PraisonAI versions from 3.11.0 up to but not including 4.6.59 contain a missing authorization vulnerability in its Slack bot. The bot enforces user and channel restrictions in the normal Slack message event handler but fails to do so in the Slack app_mention event handler. This allows any Slack user who can mention the bot in a channel with the app installed to trigger configured agents despite restrictions, potentially leading to unauthorized actions. The issue is fixed in version 4.6.59.
PraisonAI versions from 3.8.1 up to but not including 4.6.59 contain a path traversal vulnerability in the Dynamic Context Discovery feature. This flaw allows unauthorized reading of arbitrary files on the host filesystem by manipulating artifact tool arguments. The vulnerability arises because the artifact tools do not verify that the supplied paths are within the configured artifact base directory or created by the configured store. This can expose sensitive files such as .env files, cloud credentials, SSH keys, and source code. The issue is fixed in version 4.6.59.
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.
PraisonAI versions from 4.5.2 up to but not including 4.6.59 contain a vulnerability in the Discord approval backend where any user able to post in the configured approval channel can approve a pending high-risk tool call by sending a message classified as approval (e.g., 'yes'). This occurs because the system does not verify that the approval message is a direct reply or otherwise bound to the approval request, allowing unthreaded channel cross-talk. The Slack and Telegram approval backends also lack explicit approver allowlist parameters, but the primary issue is with Discord. This vulnerability has been patched in version 4.6.59.
Vvveb CMS versions 1.0.8.6 and earlier contain a path traversal vulnerability in the backup controller's nextRestore() and nextBackup() functions. These functions accept a file parameter that is concatenated to the backup directory path without proper sanitization, allowing an authenticated administrator to read arbitrary files or write SQL dump content to arbitrary locations. This flaw contrasts with other related functions that correctly sanitize file names. The issue has been patched in a subsequent commit.
AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges.
Aider-AI's aider software up to version 0.86.2 contains an OS command injection vulnerability. This flaw allows attackers to execute arbitrary shell commands by committing a malicious .aider.conf.yml configuration file that is auto-loaded without user confirmation. The vulnerability arises because certain configuration values (notifications-command or editor) are executed via subprocess with shell=True, enabling command execution with the victim's privileges after model replies or editor use.
VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files access.
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.
CVE-2026-115722 is a vulnerability in the diegonehab rply library up to version 1.1.4 involving improper validation of array indices in the ply_read_header_property() function. This flaw allows crafted PLY files to trigger out-of-bounds accesses in ply_read_list_property(), potentially causing crashes during ASCII parsing or memory corruption during binary parsing.
Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on.
The OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected.
This issue affects req_llm: from 1.9.0 before 1.29.0.
CVE-2026-95620 is a use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support within the Qt Network module. This flaw allows a malicious or compromised HTTP/2 server to cause the client application to crash, impacting availability. The vulnerability affects Qt versions from 6.9.0 up to but not including 6.11.3. The CVSS 4.0 base score is 2.1, indicating a low severity level. There are no known exploits in the wild and no patch information is provided in the input data.
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.
A China-linked advanced persistent threat (APT) group known as Storm-0940 has been using the open source AI penetration testing tool Artex to automate attacks targeting ConnectWise customers. The campaign, active since at least 2021 and intensified since September 2026, involved password spraying, OAuth application abuse, and reconnaissance at machine speed. The attackers gained privileged access to multiple Microsoft 365 tenants by abusing compromised ConnectWise application credentials. ConnectWise suspended several cloud services in response. The threat actor established persistence by modifying application credentials, enabling continued access even after remediation efforts. Hundreds of organizations across multiple sectors were targeted, including aerospace, defense, financial services, and government. Microsoft and other security firms have documented the attack techniques and recommended monitoring service principal sign-ins and directory changes for suspicious activity.
This entry is a daily podcast update from the SANS Internet Storm Center dated October 23, 2026. It does not contain specific information about a security vulnerability, exploit, or threat. The content primarily serves as a news or informational update without technical details or actionable threat intelligence.
The securityheaders.com API is no longer accepting new API keys and is effectively deprecated. Users are advised to switch to an alternative API provided by https://httpsornot.com, which offers similar functionality for checking HTTP security headers with a rate limit of 120 requests per hour per IP without requiring an API key. The new API uses a different JSON response format and grading system. This change does not represent a security vulnerability but rather a service discontinuation and migration notice.
A critical SQL injection vulnerability (CVE-2026-114625) in Arista Networks' VeloCloud Orchestrator (VCO) allows remote attackers with authenticated access to escalate privileges to operator level and access internal functionality not intended for remote use. The flaw affects on-premises VCO versions prior to 5.2.3.18, 6.1.3.10, and 6.4.2.12. Arista has patched the vulnerability and already mitigated hosted deployments. Attackers have actively exploited this zero-day, and administrators are urged to update immediately and monitor for suspicious activity.
Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-typed argument. Every public function in Plug.Crypto validates argument types in a function-head guard. A failed guard makes the Erlang VM raise FunctionClauseError with the actual argument values in the top stack frame, so the secret key base, a derived key, or the value an API key is compared against lands in that frame. The library's rescue blocks and Plug.Crypto.prune_args_from_stacktrace/1 only reach exceptions raised inside a function body, so they never see a guard failure. Plug.Cowboy and Bandit write the frame to the error log and attach it as crash_reason Logger metadata, which error trackers forward.
Two entry points take request data. Plug.Crypto.verify/4 exposes the secret key base when the token is neither a binary nor nil, which Phoenix.Token.verify/4 reaches because it forwards the token unguarded. Plug.Crypto.secure_compare/2 exposes the other operand when one side is not a binary, as happens when a missing request header yields nil. Reading the leaked value needs separate access to the logs or the error tracker, so the request alone does not disclose the secret to the attacker.
This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1.
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.