{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-23T19:17:25.278Z", "lastRun": "2026-10-23T19:01:02.861Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "pip" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2026-96639", "url": "https://cveboard.org/i/cve-2026-96639", "urlPt": "https://cveboard.org/pt/i/cve-2026-96639", "json": "https://cveboard.org/i/cve-2026-96639.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Pillow multi-frame loaders can reuse stale native image storage after mode transitions", "summary": "Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame.", "titlePt": "Carregadores multi-frame do Pillow podem reutilizar armazenamento nativo de imagem obsoleto após transições de modo.", "summaryPt": "Carregadores de imagens multi-frame do Pillow podem reter o armazenamento nativo do ImagingCore alocado para um frame enquanto alteram o modo e os azulejos do decodificador da imagem do lado do Python para um frame posterior.", "affected": [ { "vendor": "python-pillow", "product": "Pillow", "defaultStatus": "unknown", "versions": [ { "version": ">= 11.0.0, < 13.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-125", "name": "Out-of-bounds Read" }, { "id": "CWE-787", "name": "Out-of-bounds Write" } ], "ssvc": null, "fix": "listed", "tags": [ "python-pillow", "pip" ], "cves": [ "CVE-2026-96639" ], "ghsa": "GHSA-v9pv-5gc8-w2m6", "cvss": { "score": 9.8, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00565, "percentile": 0.46227, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "Pillow", "vulnerable": ">= 11.0.0, < 13.0.0", "fixed": "13.0.0", "advisory": "GHSA-v9pv-5gc8-w2m6" } ], "vendor": "python-pillow", "product": "Pillow", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-v9pv-5gc8-w2m6" } ], "publishedAt": "2026-10-22T16:00:15.000Z", "updatedAt": "2026-10-22T16:00:15.000Z" }, { "id": "cve-2026-112393", "url": "https://cveboard.org/i/cve-2026-112393", "urlPt": "https://cveboard.org/pt/i/cve-2026-112393", "json": "https://cveboard.org/i/cve-2026-112393.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO", "summary": "Pillow can write attacker-chosen data past the end of a heap buffer when it saves a TIFF image to an in-memory destination such as io.BytesIO rather than to a file. The same code also copies leftover heap memory from the process into the saved file. Anyone who can supply an image to a service that opens it and re-saves it as TIFF this way can trigger this with default settings.", "titlePt": "Pillow: estouro de buffer de heap em _tiffWriteProc ao salvar TIFF em BytesIO", "summaryPt": "Pillow pode escrever dados escolhidos pelo atacante além do final de um buffer de heap quando salva uma imagem TIFF em um destino de memória, como io.BytesIO, em vez de em um arquivo. O mesmo código também copia memória de heap restante do processo para o arquivo salvo. Qualquer pessoa que possa fornecer uma imagem a um serviço que a abre e a re-salva como TIFF dessa maneira pode acionar isso com as configurações padrão.", "affected": [ { "vendor": "python-pillow", "product": "Pillow", "defaultStatus": "unknown", "versions": [ { "version": ">= 2.0.0, < 13.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf", "tag": "exploit" } ], "cwes": [ { "id": "CWE-122", "name": "Heap-based Buffer Overflow" } ], "ssvc": { "exploitation": "poc", "automatable": "no", "impact": "total", "at": "2026-10-19T21:17:12.786Z" }, "fix": "listed", "tags": [ "python-pillow", "pip" ], "cves": [ "CVE-2026-112393" ], "ghsa": "GHSA-332p-7hrc-92wf", "cvss": { "score": 9.2, "version": "4.0", "by": "GitHub" }, "epss": { "percentage": 0.00528, "percentile": 0.43894, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "Pillow", "vulnerable": ">= 2.0.0, < 13.0.0", "fixed": "13.0.0", "advisory": "GHSA-332p-7hrc-92wf" } ], "vendor": "python-pillow", "product": "Pillow", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-332p-7hrc-92wf" } ], "publishedAt": "2026-10-21T21:28:09.000Z", "updatedAt": "2026-10-21T21:28:09.000Z" }, { "id": "cve-2026-112900", "url": "https://cveboard.org/i/cve-2026-112900", "urlPt": "https://cveboard.org/pt/i/cve-2026-112900", "json": "https://cveboard.org/i/cve-2026-112900.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Pillow: Argument Injection in Ghostscript call, potentially leading into RCE", "summary": "PIL.EpsImagePlugin.Ghostscript() builds the Ghostscript command line using the input file path (fp.name) without sanitization, placing it at -f . A filename beginning with - is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default invocation (with -dSAFER enabled).", "titlePt": "Pillow: Injeção de Argumento na chamada do Ghostscript, potencialmente levando a execução remota de código", "summaryPt": "PIL.EpsImagePlugin.Ghostscript() constrói a linha de comando do Ghostscript usando o caminho do arquivo de entrada (fp.name) sem sanitização, colocando-o em -f . Um nome de arquivo começando com - é interpretado pelo Ghostscript como uma opção, permitindo a injeção de argumentos na linha de comando; encadeável para execução remota de código (veja Impacto). Reproduz com a invocação padrão do Pillow (com -dSAFER habilitado).", "affected": [ { "vendor": "python-pillow", "product": "Pillow", "defaultStatus": "unknown", "versions": [ { "version": ">= 2.6.0, < 13.