https://blog.securelayer7.net/shadow-ai/ SecureLayer7 en 2026-08-25T08:22:23.000Z Shadow AI: Risks, How It Works and How to Protect Security News https://securelayer7.net/lab/cve-2026-54049-sakai-conversations-stored-xss-unsanitized-messages SecureLayer7 en 2026-08-24T19:50:19.285Z CVE-2026-54049: Sakai Conversations Stored XSS via Unsanitized Topic and Post Messages CVE Advisory https://securelayer7.net/lab/cve-2026-54623-django-cms-move-plugin-cyclic-reparenting-dos SecureLayer7 en 2026-08-24T20:28:49.690Z CVE-2026-54623: django-cms Plugin Move Endpoint Cyclic Reparenting DoS CVE Advisory https://securelayer7.net/lab/cve-2026-55477-3x-ui-arbitrary-file-write-xray-log-path SecureLayer7 en 2026-08-24T21:08:56.562Z CVE-2026-55477: 3X-UI Authenticated Arbitrary File Write via Xray Log Path CVE Advisory https://securelayer7.net/lab/cve-2026-55523-praisonaiagents-web-crawl-ssrf-redirect-bypass SecureLayer7 en 2026-08-25T14:29:01.586Z CVE-2026-55523: praisonaiagents web_crawl SSRF via Unvalidated Redirect Target CVE Advisory https://securelayer7.net/lab/cve-2026-55524-praisonaiagents-ssrf-web-crawl-redirect-dns-rebinding SecureLayer7 en 2026-08-25T14:49:14.600Z CVE-2026-55524: praisonaiagents SSRF via Redirect and DNS Rebinding in web_crawl CVE Advisory https://securelayer7.net/lab/cve-2026-55525-praisonaiagents-web-crawl-ssrf-redirect-bypass SecureLayer7 en 2026-08-25T14:09:13.909Z CVE-2026-55525: praisonaiagents web_crawl SSRF via Redirect Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-55526-praisonaiagents-ssrf-dns-bypass-spider-tools SecureLayer7 en 2026-08-25T14:51:00.533Z CVE-2026-55526: praisonaiagents SSRF Protection Bypass via Wildcard DNS Hostname CVE Advisory https://securelayer7.net/lab/cve-2026-55528-praisonaiagents-agentserver-missing-authentication SecureLayer7 en 2026-08-25T14:52:09.340Z CVE-2026-55528: praisonaiagents AgentServer Missing Authentication CVE Advisory https://securelayer7.net/lab/cve-2026-55532-praisonai-mcp-origin-csrf-bypass SecureLayer7 en 2026-08-25T15:31:08.480Z CVE-2026-55532: PraisonAI MCP HTTP Server Origin Validation Bypass (CSRF) CVE Advisory https://securelayer7.net/lab/cve-2026-55536-praisonai-websocket-origin-regex-bypass SecureLayer7 en 2026-08-25T15:30:01.275Z CVE-2026-55536: PraisonAI WebSocket Origin Validation Bypass via Unanchored Regex CVE Advisory https://securelayer7.net/lab/cve-2026-55537-praisonai-webhook-ssrf-dns-fail-open-toctou SecureLayer7 en 2026-08-25T15:10:11.732Z CVE-2026-55537: PraisonAI Webhook SSRF via DNS Fail-Open and TOCTOU Race CVE Advisory https://securelayer7.net/lab/cve-2026-55538-praisonai-serve-agents-api-key-auth-bypass SecureLayer7 en 2026-08-25T15:11:31.693Z CVE-2026-55538: PraisonAI serve agents --api-key Authentication Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-55539-praisonai-jobs-api-missing-authentication SecureLayer7 en 2026-08-25T15:35:37.308Z CVE-2026-55539: PraisonAI Jobs API Missing Authentication CVE Advisory https://securelayer7.net/lab/cve-2026-55541-praisonai-serve-api-key-missing-authorization SecureLayer7 en 2026-08-25T15:08:58.250Z CVE-2026-55541: PraisonAI serve --api-key Flag Missing Authorization CVE Advisory https://securelayer7.net/lab/cve-2026-55546-qwed-mcp-sympy-parse-expr-rce