ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets (not the default configuration).
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue.
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE name to load an arbitrary shared library from anywhere on the filesystem via path traversal. The library's initialization code executes immediately during loading, before Firebird validates the module, achieving code execution as the server's OS account. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
SiYuan versions 3.6.3 and below have a critical stored cross-site scripting (XSS) vulnerability due to insecure rendering of Mermaid diagrams with securityLevel set to "loose". This allows attacker-controlled javascript: URLs to be injected into the DOM. On desktop Electron builds with nodeIntegration enabled and contextIsolation disabled, this XSS can escalate to arbitrary code execution when a user interacts with a malicious Mermaid diagram. The issue is fixed in version 3.6.4.
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Versions prior to 2.1.1 contain an RCE vulnerability in the .github/workflows/regenerate-migrations.yml workflow. The workflow uses the pull_request_target trigger to run with full GITHUB_TOKEN write permissions, copies attacker-controlled files from untrusted pull requests into the trusted runner workspace via git show, and then executes python manage.py makemigrations, which imports Django model modules including attacker-controlled website/models.py at runtime. Any module-level Python code in the attacker's models.py is executed during import, enabling arbitrary code execution in the privileged CI environment with access to GITHUB_TOKEN and repository secrets. The attack is triggerable by any external contributor who can open a pull request, provided a maintainer applies the regenerate-migrations label, potentially leading to secret exfiltration, repository compromise, and supply chain attacks. A patch for this issue is expected to be released in version 2.1.1.
Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.
The Avada (Fusion) Builder plugin for WordPress up to version 3.15.1 contains a vulnerability that allows authenticated users with Subscriber-level access or higher to execute arbitrary WordPress action hooks. This occurs because the plugin's output_action_hook() function improperly accepts user input without authorization checks. Exploitation could lead to privilege escalation, file inclusion, denial of service, or other impacts depending on the available hooks. The vulnerability has a medium severity rating with a CVSS score of 5.4. No official patch or remediation guidance is currently confirmed.
The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value
from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary
execution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability.
It does not affect Airflow release - example_dags are not supposed to be enabled in production environment, however
users following the example could replicate the bad pattern. Documentation of Airflow 3.2.0 contains version of
the example with improved resiliance for that case.
Users who followed that pattern are advised to adjust their implementations accordingly.
OctoberCMS versions prior to 3.7.14 and 4.1.10 have a server-side information disclosure vulnerability in the INI settings parser. Attackers with Editor access can inject environment variable interpolation patterns into CMS page settings, causing sensitive environment variables such as database passwords and application keys to be exposed. This vulnerability is relevant only when cms.safe_mode is enabled. It has been fixed in versions 3.7.
Sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal.
Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS) allows an attacker to modify the server's configuration file, potentially leading to mass data exfiltration, malicious traffic interception, or disruption of testing services.
The The Germanized for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution via 'account_holder' parameter in all versions up to, and including, 3.20.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVE-2026-40288 is a critical OS command injection vulnerability in MervinPraison's PraisonAI multi-agent teams system. Versions prior to 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents improperly handle untrusted YAML workflow files, allowing arbitrary command and code execution without validation or sandboxing. This occurs because the workflow engine executes shell commands and Python scripts directly from YAML files, exposing the host system to full compromise if an attacker can supply or influence these files. The vulnerability is fixed in versions 4.5.139 and 1.
PraisonAI versions 4.5.138 and earlier are vulnerable to arbitrary code execution due to automatic, unsanitized import of a local tools.py file at startup. This allows an attacker with write access to the working directory to execute arbitrary Python code within the PraisonAI process and potentially compromise the host system and connected data. The vulnerability is fixed in version 4.5.139.
MaxKB versions 2.7.1 and below have a sandbox escape vulnerability in the ToolExecutor component. An authenticated user with workspace privileges can bypass the LD_PRELOAD-based sandbox by exploiting Python's ctypes to make direct kernel system calls. This allows arbitrary code execution, potentially leading to network exfiltration and container compromise. The vulnerability arises because the sandbox blocks mprotect but not pkey_mprotect, enabling executable memory allocation bypass. This issue is fixed in version 2.8.0.
CVE-2026-27675 is a vulnerability in SAP Landscape Transformation involving an RFC-exposed function module that allows a high privileged attacker to inject arbitrary ABAP code and operating system commands. The vulnerability impacts data integrity to a low degree, with no effect on confidentiality or availability. The CVSS score is low (2.0), reflecting the limited impact and the requirement for high privileges and user interaction. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-27674 is a code injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java) version WD-RUNTIME 7.50. An unauthenticated attacker can supply crafted input that is interpreted by the application, causing it to reference attacker-controlled content. If a victim accesses the affected functionality, the attacker-controlled content could execute in the victim's browser, potentially compromising the session and allowing arbitrary client-side code execution. This impacts the confidentiality and integrity of the application but does not affect availability.
This update includes the following RPMs:
qt5:
* qt5-filesystem-5.15.18-2.1.hum1 (aarch64, x86_64)
* qt5-rpm-macros-5.15.18-2.1.hum1 (noarch)
* qt5-srpm-macros-5.15.18-2.1.hum1 (noarch)
* qt5-5.15.18-2.1.hum1.src (src)
PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI's AST-based Python sandbox can be bypassed using type.__getattribute__ trampoline, allowing arbitrary code execution when running untrusted agent code. The _execute_code_direct function in praisonaiagents/tools/python_tools.py uses AST filtering to block dangerous Python attributes like __subclasses__, __globals__, and __bases__. However, the filter only checks ast.Attribute nodes, allowing a bypass. The sandbox relies on AST-based filtering of attribute access but fails to account for dynamic attribute resolution via built-in methods such as type.getattribute, resulting in incomplete enforcement of security restrictions. The string '__subclasses__' is an ast.Constant, not an ast.Attribute, so it is never checked against the blocked list. This vulnerability is fixed in 4.5.128.
PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI automatically loads a file named tools.py from the current working directory to discover and register custom agent tools. This loading process uses importlib.util.spec_from_file_location and immediately executes module-level code via spec.loader.exec_module() without explicit user consent, validation, or sandboxing. The tools.py file is loaded implicitly, even when it is not referenced in configuration files or explicitly requested by the user. As a result, merely placing a file named tools.py in the working directory is sufficient to trigger code execution. This behavior violates the expected security boundary between user-controlled project files (e.g., YAML configurations) and executable code, as untrusted content in the working directory is treated as trusted and executed automatically. If an attacker can place a malicious tools.py file into a directory where a user or automated system (e.g., CI/CD pipeline) runs praisonai, arbitrary code execution occurs immediately upon startup, before any agent logic begins. This vulnerability is fixed in 4.5.128.