News & Sicurezza

CVE ID :CVE-2026-55528 Published : Aug. 25, 2026, 3:16 p.m. | 49 minutes ago Description :PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when authentication is configured. This issue is fixed in version 1.6.58. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-55530 Published : Aug. 25, 2026, 3:16 p.m. | 49 minutes ago Description :PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, ast_grep_rewrite lacks the @require_approval decorator used by sibling mutation tools. With dry_run=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected authorization gate. This issue is fixed in version 1.6.58. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-55529 Published : Aug. 25, 2026, 3:16 p.m. | 49 minutes ago Description :PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts request_origin.startswith(allowed), so the attacker-controlled localhost.evil.example HTTP origin matches the localhost allowlist. Without an API key, a malicious webpage can submit tools/call requests to the local MCP server and execute exposed tools. This issue is fixed in version 4.6.58. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-55527 Published : Aug. 25, 2026, 3:16 p.m. | 49 minutes ago Description :PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller supplying ../ or path separators can escape the memory directory and write JSON data to arbitrary process-writable locations. The fix sanitizes user_id before constructing self.user_path. This issue is fixed in version 1.6.58. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-55526 Published : Aug. 25, 2026, 3:16 p.m. | 49 minutes ago Description :PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_page fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permitting internal HTTP access. The fix uses socket.getaddrinfo and fails closed on DNS errors. This issue is fixed in version 1.6.58. Severity: 8.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This issue affects Software Repository Management: before 2fb4acee.

CVE ID :CVE-2026-16599 Published : Aug. 25, 2026, 3:16 p.m. | 49 minutes ago Description :GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation. This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Vulnerability in GNU wget software Vulnerability in GNU wget software CVE ID CVE-2026-16599 Publication date 25 August 2026 Vendor GNU Product wget Vulnerable versions All through 1.25.0 Vulnerability type (CWE) Unchecked input for loo ... Read more Published Date: Aug 25, 2026 (2 days, 20 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-16599

CISA adds TrueConf and Zimbra and Oracle WebLogic to KEV August 25, 2026CISA has added multiple vulnerabilities affecting TrueConf Server, Zimbra Collaboration Suite and Oracle HTTP Server/WebLogic Server Proxy Plug-in to its Known Exploited Vulnerabilities ... Read more Published Date: Aug 25, 2026 (2 days, 20 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-69836 CVE-2026-72530 CVE-2026-72529 CVE-2026-73570 CVE-2026-21962

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.

A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw Oasis Security has disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take unauthenticated control of the local Ollama instance serving an AI agent and plant hidden ... Read more Published Date: Aug 25, 2026 (2 days, 21 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-58231 CVE-2024-28224

CVE ID :CVE-2026-79623 Published : Aug. 25, 2026, 1:30 p.m. | 35 minutes ago Description :A security vulnerability has been detected in FishCodeTech Muteki up to 0.2.5. The affected element is an unknown function of the file .claude/settings.json of the component Default Local Worker Backend. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The issue was closed with the comment (translated from Chinese): "The project will be refactored and shut down." Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...