SecureLayer7 en 2026-08-25T15:28:43.436Z CVE-2026-55546: qwed-mcp Remote Code Execution via Unsafe SymPy parse_expr() CVE Advisory https://securelayer7.net/lab/cve-2026-55553-urllib-cross-origin-redirect-credential-leakage SecureLayer7 en 2026-08-25T16:30:13.085Z CVE-2026-55553: urllib Cross-Origin Redirect Credential Leakage CVE Advisory https://securelayer7.net/lab/cve-2026-55571-djust-liveview-websocket-auth-bypass SecureLayer7 en 2026-08-25T16:14:52.083Z CVE-2026-55571: djust LiveView WebSocket Authentication Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-55580-mcp-shell-command-injection-security-disabled-default-shell-inter SecureLayer7 en 2026-08-25T15:49:03.237Z CVE-2026-55580: mcp-shell OS Command Injection via Security-Disabled Default and Shell Interpreter in Allowlist CVE Advisory https://securelayer7.net/lab/cve-2026-55581-mcp-shell-allowlist-bypass-bash-command-injection SecureLayer7 en 2026-08-25T15:50:13.471Z CVE-2026-55581: mcp-shell Secure Mode Allowlist Bypass via /bin/bash -c CVE Advisory https://securelayer7.net/lab/cve-2026-55582-mcp-shell-git-alias-command-injection SecureLayer7 en 2026-08-25T15:51:22.523Z CVE-2026-55582: mcp-shell Secure Mode Allowlist Bypass via Git Shell Alias CVE Advisory https://securelayer7.net/lab/cve-2026-55585-qwed-authenticated-rce-sympy-parse-expr SecureLayer7 en 2026-08-25T16:28:58.191Z CVE-2026-55585: qwed Authenticated Remote Code Execution via Unsafe SymPy parse_expr() CVE Advisory https://securelayer7.net/lab/cve-2026-55596-platejs-media-embed-stored-xss-provider-metadata SecureLayer7 en 2026-08-25T16:48:48.260Z CVE-2026-55596: @platejs/media Media Embed Stored XSS via Serialized Provider Metadata CVE Advisory https://securelayer7.net/lab/cve-2026-55640-nextcloud-mcp-server-unauthenticated-webhook-vector-deletion SecureLayer7 en 2026-08-25T16:09:19.454Z CVE-2026-55640: nextcloud-mcp-server Unauthenticated Webhook Allows Arbitrary Vector Data Deletion CVE Advisory https://securelayer7.net/lab/cve-2026-55677-echo-encoded-slash-route-bypass-static-file-disclosure SecureLayer7 en 2026-08-25T16:31:27.091Z CVE-2026-55677: Echo v5 Encoded Slash Route-Bypass Exposes Static Files CVE Advisory https://securelayer7.net/lab/cve-2026-9769-justhtml-uncontrolled-recursion-dos-nested-html SecureLayer7 en 2026-08-25T16:50:51.995Z CVE-2026-9769: justhtml Uncontrolled Recursion DoS via Deeply Nested HTML Security Research https://securelayer7.net/lab/pickem-terminal-escape-sequence-injection-unsanitized-labels SecureLayer7 en 2026-08-25T16:10:32.974Z pickem Terminal Escape-Sequence Injection via Unsanitized Item Labels Security Research https://securelayer7.net/lab/postgres-protocol-scram-iteration-count-dos SecureLayer7 en 2026-08-24T19:49:03.531Z postgres-protocol: Unbounded SCRAM Iteration Count CPU Exhaustion DoS Security Research https://securelayer7.net/lab/utcp-http-oauth2-tokenurl-ssrf-credential-theft SecureLayer7 en 2026-08-25T16:11:36.956Z utcp-http OAuth2 tokenUrl Trust Boundary Bypass (SSRF and Credential Theft) Security Research https://securelayer7.net/lab/utcp-http-ssrf-unvalidated-redirect-call-tool SecureLayer7 en 2026-08-25T16:16:10.987Z utcp-http SSRF via Unvalidated HTTP Redirect in call_tool Security Research