{"vulnerability": "CVE-2026-5713", "sightings": [{"uuid": "c2e1a2ad-952e-4ce7-91da-635911f9c2d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5713", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mjk2cpb2wg2r", "content": "", "creation_timestamp": "2026-04-15T13:55:26.145561Z"}, {"uuid": "49748727-1678-4583-be4f-0c0addffaa48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5713", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mjkbudr45z2t", "content": "", "creation_timestamp": "2026-04-15T16:10:34.311403Z"}, {"uuid": "71465fde-aae8-4889-a03f-fec084d90c90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5713", "type": "seen", "source": "https://bsky.app/profile/robsavoury.bsky.social/post/3mmjw7y2wqs2a", "content": "Latest Python 3.14.5 release (including fixes for CVE-2026-1502, CVE-2026-4786, and CVE-2026-5713) is now available to #SavOS PPA users of #Ubuntu #Linux at ppa:savoury1/python-3.14 (launchpad.net/~savoury1/+a...) for all PPA supported LTS releases.", "creation_timestamp": "2026-05-23T17:02:43.178070Z"}, {"uuid": "39680f1f-a464-4228-b2aa-9fcac664219a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-57130", "type": "published-proof-of-concept", "source": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c969-5x3p-vq3v", "content": "", "creation_timestamp": "2026-07-20T22:36:17.686764Z"}, {"uuid": "8e80148b-9ad6-410d-8005-a7ecf7a07d40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-57132", "type": "published-proof-of-concept", "source": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8ccj-p46r-jwqq", "content": "", "creation_timestamp": "2026-07-20T22:36:13.280869Z"}, {"uuid": "51c4e761-3a73-4faf-bc4f-cee3ffa9dfef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-57131", "type": "published-proof-of-concept", "source": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fq2m-6wqh-x44g", "content": "", "creation_timestamp": "2026-07-20T22:36:15.504372Z"}, {"uuid": "9b17d90c-7bdc-48e5-a05e-b1339c348a0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-57133", "type": "published-proof-of-concept", "source": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5jv7-2mjm-h6qj", "content": "", "creation_timestamp": "2026-07-20T22:35:53.256816Z"}, {"uuid": "322c78f7-087a-4955-b8da-996d3dda3150", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-57139", "type": "published-proof-of-concept", "source": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j4f3-55x4-r6q2", "content": "", "creation_timestamp": "2026-07-20T22:35:57.623776Z"}, {"uuid": "d96fb121-d3c9-4d20-ad31-fb4745a6dc9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-57138", "type": "published-proof-of-concept", "source": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vmmj-pfw7-fjwp", "content": "", "creation_timestamp": "2026-07-20T22:36:02.049865Z"}, {"uuid": "5710bed6-ad25-49ab-8f9d-cf929a5120a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-57137", "type": "published-proof-of-concept", "source": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-h2w2-v7j6-xqm4", "content": "", "creation_timestamp": "2026-07-20T22:36:04.348369Z"}, {"uuid": "e7d13c7a-f444-459a-8ed9-c2c6ade07830", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-57136", "type": "published-proof-of-concept", "source": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vjv9-7m7j-h833", "content": "", "creation_timestamp": "2026-07-20T22:36:06.666315Z"}, {"uuid": "43d0311d-a029-4549-8d10-b574a1c3c5bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-57135", "type": "published-proof-of-concept", "source": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gqmf-56h7-rrpf", "content": "", "creation_timestamp": "2026-07-20T22:36:08.889541Z"}, {"uuid": "76db1287-9e5d-4e80-a397-95b3ea57b7cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-57134", "type": "published-proof-of-concept", "source": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4qq2-2j2x-x62c", "content": "", "creation_timestamp": "2026-07-20T22:36:11.094904Z"}, {"uuid": "f0789c87-c91f-4b01-b643-37bdf66c98bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57131", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrdcrzmdqs2q", "content": "CVE-2026-57131 - praisonai\nThe PraisonAI Jobs API allows anyone to execute arbitrary code without needing a password. This could be used by an attacker to run malicious code on your system. To fix this, update\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#praisonai #pip #CVE #infosec", "creation_timestamp": "2026-07-23T17:00:05.154892Z"}, {"uuid": "dabeab21-6257-4240-8848-b2c3158f3d15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57130", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvii7bt4nn2z", "content": "\ud83d\udfe0 CVE-2026-57130 - High (8.1)\n\nPraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/pr...