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, { "id": "CWE-88", "name": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-20T14:43:22.235Z" }, "fix": "listed", "tags": [ "python-pillow", "pip" ], "cves": [ "CVE-2026-112900" ], "ghsa": "GHSA-w889-685w-c8fh", "cvss": { "score": 9.2, "version": "4.0", "by": "GitHub" }, "epss": { "percentage": 0.00431, "percentile": 0.36366, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "Pillow", "vulnerable": ">= 2.6.0, < 13.0.0", "fixed": "13.0.0", "advisory": "GHSA-w889-685w-c8fh" } ], "vendor": "python-pillow", "product": "Pillow", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-w889-685w-c8fh" } ], "publishedAt": "2026-10-21T19:58:44.000Z", "updatedAt": "2026-10-21T19:58:44.000Z" }, { "id": "cve-2026-112403", "url": "https://cveboard.org/i/cve-2026-112403", "urlPt": "https://cveboard.org/pt/i/cve-2026-112403", "json": "https://cveboard.org/i/cve-2026-112403.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Pillow: Heap buffer overflow in ImagingJpegDecode", "summary": "JpegImageFile.draft() — which Image.thumbnail() calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks self._size and the tile extents to match, so _setimage() allocates a single-row decode buffer of ceil(W/s) samples. ImagingJpegDecode() sets cinfo.scale_num/scale_denom, calls jpeg_start_decompress(), and then reads scanlines into that buffer without ever comparing cinfo.", "titlePt": "Pillow: transbordamento de buffer na heap em ImagingJpegDecode", "summaryPt": "JpegImageFile.draft() — que Image.thumbnail() chama automaticamente — solicita saída JPEG escalonada em 1/2, 1/4 ou 1/8 e reduz self._size e os limites do tile para corresponder, então _setimage() aloca um buffer de decodificação de linha única de ceil(W/s) amostras. ImagingJpegDecode() define cinfo.scale_num/scale_denom, chama jpeg_start_decompress(), e depois lê linhas de varredura para esse buffer sem nunca comparar cinfo.", "affected": [ { "vendor": "python-pillow", "product": "Pillow", "defaultStatus": "unknown", "versions": [ { "version": "< 13.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8g5g-8vmr-9782", "tag": "exploit" } ], "cwes": [ { "id": "CWE-122", "name": "Heap-based Buffer Overflow" } ], "ssvc": { "exploitation": "poc", "automatable": "no", "impact": "total", "at": "2026-10-22T21:08:31.338Z" }, "fix": "listed", "tags": [ "python-pillow", "pip" ], "cves": [ "CVE-2026-112403" ], "ghsa": "GHSA-8g5g-8vmr-9782", "cvss": { "score": 9.2, "version": "4.0", "by": "GitHub" }, "epss": { "percentage": 0.00321, "percentile": 0.23908, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "Pillow", "vulnerable": "<= 12.3.0", "fixed": "13.0.0", "advisory": "GHSA-8g5g-8vmr-9782" } ], "vendor": "python-pillow", "product": "Pillow", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-8g5g-8vmr-9782" } ], "publishedAt": "2026-10-20T20:40:07.000Z", "updatedAt": "2026-10-20T20:40:07.000Z" }, { "id": "ghsa-hq85-5cpj-mr62", "url": "https://cveboard.org/i/ghsa-hq85-5cpj-mr62", "urlPt": "https://cveboard.org/pt/i/ghsa-hq85-5cpj-mr62", "json": "https://cveboard.org/i/ghsa-hq85-5cpj-mr62.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised", "summary": "By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them.", "titlePt": "O repositório de CA embutido do uv confia em uma raiz emSign cujas chaves de CA intermediária estão comprometidas", "summaryPt": "Por padrão, o uv verifica conexões TLS contra uma cópia vendida do pacote webpki-root-certs. Versões anteriores à 0.13.4 incluem a raiz emSign ECC Root CA - G3. Oito certificados de CA intermediária da eMudhra que encadeiam até essa raiz têm chaves privadas comprometidas, e a CA os revogou.", "affected": [], "omitted": 0, "references": [], "cwes": [], "ssvc": null, "fix": "listed", "tags": [ "pip" ], "cves": [], "ghsa": "GHSA-hq85-5cpj-mr62", "cvss": { "score": 9.1, "version": "4.0", "by": "GitHub" }, "epss": null, "packages": [ { "ecosystem": "pip", "name": "uv", "vulnerable": "< 0.13.4", "fixed": "0.13.4", "advisory": "GHSA-hq85-5cpj-mr62" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-hq85-5cpj-mr62" } ], "publishedAt": "2026-10-20T19:37:52.000Z", "updatedAt": "2026-10-20T19:37:52.000Z" }, { "id": "ghsa-6q48-6c7w-9gw2", "url": "https://cveboard.org/i/ghsa-6q48-6c7w-9gw2", "urlPt": "https://cveboard.org/pt/i/ghsa-6q48-6c7w-9gw2", "json": "https://cveboard.org/i/ghsa-6q48-6c7w-9gw2.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "certifi bundles emSign root CAs with compromised intermediate CA keys", "summary": "Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them.", "titlePt": "certifi inclui CAs raiz emSign com chaves de CA intermediária comprometidas", "summaryPt": "Versões do certifi anteriores à 2026.10.18 incluem o certificado raiz emSign ECC Root CA - G3 em seu repositório de CAs embutido. Oito certificados de CA intermediária eMudhra que se encadeiam a esta raiz têm chaves privadas comprometidas e a CA os revogou.", "affected": [], "omitted": 0, "references": [], "cwes": [], "ssvc": null, "fix": "listed", "tags": [ "pip" ], "cves": [], "ghsa": "GHSA-6q48-6c7w-9gw2", "cvss": { "score": 9.1, "version": "4.0", "by": "GitHub" }, "epss": null, "packages": [ { "ecosystem": "pip", "name": "certifi", "vulnerable": ">= 2019.03.09, < 2026.10.19", "fixed": "2026.10.19", "advisory": "GHSA-6q48-6c7w-9gw2" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2" } ], "publishedAt": "2026-10-20T19:35:05.000Z", "updatedAt": "2026-10-20T19:35:05.000Z" }, { "id": "cve-2026-111057", "url": "https://cveboard.org/i/cve-2026-111057", "urlPt": "https://cveboard.org/pt/i/cve-2026-111057", "json": "https://cveboard.org/i/cve-2026-111057.