A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown processing of the file kicad_mcp/utils/path_validator.py. Performing a manipulati...

CVE-2026-15528

A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown processing of the file k

历史摘要 · 未重新核验 · NVD

SafeInstall agent guard shell parsing can miss raw package execution

## Summary SafeInstall CLI through 0.10.1 can fail to recognize some package-manager and registry-runner commands in it

历史摘要 · 未重新核验 · GitHub Advisory

PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisona...

CVE-2026-61437

PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFl

历史摘要 · 未重新核验 · NVD

PraisonAI before 4.6.78 contains a prompt injection defense bypass vulnerability where the injection defense only blocks threats classified as CRITICAL, requiring three or more ...

CVE-2026-60086

PraisonAI before 4.6.78 contains a prompt injection defense bypass vulnerability where the injection defense only blocks

历史摘要 · 未重新核验 · NVD

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, POST /api/file/globalCopyFiles accepts attacker-supplied absolute source paths and relies on util....

CVE-2026-59854

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, POST /api/file/globalCopyFiles accepts at

历史摘要 · 未重新核验 · NVD

Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP)...

CVE-2026-0278

Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow

历史摘要 · 未重新核验 · GitHub Advisory

Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to bypass DLP policy enforcement controls. ...

CVE-2026-0278

Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow

历史摘要 · 未重新核验 · NVD

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, WEB_FETCH_FILTER_LIST matching compared configured host entries against UR...

CVE-2026-59223

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, WEB_FETCH_FILTER_

历史摘要 · 未重新核验 · NVD

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

CVE-2026-59223

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, WEB_FETCH_FILTER_

历史摘要 · 未重新核验 · OSV.dev

n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on ...

CVE-2026-59207

n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents feature did not enforce th

历史摘要 · 未重新核验 · NVD

n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

CVE-2026-59207

n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents feature did not enforce th

历史摘要 · 未重新核验 · OSV.dev

oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

CVE-2026-53508

## Summary From **v1.13.2** through **v1.18.0**, oasdiff did not enforce `--allow-external-refs=false` (library: `opena

历史摘要 · 未重新核验 · GitHub Advisory

netfoil has a domain name filter bypass via multiple questions

### Summary Potential bypass of domain name filter by crafting a DNS request with multiple questions, with the first que

历史摘要 · 未重新核验 · GitHub Advisory

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

`determine_backup_mode` in `src/uucore/src/lib/features/backup_control.rs` only checks `--backup`/`-b` and returns `Back

历史摘要 · 未重新核验 · GitHub Advisory

rm: 'rm -rf ./' (and ./// variants) silently deletes current directory contents, bypassing dot protection

CVE-2026-35363

`rm -rf .` is correctly refused, but `clean_trailing_slashes` normalizes `.///` to `./` while `path_is_current_or_parent

历史摘要 · 未重新核验 · GitHub Advisory

rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)

CVE-2026-35349

The `--preserve-root` check uses a path-string test (`path.has_root() && path.parent().is_none()`) rather than comparing

历史摘要 · 未重新核验 · GitHub Advisory

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass...

CVE-2026-14535

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls A

历史摘要 · 未重新核验 · GitHub Advisory

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it...

CVE-2026-14535

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls A

历史摘要 · 未重新核验 · NVD

A security flaw has been discovered in NousResearch hermes-agent up to 0.15.2. The affected...

CVE-2026-14625

A security flaw has been discovered in NousResearch hermes-agent up to 0.15.2. The affected element is the function shel

历史摘要 · 未重新核验 · GitHub Advisory

A security flaw has been discovered in NousResearch hermes-agent up to 0.15.2. The affected element is the function shell.exec of the file tui_gateway/server.py. The manipulatio...

CVE-2026-14625

A security flaw has been discovered in NousResearch hermes-agent up to 0.15.2. The affected element is the function shel

历史摘要 · 未重新核验 · NVD