CVE Notifier

CVE-2026-90791 CWE-416 6.3

GPAC MP4Box base_scenegraph.c gf_node_unregister use after free

A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. The manipulation results in use after free…

cve.org n/a:GPAC 14 Sep 2026

CVE-2026-59569 CWE-20 8.1

Android ZCC VPN API method privilege escalation

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls.

cve.org Zscaler:Client · Connector 14 Sep 2026

CVE-2026-25687 CWE-366 8.1

ZCC race condition in ZPA tunnel handler

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the …

cve.org Zscaler:Client · Connector 14 Sep 2026

CVE-2026-90790 CWE-918 6.3

a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the file src/a2a/server/tasks/base_push_notification_sender.py of the component Push No…

cve.org a2aproject:a2a-python 14 Sep 2026

CVE-2026-57130 CWE-20 8.1

PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IM…

cve.org MervinPraison:praisonaiagents 14 Sep 2026

CVE-2026-57128 CWE-306 4.3

PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.auth_token before handling /publish, /events…

cve.org MervinPraison:PraisonAI 14 Sep 2026

CVE-2026-57115 CWE-918 6.5

PraisonAI: SpiderTools redirect-target SSRF protection bypass

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrape_page validates only the initial URL and lets requests.Session.get follow redirects automatically, so a public-looking URL can r…

cve.org MervinPraison:PraisonAI · MervinPraison:praisonaiagents 14 Sep 2026

CVE-2026-57125 CWE-306 9.8

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute…

cve.org MervinPraison:PraisonAI · MervinPraison:praisonaiagents 14 Sep 2026

CVE-2026-82427 CWE-22 N/A

Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name

Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without nor…

cve.org Apache · Software · Foundation:Apache 14 Sep 2026

CVE-2026-82428 CWE-22 N/A

Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate, for example `dep---.jar`. The key was therefore identical for every user of the…

cve.org Apache · Software · Foundation:Apache 14 Sep 2026

CVE-2026-82429 CWE-367 N/A

Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher

Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with…

cve.org Apache · Software · Foundation:Apache 14 Sep 2026

CVE-2026-82430 CWE-367 N/A

Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant

Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the comma…

cve.org Apache · Software · Foundation:Apache 14 Sep 2026