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass", "summary": "A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury.", "titlePt": "Mercury: execução remota de código não autenticada em /api/terminals - contorno de controle de acesso", "summaryPt": "Uma vírgula faltante na lista BLOCKED_PATTERNS do arquivo mercury_app/block_handler.py faz com que a lista de bloqueios falhe ao cobrir o endpoint /api/terminals. Como resultado, qualquer atacante não autenticado pode iniciar um shell interativo completo no nível do sistema operacional no host que executa o Mercury.", "affected": [ { "vendor": "mljar", "product": "mercury", "defaultStatus": "unknown", "versions": [ { "version": ">= 3.0.0, < 3.2.4", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-185", "name": "Incorrect Regular Expression" }, { "id": "CWE-284", "name": "Improper Access Control" } ], "ssvc": null, "fix": "listed", "tags": [ "mljar", "pip" ], "cves": [ "CVE-2026-111057" ], "ghsa": "GHSA-f8c7-rwf9-fmgm", "cvss": { "score": 10, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00443, "percentile": 0.37507, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "mercury", "vulnerable": ">= 3.0.0, <= 3.2.3", "fixed": "3.2.4", "advisory": "GHSA-f8c7-rwf9-fmgm" } ], "vendor": "mljar", "product": "mercury", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-f8c7-rwf9-fmgm" } ], "publishedAt": "2026-10-19T17:00:54.000Z", "updatedAt": "2026-10-19T17:00:54.000Z" }, { "id": "cve-2026-111058", "url": "https://cveboard.org/i/cve-2026-111058", "urlPt": "https://cveboard.org/pt/i/cve-2026-111058", "json": "https://cveboard.org/i/cve-2026-111058.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Mercury: Unauthenticated Remote Code Execution via /api/kernels", "summary": "Mercury runs a JupyterLab server with anonymous access by default (mercury_app/main.py sets --IdentityProvider.token='' when no --token/MERCURY_TOKEN is given; when tokenless it also sets --ServerApp.disable_check_xsrf=True). It relies on a blocklist (mercury_app/block_handler.py BLOCKED_PATTERNS: /lab, /api/terminals, /api/shutdown, /files) to keep anonymous users off dangerous Jupyter endpoints.", "titlePt": "Mercury: execução remota de código não autenticada via /api/kernels", "summaryPt": "Mercury executa um servidor JupyterLab com acesso anônimo por padrão (mercury_app/main.py define --IdentityProvider.token='' quando nenhum --token/MERCURY_TOKEN é fornecido; quando sem token, também define --ServerApp.disable_check_xsrf=True). Ele depende de uma lista de bloqueio (mercury_app/block_handler.py BLOCKED_PATTERNS: /lab, /api/terminals, /api/shutdown, /files) para manter usuários anônimos fora de endpoints perigosos do Jupyter.", "affected": [ { "vendor": "mljar", "product": "mercury", "defaultStatus": "unknown", "versions": [ { "version": "< 3.2.6", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-862", "name": "Missing Authorization" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-19T17:05:16.440Z" }, "fix": "listed", "tags": [ "mljar", "pip" ], "cves": [ "CVE-2026-111058" ], "ghsa": "GHSA-rv4m-xm3f-3ccq", "cvss": { "score": 9.8, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00437, "percentile": 0.37005, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "mercury", "vulnerable": "<= 3.2.5", "fixed": "3.2.6", "advisory": "GHSA-rv4m-xm3f-3ccq" } ], "vendor": "mljar", "product": "mercury", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-rv4m-xm3f-3ccq" } ], "publishedAt": "2026-10-19T16:49:08.000Z", "updatedAt": "2026-10-19T16:49:08.000Z" }, { "id": "cve-2026-105192", "url": "https://cveboard.org/i/cve-2026-105192", "urlPt": "https://cveboard.org/pt/i/cve-2026-105192", "json": "https://cveboard.org/i/cve-2026-105192.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport", "summary": "LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport", "titlePt": "LMCache: execução remota de código via deserialização insegura no transporte em modo multiprocesso", "summaryPt": "LMCache é vulnerável à execução remota de código não autenticada via deserialização Pickle no transporte ZMQ Multiprocesso", "affected": [ { "vendor": "LMCache", "product": "LMCache", "defaultStatus": "unaffected", "versions": [ { "version": "0.3.9", "status": "affected", "lessThan": null, "lessThanOrEqual": "*" } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, { "id": "CWE-306", "name": "Missing Authentication for Critical Function" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-07T17:47:55.401Z" }, "fix": "listed", "tags": [ "lmcache", "pip" ], "cves": [ "CVE-2026-105192" ], "ghsa": "GHSA-w5f2-9q9c-ff4h", "cvss": { "score": 9.8, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00482, "percentile": 0.40638, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "lmcache", "vulnerable": ">= 0.3.9, < 0.5.6", "fixed": "0.5.6", "advisory": "GHSA-w5f2-9q9c-ff4h" } ], "vendor": "LMCache", "product": "LMCache", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-w5f2-9q9c-ff4h" } ], "publishedAt": "2026-10-16T20:08:44.000Z", "updatedAt": "2026-10-16T20:08:44.000Z" }, { "id": "cve-2026-96620", "url": "https://cveboard.org/i/cve-2026-96620", "urlPt": "https://cveboard.org/pt/i/cve-2026-96620", "json": "https://cveboard.org/i/cve-2026-96620.