| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-57140 | PraisonAI AgentOS exposes unauthenticated agent listing and invocation | MervinPraison | PraisonAI | Critical | 9.4 | 2026-09-15 10:26:11 | Deep Dive |
| CVE-2026-57139 | PraisonAI MCPServer exposes unauthenticated HTTP tools/call | MervinPraison | PraisonAI | Critical | 9.8 | 2026-09-15 10:25:27 | Deep Dive |
| CVE-2026-57138 | PraisonAI codeMode sandbox escape via Function constructor | MervinPraison | PraisonAI | Critical | 9.9 | 2026-09-15 10:22:19 | Deep Dive |
| CVE-2026-57141 | PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool | MervinPraison | PraisonAI | Critical | 9.8 | 2026-09-15 10:14:17 | Deep Dive |
| CVE-2026-48717 | OpenAM OAuth Authorization Bypass via PKCE Challenge | OpenIdentityPlatform | OpenAM | Critical | 9.1 | 2026-09-15 09:57:54 | Deep Dive |
| CVE-2026-45051 | OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage | OpenIdentityPlatform | OpenAM | Critical | 9.2 | 2026-09-15 09:53:41 | Deep Dive |
| CVE-2026-62263 | OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass | OpenIdentityPlatform | OpenAM | Critical | 9.2 | 2026-09-15 09:52:58 | Deep Dive |
| CVE-2026-46619 | OpenAM Authentication Bypass via MSISDN LDAP Injection | OpenIdentityPlatform | OpenAM | Critical | 9.3 | 2026-09-15 09:51:26 | Deep Dive |
| CVE-2026-62379 | OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback | OpenIdentityPlatform | OpenAM | Critical | 9.8 | 2026-09-15 09:45:52 | Deep Dive |
| CVE-2026-45052 | OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints | OpenIdentityPlatform | OpenAM | Critical | 9.3 | 2026-09-15 09:43:59 | Deep Dive |
| CVE-2026-90711 | proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet | proxy-addr | proxy-addr | Critical | 9.1 | 2026-09-15 06:19:46 | Deep Dive |
| CVE-2026-91003 | D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflow | D-Link | DI-8300 | Critical | 9.1 | 2026-09-15 05:45:17 | Deep Dive |
| CVE-2026-91001 | D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow | D-Link | DI-8400 | Critical | 9.9 | 2026-09-15 05:15:14 | Deep Dive |
| CVE-2026-90847 | EFM ipTIME C200E System Setup iux_set.cgi os command injection | EFM | ipTIME C200E | Critical | 9.1 | 2026-09-15 01:00:13 | Deep Dive |
| CVE-2026-12944 | Incomplete Security Scanner Blocklist Enables Network-Based Code Execution | IBM | Langflow OSS | Critical | 9.6 | 2026-09-14 21:30:58 | Deep Dive |
| CVE-2026-67399 | WHMCS 9.0.0-9.0.7/8.13.6及之前版本反序列化RCE | WebPros | WHMCS | Critical | 9.3 | 2026-09-14 20:53:06 | Deep Dive |
| CVE-2026-53713 | Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure | envoyproxy | gateway | Critical | 9.1 | 2026-09-14 20:11:03 | Deep Dive |
| CVE-2026-54334 | UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen` | theopolis | uefi-firmware-parser | Critical | 9.8 | 2026-09-14 20:06:42 | Deep Dive |
| CVE-2026-54333 | UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable | theopolis | uefi-firmware-parser | Critical | 9.8 | 2026-09-14 20:05:20 | Deep Dive |
| CVE-2026-50006 | Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode | julien040 | anyquery | Critical | 9.1 | 2026-09-14 19:56:40 | Deep Dive |