•13 minutes ago•CVE-2026-61427
7.3CVE-2026-61427: Authentication Bypass and Unvalidated Tool Execution in PraisonAI MCP HTTP-Stream Server
CVE-2026-61427 is a critical authentication bypass and improper input validation vulnerability within the Model Context Protocol (MCP) HTTP-stream server of PraisonAI. In versions prior to 4.6.78, the server lacks authentication by default and forwards client messages directly to Python tool handlers without input validation. When bound to non-localhost interfaces, this permits unauthenticated remote attackers to perform unauthorized administrative operations and execute tools.
0 views•4 min read
•about 1 hour ago•CVE-2026-107387
6.2CVE-2026-107387: Uncontrolled Memory Allocation (OOM) in music-metadata APEv2 Parser
CVE-2026-107387 is a high-impact uncontrolled memory allocation vulnerability in music-metadata, a widely used Node.js metadata parser. The flaw occurs in the APEv2 tag parser, where the library reads an attacker-controlled 32-bit integer indicating the tag size and immediately requests a corresponding heap buffer reservation. Because this allocation occurs before validating if the input stream actually contains those bytes, an attacker can supply a minuscule audio file to trigger large, disproportionate allocations, resulting in heap exhaustion and an uncatchable process-wide Out of Memory (OOM) crash.
3 views•5 min read
•about 2 hours ago•CVE-2026-107391
6.2CVE-2026-107391: Synchronous Infinite Loop and Memory Exhaustion in music-metadata MP4 Parser
An input validation vulnerability exists in music-metadata versions prior to 11.16.0, where parsing a crafted MP4 file containing a sample-description (stsd) box with a zero-value size entry causes a synchronous infinite loop and memory exhaustion, resulting in complete Denial of Service.
6 views•7 min read
•about 3 hours ago•CVE-2026-107377
7.5CVE-2026-107377: Arbitrary File Write and Overwrite via Protobuf Weak Import Path Traversal in datamodel-code-generator
A path traversal vulnerability in datamodel-code-generator allows remote attackers to write or overwrite arbitrary files on the local host filesystem via a manipulated Protobuf schema containing malicious weak import paths.
9 views•5 min read
•about 4 hours ago•CVE-2026-61431
6.8CVE-2026-61431: Arbitrary Local File Read and Path Traversal in PraisonAI ContextGatherer
PraisonAI is vulnerable to an arbitrary local file read vulnerability prior to version 4.6.78. The flaw is in the ContextGatherer component, where validation checks are executed only after files are parsed and appended to the context bundle, bypassing security constraints.
8 views•6 min read
•about 5 hours ago•CVE-2026-107212
7.5CVE-2026-107212: CPU Exhaustion Denial of Service via Look-Ahead Row Parsing in Excelize
An algorithmic complexity vulnerability (CWE-770) in the Excelize library allows remote attackers to cause resource exhaustion (100% CPU usage) via a crafted Microsoft Excel spreadsheet. This occurs because the look-ahead row index parsing in Rows.Columns() fails to enforce upper boundary limits, enabling an out-of-bounds row index to trigger an infinite seek loop inside the Rows iterator.
14 views•6 min read
•about 6 hours ago•CVE-2026-105647
4.0CVE-2026-105647: Server-Side Request Forgery via Favicon Probing in Ghost CMS
An unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Ghost CMS from version 6.54.1 to 6.65.0. The vulnerability stems from a validation bypass in the favicon resolution logic within the bookmark-fetching subsystem, which allows remote, unauthenticated attackers to trigger arbitrary HTTP requests to the local host and internal networks. This bypass circumvents the custom DNS-level IP blocklist controls configured globally in the application.
8 views•8 min read
•about 7 hours ago•CVE-2026-106450
5.3CVE-2026-106450: Denial of Service via Eager Resource Allocation in lz4-java LZ4FrameInputStream
A resource allocation vulnerability (CWE-770) in lz4-java before version 1.11.4 allows an unauthenticated remote attacker to trigger CPU exhaustion and high garbage collection overhead by streaming empty concatenated LZ4 frames.
12 views•8 min read
•about 8 hours ago•CVE-2026-106449
3.7CVE-2026-106449: Stack Overflow via Uncontrolled Recursion in yawkat lz4-java
A Denial of Service (DoS) vulnerability exists in the yawkat fork of lz4-java prior to version 1.11.4. Under specific non-default configurations (stopOnEmptyBlock = false), parsing crafted streams with a large sequence of contiguous empty LZ4 blocks triggers uncontrolled recursion inside the LZ4BlockInputStream.refill() method, causing stack exhaustion and thread termination.
8 views•6 min read
•about 9 hours ago•CVE-2026-76485
9.8CVE-2026-76485: Remote Code Execution in Cisco NX-OS VXLAN OAM (NGOAM)
CVE-2026-76485 is a critical stack-based buffer overflow vulnerability in the VXLAN OAM (NGOAM) parsing component of Cisco NX-OS Software. The flaw enables an unauthenticated, remote attacker to execute arbitrary code with root privileges or trigger a denial of service on affected Nexus switches. This vulnerability is triggered through crafted packets sent to an IP interface. No workarounds are currently available to mitigate the vulnerability while preserving the NGOAM functionality. Cisco has published software patches to address this flaw.
13 views•6 min read
•about 9 hours ago•CVE-2026-106451
7.3CVE-2026-106451: Local Privilege Escalation via JNI Extraction TOCTOU in lz4-java
A local privilege escalation and code execution vulnerability exists in the yawkat fork of lz4-java when extracting its bundled JNI shared library into the system temporary directory. Predictable path derivation and lack of exclusive file creation flags allow a local attacker to hijack library loading via a race condition.
8 views•6 min read
•about 10 hours ago•CVE-2026-105698
5.4CVE-2026-105698: Missing Authorization in Deprecated Chat Vertices Endpoints in Langflow
A missing authorization vulnerability in Langflow versions 1.0.0 through 1.10.0 allows authenticated users (and unauthenticated users in versions prior to 1.7.2) to access private workflow structures and execute graph components by targeting deprecated API endpoints.
8 views•8 min read