CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- mervinpraison praisonaiPraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool9.8 Critical
- mervinpraison praisonaiPraisonAI SandboxExecutor allowedCommands bypass via shell chaining8.8 High
- mervinpraison praisonaiPraisonAI codeMode sandbox escape via Function constructor9.9 Critical
- mervinpraison praisonaiPraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients7.6 High
- mervinpraison praisonaiPraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation8.2 High
- mervinpraison praisonaiagentsPraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters8.1 High
- mervinpraison praisonaiPraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion8.1 High
- dadrus heimdallHeimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode7.0 High
- dadrus heimdallHeimdall: IP Spoofing via Unvalidated Forwarding Headers7.0 High
- eclipse theia, the eclipse foundation eclipse theia +1 more[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat8.4 High
- woodpecker-ci woodpeckerWoodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation7.1 High
- eclipse 4diac forte, eclipse foundation 4diac +1 moreIn Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to...5.2 Medium
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerability8.5 High
- mervinpraison praisonaiPraisonAI Code agent tools fail open without a workspace boundary7.3 High
- mervinpraison praisonaiPraisonAI UI MCP connect endpoint allows unauthenticated local command execution9.8 Critical
- mervinpraison praisonaiPraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)8.6 High
- mervinpraison praisonaiPraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API8.1 High
- mervinpraison praisonaiPraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation9.8 Critical
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints9.8 Critical
- mervinpraison praisonaiPraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding7.2 High
- mervinpraison praisonaipraisonai: Jobs API exposes agent-execution endpoints with no authentication9.8 Critical
- mervinpraison praisonaiagentsPraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal7.5 High
- mervinpraison praisonaipraisonai: recipe serve auth middleware silently disables itself when no secret is set9.8 Critical
- mervinpraison praisonaipraisonaiagents: SSRF guard validates literal IPs only and never resolves DNS8.5 High
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass9.8 Critical
- mervinpraison praisonaiPraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API7.5 High
- mervinpraison praisonaiagentsPraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in9.8 Critical
- shenzhen liandian communication technology ltd v380 ip camera / appfhe1 v1.0.6.0A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian...6.0 Medium
- mervinpraison praisonaiagentsPraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder6.5 Medium
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI: SpiderTools redirect-target SSRF protection bypass6.5 Medium
- mervinpraison praisonaiPraisonAI: Compute-bridged file tools allow shell command injection8.8 High
- mervinpraison praisonaiPraisonAI recipe.run_stream skips dangerous-tool policy enforcement7.8 High
- mervinpraison praisonaiPraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools8.8 High
- mervinpraison praisonaiPraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing8.6 High
- mervinpraison praisonaiPraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage7.5 High
- mervinpraison praisonaiPraisonAI Slack app_mention bypasses configured user/channel authorization8.3 High
- mervinpraison praisonaiPraisonAI recipe serve Typer command bypasses the non-localhost authentication guard8.2 High
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools8.3 High
- mervinpraison praisonaiPraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal7.5 High
- mervinpraison praisonaiPraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals8.8 High
- zitadelZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider4.2 Medium
- zitadelZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider4.2 Medium
- zitadelZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)7.4 High
- mervinpraison praisonaiPraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint4.3 Medium
- docker sandboxesDocker Sandboxes ICMP egress restriction bypass after daemon restart5.1 Medium
rootlesskitSUSESecurity update for rootlesskitNo score- docker sandboxesDocker Sandboxes network egress allowlist bypass via unfiltered DNS resolution5.7 Medium
rootlesskitSUSESecurity update for rootlesskitNo scoreocamlopamWindows command execution via filename quotes.7.3 High- zitadelZITADEL: Cross-Tenant User Leakage via Recycled Identifiers2.3 Low
- Show moreLoading…