Mechanize sends credential headers to another host after an HTTP redirect
CVE-2026-107715
## Summary `mechanize` leaked credentials to the redirect target when an HTTP redirect crossed to another host. Credent
#advisory
共收录 23210 条相关情报。
← 返回所有主题Hazelcast: Arbitrary member memory access by low-privileged client
CVE-2026-107726
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.1
Hazelcast: Authorization bypass in IMap Predicates API
CVE-2026-107725
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.1
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
CVE-2026-107720
### Summary `createVerifier` in fast-jwt ≤ 6.3.0 skips signature verification entirely when the `key` option is a falsy
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
CVE-2026-107722
### Summary The fix for CVE-2026-34950 (CVSS 9.1, released in v6.2.0) is **incomplete**. It adds `key.trim()` to the PE
fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)
CVE-2026-107721
## Summary `createVerifier({ clockTolerance: Infinity })` silently bypasses both `exp` (expiry) AND `nbf` (not-before)
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
CVE-2026-107723
### Summary `fast-jwt`'s `createVerifier` silently skips **all** configured claim validators (`exp`, `nbf`, `iss`, `aud
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
CVE-2026-107724
### Summary `fast-jwt` 6.2.4 silently classifies raw serialized public JWK JSON as an HMAC secret. If an application s
PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure
CVE-2026-61426
## Summary The AgentOS server in the `praisonai` TypeScript/npm package ships an insecure default: it binds `0.0.0.0`,
PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass
CVE-2026-61442
# Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass ## Summary `p
PraisonAI: Shell command allowlist bypass via find -exec built-in action
CVE-2026-61434
### Summary The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2m
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
CVE-2026-61445
### Summary The `AICoder` UI component exposes `write_to_file` and `execute_command` tools to the LLM with no path valid
PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
CVE-2026-61427
## Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaul
PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization
CVE-2026-61440
# Platform members can rewrite shared labels and owner issue labels without owner/admin authorization ## Summary `prai
PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend
CVE-2026-60085
Summary SecurityPolicy in praisonaiagents/sandbox/config.py is a documented configuration data class with fields for all
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
CVE-2026-60091
## Summary PraisonAI's Async Jobs API enables its API-key middleware **only when `PRAISONAI_JOBS_API_KEY` is set**, so
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
CVE-2026-107724
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or
Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions
CVE-2026-107831
Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-c
Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint
CVE-2026-107830
Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction en
Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql
CVE-2026-107829
Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digest