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution", "summary": "The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag. An attacker who controlled the resume value could inject an --mcp-config flag defining a stdio MCP server, resulting in arbitrary command execution at CLI startup that bypassed the SDK's permission controls.", "titlePt": "Claude Agent SDK: Injeção de argumento via opção resume permite execução arbitrária de comandos", "summaryPt": "O SDK do Claude Agent para Python passou a opção resume para o CLI do Claude sem validação, permitindo que um valor iniciado com - fosse interpretado como uma flag CLI separada. Um atacante que controlasse o valor do resume poderia injetar uma flag --mcp-config definindo um servidor MCP stdio, resultando na execução arbitrária de comandos no início do CLI que contornava os controles de permissão do SDK.", "affected": [ { "vendor": "anthropics", "product": "claude-agent-sdk-python", "defaultStatus": "unknown", "versions": [ { "version": "< 0.2.121", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-20", "name": "Improper Input Validation" }, { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, { "id": "CWE-88", "name": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-21T21:28:15.538Z" }, "fix": "listed", "tags": [ "anthropics", "pip" ], "cves": [ "CVE-2026-96620" ], "ghsa": "GHSA-h4mw-j7qp-8mwm", "cvss": { "score": 9.2, "version": "4.0", "by": "GitHub" }, "epss": { "percentage": 0.00578, "percentile": 0.46871, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "claude-agent-sdk", "vulnerable": "< 0.2.121", "fixed": "0.2.121", "advisory": "GHSA-h4mw-j7qp-8mwm" } ], "vendor": "anthropics", "product": "claude-agent-sdk-python", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-h4mw-j7qp-8mwm" } ], "publishedAt": "2026-10-16T19:44:37.000Z", "updatedAt": "2026-10-16T19:44:37.000Z" }, { "id": "cve-2026-61445", "url": "https://cveboard.org/i/cve-2026-61445", "urlPt": "https://cveboard.org/pt/i/cve-2026-61445", "json": "https://cveboard.org/i/cve-2026-61445.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls", "summary": "The AICoder UI component exposes write_to_file and execute_command tools to the LLM with no path validation and no command sanitization. An attacker can achieve arbitrary file write to any location on the filesystem (including /root/.ssh/authorized_keys, /etc/crontab) and arbitrary command execution through prompt injection in the chat interface. Docker containers run as root, maximizing impact.", "titlePt": "PraisonAI: escrita arbitrária de arquivos e execução de comandos no AICoder via chamadas de ferramentas LLM", "summaryPt": "O componente de interface do usuário AICoder expõe as ferramentas write_to_file e execute_command para o LLM sem validação de caminho e sem sanitização de comando. Um atacante pode realizar escrita arbitrária de arquivos em qualquer localização no sistema de arquivos (incluindo /root/.ssh/authorized_keys, /etc/crontab) e execução arbitrária de comandos através de injeção de prompt na interface de chat. Contêineres Docker são executados como root, maximizando o impacto.", "affected": [ { "vendor": "MervinPraison", "product": "PraisonAI", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": "4.6.78", "lessThanOrEqual": null }, { "version": "4.6.78", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "4.6.78" ] } ], "omitted": 0, "references": [ { "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9mp3-24cc-77mg", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" } ], "ssvc": { "exploitation": "poc", "automatable": "no", "impact": "total", "at": "2026-07-14T14:29:21.404Z" }, "fix": "listed", "tags": [ "mervinpraison", "pip" ], "cves": [ "CVE-2026-61445" ], "ghsa": "GHSA-9mp3-24cc-77mg", "cvss": { "score": 9.9, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00881, "percentile": 0.58757, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "praisonai", "vulnerable": "<= 4.6.77", "fixed": "4.6.78", "advisory": "GHSA-9mp3-24cc-77mg" } ], "vendor": "MervinPraison", "product": "PraisonAI", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-9mp3-24cc-77mg" } ], "publishedAt": "2026-10-08T22:00:40.000Z", "updatedAt": "2026-10-08T22:00:40.000Z" }, { "id": "cve-2026-61447", "url": "https://cveboard.org/i/cve-2026-61447", "urlPt": "https://cveboard.org/pt/i/cve-2026-61447", "json": "https://cveboard.org/i/cve-2026-61447.