Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass
CVE-2026-44180
### Summary Jupyter Enterprise Gateway has a prohibited UID and GID feature that by default prevents launching kernels
#severity:critical
共收录 1443 条相关情报。
← 返回所有主题The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism...
CVE-2026-5076
The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, a
OpenMed before 1.5.2 contains a remote code execution vulnerability in the PII privacy-filter...
CVE-2026-47117
OpenMed before 1.5.2 contains a remote code execution vulnerability in the PII privacy-filter model loading path. The pr
Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an...
CVE-2026-0611
Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code
SIP signaling stack in Verizon IMS (unspecified version) implements SIP signaling without IPsec...
CVE-2026-10629
SIP signaling stack in Verizon IMS (unspecified version) implements SIP signaling without IPsec integrity protection (mi
CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4...
CVE-2026-7198
CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unaut
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from...
CVE-2026-7312
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152
Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure....
CVE-2026-40965
Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vul
praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members
CVE-2026-47413
## Summary **Type:** Privilege escalation / cross-tenant member injection. The `POST /workspaces/{workspace_id}/members
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
CVE-2026-47428
## Summary Vitest browser mode served `/__vitest_test__/` with the `otelCarrier` query parameter inserted directly into
When Vitest UI server is listening, arbitrary file can be read and executed
CVE-2026-47429
### Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the net
Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated...
CVE-2018-25412
Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload maliciou
praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}
CVE-2026-47416
## Summary **Type:** Vertical privilege escalation. The `PATCH /workspaces/{workspace_id}/members/{user_id}` endpoint i
praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset
CVE-2026-47410
## Summary **Type:** Insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal `"dev
PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation
CVE-2026-47407
## Summary The Platform server exposes resources under `/api/v1/workspaces/{workspace_id}/...` and protects them with a
PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
CVE-2026-47391
## Summary The first-party PraisonAI A2A server example combines three behaviors into a remotely exploitable Critical c
PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)
CVE-2026-47392
## Summary `execute_code()` in `praisonaiagents/tools/python_tools.py` (v1.6.37, subprocess sandbox mode) can be fully
PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
CVE-2026-47393
### Summary CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (`praisonai.deploy.api
PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
CVE-2026-47396
### Summary PraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER
stigmem-node's federation peer registration lacked explicit out-of-band approval
### Impact Federation peer registration accepted peer key material during registration without a separate administrator