "2026-08-26T00:50:04.621517Z"}, {"uuid": "9e305432-3698-441e-8252-bd0c16ac7de0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55541", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mtw4n5te3z2v", "content": "PraisonAI's `praisonai serve agents` and `serve unified` parse `--api-key` but never wire it into the FastAPI app \u2014 no middleware, no header check. CVE-2026-55541, HIGH, confirmed on 4.6.50: the server runs open regardless of the key you set. #dev", "creation_timestamp": "2026-08-25T15:20:58.165186Z"}]}