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets", "summary": "CodeAgent._execute_python() executes LLM-generated Python code in a subprocess with the complete parent-process environment (os.environ.copy()), zero AST validation, zero import restrictions, and no sandbox enforcement — even when CodeConfig(sandbox=True) is explicitly set.", "titlePt": "PraisonAI: CodeAgent Executa Código Gerado por LLM Sem Sandboxing e Vaza Todos os Segredos do Ambiente", "summaryPt": "CodeAgent._execute_python() executa código Python gerado por LLM em um subprocesso com o ambiente completo do processo pai (os.environ.copy()), sem validação AST, sem restrições de importação e sem aplicação de sandbox — mesmo quando CodeConfig(sandbox=True) é explicitamente definido.", "affected": [ { "vendor": "MervinPraison", "product": "PraisonAI", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": "1.6.78", "lessThanOrEqual": null }, { "version": "1.6.78", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "1.6.78" ] } ], "omitted": 0, "references": [ { "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2xv2-w8cq-5gxw", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')" } ], "ssvc": { "exploitation": "poc", "automatable": "yes", "impact": "total", "at": "2026-07-13T15:21:25.938Z" }, "fix": "listed", "tags": [ "mervinpraison", "pip" ], "cves": [ "CVE-2026-61447" ], "ghsa": "GHSA-2xv2-w8cq-5gxw", "cvss": { "score": 10, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.0249, "percentile": 0.84525, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "praisonaiagents", "vulnerable": "<= 1.6.77", "fixed": "1.6.78", "advisory": "GHSA-2xv2-w8cq-5gxw" } ], "vendor": "MervinPraison", "product": "PraisonAI", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-2xv2-w8cq-5gxw" } ], "publishedAt": "2026-10-08T16:44:01.000Z", "updatedAt": "2026-10-08T16:44:01.000Z" }, { "id": "cve-2026-105697", "url": "https://cveboard.org/i/cve-2026-105697", "urlPt": "https://cveboard.org/pt/i/cve-2026-105697", "json": "https://cveboard.org/i/cve-2026-105697.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration", "summary": "Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c \"exec {command} ...\".", "titlePt": "Langflow: Injeção de comando do sistema operacional (RCE) via comando arbitrário na configuração do servidor stdio MCP", "summaryPt": "Antes do Langflow 1.10.3, o transporte MCP stdio executava qualquer comando / argumentos que um usuário colocasse em uma configuração de servidor MCP, sem uma lista de permissões e (antes do 1.10.3) envolto em bash -c \"exec {command} ...\".", "affected": [ { "vendor": "langflow-ai", "product": "langflow", "defaultStatus": "unknown", "versions": [ { "version": ">= 1.1.2, < 1.10.3", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "langflow-ai", "product": "langflow-base", "defaultStatus": "unknown", "versions": [ { "version": ">= 0.1.2, < 0.10.3", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "langflow-ai", "product": "lfx", "defaultStatus": "unknown", "versions": [ { "version": "< 1.10.3", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-10-06T14:36:02.678Z" }, "fix": "listed", "tags": [ "langflow-ai", "pip" ], "cves": [ "CVE-2026-105697" ], "ghsa": "GHSA-w794-rj3p-xv45", "cvss": { "score": 9.9, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00471, "percentile": 0.39839, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "langflow", "vulnerable": ">= 1.1.2, < 1.10.3", "fixed": "1.10.3", "advisory": "GHSA-w794-rj3p-xv45" }, { "ecosystem": "pip", "name": "langflow-base", "vulnerable": ">= 0.1.2, < 0.10.3", "fixed": "0.10.3", "advisory": "GHSA-w794-rj3p-xv45" }, { "ecosystem": "pip", "name": "lfx", "vulnerable": "< 1.10.3", "fixed": "1.10.3", "advisory": "GHSA-w794-rj3p-xv45" } ], "vendor": "langflow-ai", "product": "langflow", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-w794-rj3p-xv45" } ], "publishedAt": "2026-10-07T20:36:35.000Z", "updatedAt": "2026-10-07T20:36:35.000Z" }, { "id": "cve-2026-62176", "url": "https://cveboard.org/i/cve-2026-62176", "urlPt": "https://cveboard.org/pt/i/cve-2026-62176", "json": "https://cveboard.org/i/cve-2026-62176.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation", "summary": "The deploy/api.py module generates Python server code by directly interpolating the agents_file parameter into an f-string that is then written to a file and executed via subprocess.Popen(). An attacker who controls the agents_file value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code.", "titlePt": "PraisonAI: Injeção de código via interpolação de f-string na geração do servidor da API de deploy", "summaryPt": "O módulo deploy/api.py gera código de servidor Python interpolando diretamente o parâmetro agents_file em uma f-string que é então escrita em um arquivo e executada via subprocess.Popen(). Um atacante que controla o valor de agents_file (via argumento CLI, configuração ou API upstream) pode injetar código Python arbitrário.", "affected": [ { "vendor": "MervinPraison", "product": "PraisonAI", "defaultStatus": "unknown", "versions": [ { "version": "< 4.6.78", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g6j7-pffp-8whg", "tag": "exploit" } ], "cwes": [ { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')" } ], "ssvc": { "exploitation": "poc", "automatable": "no", "impact": "total", "at": "2026-10-07T16:57:09.228Z" }, "fix": "listed", "tags": [ "mervinpraison", "pip" ], "cves": [ "CVE-2026-62176" ], "ghsa": "GHSA-g6j7-pffp-8whg", "cvss": { "score": 9.1, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.0046, "percentile": 0.38975, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "PraisonAI", "vulnerable": "<= 4.6.77", "fixed": "4.6.78", "advisory": "GHSA-g6j7-pffp-8whg" } ], "vendor": "MervinPraison", "product": "PraisonAI", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-g6j7-pffp-8whg" } ], "publishedAt": "2026-10-07T16:05:53.000Z", "updatedAt": "2026-10-07T16:05:53.000Z" }, { "id": "cve-2026-10561", "url": "https://cveboard.org/i/cve-2026-10561", "urlPt": "https://cveboard.org/pt/i/cve-2026-10561", "json": "https://cveboard.org/i/cve-2026-10561.