CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in PraisonAI Platform before version 0.1.4. An IDOR (Insecure Direct Object Reference) flaw in project CRUD endpoints allows a member of any workspace to read, modify, delete, or read stats of projects belonging to another workspace.
IDOR vulnerability in PraisonAI Platform (versions before 0.1.4) in comment endpoints allows a member of any workspace to read and post comments to issues in other workspaces without verifying issue ownership.
An IDOR vulnerability in PraisonAI Platform allows a member of one workspace to read, modify, or delete issues belonging to another workspace. The issue exists in versions prior to 0.1.4.
IDOR vulnerability in PraisonAI Platform (versions before 0.1.4) allows an authenticated workspace member to manipulate labels and issues belonging to other workspaces. No verification that the label/issue belongs to the workspace.
Vulnerability in PraisonAI Platform before version 0.1.4. Missing authorization on the DELETE /workspaces/{workspace_id} endpoint allows any workspace member to delete the entire workspace along with all associated data (projects, issues, comments, agents, labels, member records).
A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation could allow a remote low-privileged user to execute arbitrary code as a privileged user on the underlying operating system.
Information disclosure vulnerability in Confluence Data Center. An unauthenticated attacker can access sensitive information without authentication.
RCE vulnerability in Sourcetree for Mac and Windows version 3.4.11. Requires authentication and user interaction. Attacker can execute arbitrary code with high impact on confidentiality, integrity, and availability.
In ansible-core, the _extract_collection_from_git() function in concrete_artifact_manager.py constructs git clone commands without a '--' separator before user-supplied URLs. An attacker can provide a malicious collection source URI containing git argument injection, leading to arbitrary command execution during collection installation.
In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.
A vulnerability in PraisonAI Platform allows any workspace member to remove any other member, including the workspace owner, without role checking. The issue exists in versions prior to 0.1.4.
Insecure Direct Object Reference (IDOR) vulnerability in PraisonAI Platform before version 0.1.4. Dependency endpoints do not verify that issue and dependency IDs belong to the checked workspace, allowing an attacker to create links between any issues in the database.
Vulnerability in PraisonAI Platform before version 0.1.4. Broken access control in workspace management routes allows any authenticated low-privilege member to escalate their role to owner.
In PraisonAI Platform before version 0.1.4, workspace-scoped REST routes have an object-level authorization flaw allowing an authenticated user from one workspace to access objects of another workspace by supplying the victim's global UUID.
A vulnerability in PraisonAI versions prior to 4.6.40 allows arbitrary code execution through unguarded spec.loader.exec_module calls in agents_generator.py. These functions accept a module_path parameter from YAML configuration and execute it without validation, allowing an attacker to execute remote code.
Vulnerability in PraisonAI (versions prior to 4.6.40) where hidden metadata in a webpage causes PraisonAI agents to write attacker-controlled content to arbitrary paths. The write_file function skips path validation when workspace=None (always in production).
A denial of service vulnerability in react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages versions 19.0.0-19.0.7, 19.1.0-19.1.8, and 19.2.0-19.2.7. Specially crafted HTTP requests to server function endpoints can cause excessive CPU usage.
SQL injection and security boundary bypass vulnerability in the bigquery-forecast tool of googleapis/mcp-toolbox. An attacker can inject malicious SQL queries via client-controlled parameters, bypassing the allowedDatasets mechanism and accessing arbitrary BigQuery tables.
Vulnerability in BuildKit allows a malicious Git source, when git.checkoutbundle=true is set, to execute a crafted command on the host during checkout.
A malicious BuildKit client or frontend can craft a request that causes the BuildKit daemon to crash with a panic.