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation", "summary": "Langflow's built-in Python interpreter components — PythonREPLComponent (Python Interpreter) and the legacy PythonREPLToolComponent (Python REPL Tool) — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing.", "titlePt": "Langflow: PythonREPLComponent executa código Python não sandboxed, permitindo RCE e escalada de privilégios autenticados", "summaryPt": "Os componentes de interpretador Python integrados do Langflow — PythonREPLComponent (Interpretador Python) e o legado PythonREPLToolComponent (Ferramenta Python REPL) — executaram código Python arbitrário fornecido pelo usuário ou modelo dentro dos fluxos sem sandboxing eficaz.", "affected": [ { "vendor": "IBM", "product": "Langflow OSS", "defaultStatus": "unknown", "versions": [ { "version": "1.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "1.9.3" } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://www.ibm.com/support/pages/node/7277242", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-06-23T03:55:46.829Z" }, "fix": "listed", "tags": [ "ibm", "pip" ], "cves": [ "CVE-2026-10561" ], "ghsa": "GHSA-8qpj-27x8-pwpq", "cvss": { "score": 9.9, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.0082, "percentile": 0.56861, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "langflow", "vulnerable": "< 1.10.1", "fixed": "1.10.1", "advisory": "GHSA-8qpj-27x8-pwpq" } ], "vendor": "IBM", "product": "Langflow OSS", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-8qpj-27x8-pwpq" } ], "publishedAt": "2026-10-06T13:38:28.000Z", "updatedAt": "2026-10-06T13:38:28.000Z" }, { "id": "cve-2026-9205", "url": "https://cveboard.org/i/cve-2026-9205", "urlPt": "https://cveboard.org/pt/i/cve-2026-9205", "json": "https://cveboard.org/i/cve-2026-9205.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Langflow: Weak Fernet Key via random.seed()", "summary": "Langflow uses Python's random module (Mersenne Twister, a non-cryptographic PRNG) seeded with the SECRET_KEY to derive the Fernet encryption key for all stored user credentials (API keys, LLM provider secrets, database passwords).", "titlePt": "Langflow: Chave Fernet fraca via random.seed()", "summaryPt": "Langflow utiliza o módulo random do Python (Mersenne Twister, um PRNG não criptográfico) inicializado com o SECRET_KEY para derivar a chave de criptografia Fernet para todas as credenciais de usuário armazenadas (chaves de API, segredos de provedores de LLM, senhas de banco de dados).", "affected": [ { "vendor": "IBM", "product": "Langflow OSS", "defaultStatus": "unknown", "versions": [ { "version": "1.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "1.10.3" } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://www.ibm.com/support/pages/node/7282648", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-338", "name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-08-06T03:55:52.571Z" }, "fix": "listed", "tags": [ "ibm", "pip" ], "cves": [ "CVE-2026-9205" ], "ghsa": "GHSA-jxw3-mjmx-3pqm", "cvss": { "score": 9.1, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00302, "percentile": 0.21736, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "langflow", "vulnerable": "<= 1.10.0", "fixed": "1.10.1", "advisory": "GHSA-jxw3-mjmx-3pqm" } ], "vendor": "IBM", "product": "Langflow OSS", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-jxw3-mjmx-3pqm" } ], "publishedAt": "2026-10-05T22:31:35.000Z", "updatedAt": "2026-10-05T22:31:35.000Z" }, { "id": "cve-2026-8505", "url": "https://cveboard.org/i/cve-2026-8505", "urlPt": "https://cveboard.org/pt/i/cve-2026-8505", "json": "https://cveboard.org/i/cve-2026-8505.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass", "summary": "A vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False.", "titlePt": "Langflow: Execução de Fluxo Não Autenticada via Contorno de Autenticação de Webhook", "summaryPt": "Uma vulnerabilidade na lógica de autenticação de webhook do Langflow permite que usuários não autenticados acionem a execução de qualquer fluxo. O sistema ignora incorretamente a validação da chave de API quando a configuração WEBHOOK_AUTH_ENABLE está definida como False.", "affected": [ { "vendor": "IBM", "product": "Langflow OSS", "defaultStatus": "unknown", "versions": [ { "version": "1.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "1.10.0" } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://www.ibm.com/support/pages/node/7278921", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-07-22T00:00:00.000Z" }, "fix": "listed", "tags": [ "ibm", "pip" ], "cves": [ "CVE-2026-8505" ], "ghsa": "GHSA-cf6m-vc3m-7cgm", "cvss": { "score": 9.8, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00719, "percentile": 0.5339, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "langflow", "vulnerable": ">= 1.7.0, <= 1.9.0", "fixed": "1.9.1", "advisory": "GHSA-cf6m-vc3m-7cgm" } ], "vendor": "IBM", "product": "Langflow OSS", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-cf6m-vc3m-7cgm" } ], "publishedAt": "2026-10-05T22:31:22.000Z", "updatedAt": "2026-10-05T22:31:22.000Z" }, { "id": "ghsa-v2f8-6655-7grj", "url": "https://cveboard.org/i/ghsa-v2f8-6655-7grj", "urlPt": "https://cveboard.org/pt/i/ghsa-v2f8-6655-7grj", "json": "https://cveboard.org/i/ghsa-v2f8-6655-7grj.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain", "summary": "5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persists even with API_AUTH_KEY set (F2), unauthenticated file write of .py/.sh/.yaml to a server-returned path (F3), default-permissive CORS that combines with a loopback-only check to grant any browser page on whitelisted localhost ports credentialed cross-origin access (F-A4), and partial…", "titlePt": "Pontos de extremidade do Vibe-Trading FastAPI permitem acesso não autenticado, upload de arquivos e uma cadeia de execução remota de código", "summaryPt": "5 achados — exposição completa da API sem autenticação (F1, principal Crítica), lacuna de autorização do lado de leitura que persiste mesmo com API_AUTH_KEY definido (F2), escrita de arquivo sem autenticação de .py/.sh/.yaml para um caminho retornado pelo servidor (F3), CORS permissivo padrão que se combina com uma verificação de loopback apenas para conceder acesso cross-origin com credenciais a qualquer página do navegador em portas localhost whitelisted (F-A4), e parcial…", "affected": [], "omitted": 0, "references": [], "cwes": [], "ssvc": null, "fix": "listed", "tags": [ "pip" ], "cves": [], "ghsa": "GHSA-v2f8-6655-7grj", "cvss": { "score": 10, "version": "3.1", "by": "GitHub" }, "epss": null, "packages": [ { "ecosystem": "pip", "name": "vibe-trading-ai", "vulnerable": ">= 0.1.0, < 0.1.7", "fixed": "0.1.7", "advisory": "GHSA-v2f8-6655-7grj" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-v2f8-6655-7grj" } ], "publishedAt": "2026-10-02T22:44:26.000Z", "updatedAt": "2026-10-02T22:44:26.000Z" }, { "id": "ghsa-jqmf-mx4f-hfr6", "url": "https://cveboard.org/i/ghsa-jqmf-mx4f-hfr6", "urlPt": "https://cveboard.org/pt/i/ghsa-jqmf-mx4f-hfr6", "json": "https://cveboard.org/i/ghsa-jqmf-mx4f-hfr6.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF", "summary": "5 findings — BashTool shell-injection sink (F6, the canonical RCE primitive), BackgroundRunTool async shell-injection sink (F7), backtest exec_module() runs top-level statements before the SignalEngine class check (F8 — independent RCE path that does not match BashTool signatures), read_url outbound HTTP forwarding without schema/host validation (F-B4 SSRF), and Jinja2 codegen with autoescape…", "titlePt": "Ferramentas chamáveis por LLM do Vibe-Trading permitem execução de comandos, injeção de código e SSRF", "summaryPt": "5 achados — sink de injeção de shell BashTool (F6, o primitivo RCE canônico), sink de injeção de shell async BackgroundRunTool (F7), exec_module() do backtest executa declarações de nível superior antes da verificação da classe SignalEngine (F8 — caminho RCE independente que não corresponde às assinaturas do BashTool), encaminhamento HTTP externo read_url sem validação de esquema/host (F-B4 SSRF) e geração de código Jinja2 com autoescape…", "affected": [], "omitted": 0, "references": [], "cwes": [], "ssvc": null, "fix": "listed", "tags": [ "pip" ], "cves": [], "ghsa": "GHSA-jqmf-mx4f-hfr6", "cvss": { "score": 10, "version": "3.1", "by": "GitHub" }, "epss": null, "packages": [ { "ecosystem": "pip", "name": "vibe-trading-ai", "vulnerable": ">= 0.1.0, < 0.1.7", "fixed": "0.1.7", "advisory": "GHSA-jqmf-mx4f-hfr6" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-jqmf-mx4f-hfr6" } ], "publishedAt": "2026-10-02T22:44:03.000Z", "updatedAt": "2026-10-02T22:44:03.000Z" }, { "id": "cve-2026-102268", "url": "https://cveboard.org/i/cve-2026-102268", "urlPt": "https://cveboard.org/pt/i/cve-2026-102268", "json": "https://cveboard.org/i/cve-2026-102268.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard", "summary": "Prerequisites (both conditions must hold; both are deployment properties, not attacker-controlled at request time):", "titlePt": "PyJWT: Bypass de detecção de PEM assimétrico: chaves públicas com espaços/quebras de linha mutadas ignoram o guardião de confusão HS/assimétrico", "summaryPt": "Pré-requisitos (ambas as condições devem ser atendidas; ambas são propriedades de implantação, não controladas pelo atacante no momento da solicitação):", "affected": [ { "vendor": "jpadilla", "product": "pyjwt", "defaultStatus": "unknown", "versions": [ { "version": "< 2.14.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9", "tag": "exploit" } ], "cwes": [ { "id": "CWE-347", "name": "Improper Verification of Cryptographic Signature" } ], "ssvc": { "exploitation": "poc", "automatable": "yes", "impact": "total", "at": "2026-09-29T13:59:05.202Z" }, "fix": "listed", "tags": [ "jpadilla", "pip" ], "cves": [ "CVE-2026-102268" ], "ghsa": "GHSA-ffc3-869f-jxw9", "cvss": { "score": 9.1, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00202, "percentile": 0.09632, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "PyJWT", "vulnerable": "<= 2.13.0", "fixed": "2.14.0", "advisory": "GHSA-ffc3-869f-jxw9" } ], "vendor": "jpadilla", "product": "pyjwt", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-ffc3-869f-jxw9" } ], "publishedAt": "2026-09-29T23:17:33.000Z", "updatedAt": "2026-09-29T23:17:33.000Z" }, { "id": "cve-2026-61732", "url": "https://cveboard.org/i/cve-2026-61732", "urlPt": "https://cveboard.org/pt/i/cve-2026-61732", "json": "https://cveboard.org/i/cve-2026-61732.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context", "summary": "Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint.", "titlePt": "Decepticon: falsificação de limite de função via literais de tokens especiais do ChatML na saída de web crawl composta no contexto do LLM", "summaryPt": "Decepticon envolve os resultados de web crawl — a saída da reconhecimento de agentes contra serviços-alvo — em mensagens LLM sem neutralizar literais de tokens especiais do ChatML. No modelo de implantação BYOK (Bring Your Own Key), os usuários configuram suas próprias credenciais LLM para qualquer endpoint compatível com OpenAI.", "affected": [ { "vendor": "BitterSecurity", "product": "Decepticon", "defaultStatus": "unknown", "versions": [ { "version": "< 1.1.17", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "BitterSecurity", "product": "decepticon-core", "defaultStatus": "unknown", "versions": [ { "version": "< 1.1.17", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "BitterSecurity", "product": "decepticon-sdk", "defaultStatus": "unknown", "versions": [ { "version": "< 1.1.17", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://github.com/BitterSecurity/Decepticon/security/advisories/GHSA-g5f9-3xfg-p9mf", "tag": "exploit" } ], "cwes": [ { "id": "CWE-74", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" } ], "ssvc": { "exploitation": "poc", "automatable": "yes", "impact": "total", "at": "2026-09-24T17:59:08.643Z" }, "fix": "listed", "tags": [ "bittersecurity", "pip" ], "cves": [ "CVE-2026-61732" ], "ghsa": "GHSA-g5f9-3xfg-p9mf", "cvss": { "score": 10, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.01221, "percentile": 0.68499, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "pip", "name": "decepticon-core", "vulnerable": "<= 1.1.16", "fixed": "1.1.17", "advisory": "GHSA-g5f9-3xfg-p9mf" }, { "ecosystem": "pip", "name": "decepticon", "vulnerable": "<= 1.1.16", "fixed": "1.1.17", "advisory": "GHSA-g5f9-3xfg-p9mf" }, { "ecosystem": "pip", "name": "decepticon-sdk", "vulnerable": "<= 1.1.16", "fixed": "1.1.17", "advisory": "GHSA-g5f9-3xfg-p9mf" } ], "vendor": "BitterSecurity", "product": "Decepticon", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-g5f9-3xfg-p9mf" } ], "publishedAt": "2026-09-24T19:17:49.000Z", "updatedAt": "2026-09-24T19:17:49.000Z" }, { "id": "cve-2026-57149", "url": "https://cveboard.org/i/cve-2026-57149", "urlPt": "https://cveboard.org/pt/i/cve-2026-57149", "json": "https://cveboard.org/i/cve-2026-57149.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection", "summary": "The Classic portlet (plone.app.portlets.portlets.classic) used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path() helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet could supply a crafted value that escapes simple path traversal and is evaluated as arbitrary code.", "titlePt": "plone.app.portlets Vulnerável à Execução Remota de Código via Injeção de TALES", "summaryPt": "O portlet Classic (plone.app.portlets.portlets.classic) usou os campos de template/macro fornecidos pelo usuário para construir uma expressão de caminho TALES que foi então avaliada pelo auxiliar path() do TAL. Como o valor foi interpretado como uma expressão TALES completa, um usuário capaz de adicionar ou editar um portlet Classic poderia fornecer um valor elaborado que escapa da simples travessia de caminho e é avaliado como código arbitrário.", "affected": [ { "vendor": "plone", "product": "plone.app.portlets", "defaultStatus": "unknown", "versions": [ { "version": ">= 7.0.0, < 7.0.2", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 6.0.0, < 6.0.4", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 5.0.0, < 5.0.8", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-95", "name": "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-09-22T19:13:42.273Z" }, "fix": "listed", "tags": [ "plone", "pip" ], "cves": [ "CVE-2026-57149" ], "ghsa": "GHSA-rr49-f9g6-c9r5", "cvss": { "score": 9.9, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00638, "percentile": 0.49511, "asOf": "2026-10-23", "by": "GitHub" }, "packages": [ { "ecosystem": "pip", "name": "plone.app.portlets", "vulnerable": ">= 7.0.0, <= 7.0.1", "fixed": "7.0.2", "advisory": "GHSA-rr49-f9g6-c9r5" }, { "ecosystem": "pip", "name": "plone.app.portlets", "vulnerable": ">= 6.0.0, <= 6.0.3", "fixed": "6.0.4", "advisory": "GHSA-rr49-f9g6-c9r5" }, { "ecosystem": "pip", "name": "plone.app.portlets", "vulnerable": ">= 5.0.0, <= 5.0.7", "fixed": "5.0.8", "advisory": "GHSA-rr49-f9g6-c9r5" } ], "vendor": "plone", "product": "plone.app.portlets", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-rr49-f9g6-c9r5" } ], "publishedAt": "2026-09-23T13:55:47.000Z", "updatedAt": "2026-09-23T13:55:47.000Z" } ], "tag": { "tag": "pip", "name": "PyPI", "kev": null } }