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-57130/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-14T16:01:19.335062Z"}, {"uuid": "19f01378-6a93-4634-8e64-5b86e680f587", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57130", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/iqzsn4ajaibnh", "content": "CVE-2026-57130 - PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters\nCVE ID : CVE-2026-57130\n \n Published : Sept. 14, 2026, 3:17 p.m. | 19\u00a0minutes ago\n \n Description : PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai...", "creation_timestamp": "2026-09-14T16:11:31.529774Z"}, {"uuid": "6f460b0e-7d83-468e-b6b1-8b037c62b94f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57131", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvipcctb7c2g", "content": "\ud83d\udea8 CVE-2026-57131 \u2014 CVSS 9.8 CRITICAL\n\nPraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-57131\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-14T18:08:01.687522Z"}, {"uuid": "7ee51fc1-cdfc-4551-bf56-0a6665cdf7cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57138", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvklo3gxse2y", "content": "\ud83d\udea8 CVE-2026-57138 \u2014 CVSS 9.9 CRITICAL\n\nPraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/bui...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-57138\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-15T12:08:21.354217Z"}, {"uuid": "61e4699f-9f7b-4f88-aba4-d11d0cb332a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57139", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvklodner42t", "content": "\ud83d\udea8 CVE-2026-57139 \u2014 CVSS 9.8 CRITICAL\n\nPraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-57139\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-15T12:08:29.591200Z"}, {"uuid": "168435f9-fdf0-469f-9dde-056162f8653a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57139", "type": "seen", "source": "https://gist.github.com/KhoaPhan8I/b7899621299193d7b7079d85f4806beb", "content": "# CVE Intel Feed \u2014 Offer (2026-09-15)\n\n## Product\n\nDaily JSON feed: 20 hot CVEs with local-lab PoC + fix note each.\nEvidence-first: every item ran green in an isolated fixture.\n\n**NEW \u2014 Live-Proof Premium pack (3 items, REAL vendor-source audits):**\n\n| CVE | Finding | Proof |\n|---|---|---|\n| CVE-2026-81648 (CVSS 10.0) | CryptoPayment WP unauth AJAX \u2192 file-delete + settings overwrite + wallet cleartext | 3 live vectors on Stable 1.2.2 |\n| CVE-2026-57139 (CVSS 9.8) | PraisonAI MCPServer optional-auth default-open | DEFAULT_OPEN_PROVEN on v4.7.8 source |\n| CVE-2026-87911 (CVSS 9.6) | postgres-mcp-server COPY\u2026TO PROGRAM bypass (fixed 1.1.7, confirmed 1.2.1) | FIX_CONFIRMED on vendor source |\n\nPack manifest: `data/live-proof-pack.json` (regenerate: `python scripts/live_pack.py`).\n\n## Sample (redacted, free)\n\n`data/feed-sample.json` \u2014 3 items, PoC stripped. Full feed holds\n20 items with working PoC code + REPORT text.\n\n## Tiers\n\n- **Sample:** free, redacted, shareable.\n- **Full feed:** 20 items + PoC + REPORT. Price on request.\n- **Live-Proof Premium:** 3 REAL vendor-source audits with evidence logs. Price on request.\n- **Custom watch:** vendor/product filter + same-day PoC. Price on request.\n\n## Proof of work (today)\n\n- 255 labs in repo, each PoC executed live (rc=0).\n- Feed packed from real artifacts: `python scripts/feed.py`.\n- Sample packed redacted: `python scripts/feed_sample.py`.\n\n## Contact\n\nReply with target vendor/product list + desired tier.\nDelivery: JSON file + PoC scripts, daily refresh via farm cron.\n\n## Honest limits\n\n- Lab PoCs are synthetic fixtures modeling NVD patterns, not\n  zero-days against live products.\n- No live-scope testing included; buyer confirms own scope.\n- Bounty submission service requires buyer's HackerOne token and\n  live-target evidence per report.\n\n\n{\n  \"date\": \"2026-09-15\",\n  \"count\": 3,\n  \"redacted\": true,\n  \"items\": [\n    {\n      \"cve\": \"CVE-2026-81648\",\n      \"cvss\": 10.0,\n      \"published\": \"2026-09-13T21:17:01.930\",\n      \"summary\": \"The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated user\",\n      \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n      \"has_report\": true\n    },\n    {\n      \"cve\": \"CVE-2026-90519\",\n      \"cvss\": 6.3,\n      \"published\": \"2026-09-13T13:16:27.697\",\n      \"summary\": \"A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. Th\",\n      \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n      \"has_report\": true\n    },\n    {\n      \"cve\": \"CVE-2026-90520\",\n      \"cvss\": 6.3,\n      \"published\": \"2026-09-13T13:16:28.760\",\n      \"summary\": \"A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown co\",\n      \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n      \"has_report\": true\n    }\n  ]\n}", "creation_timestamp": "2026-09-15T16:01:41.504543Z"}, {"uuid": "a7be5749-9238-41f0-8e0e-d7aa6abef5b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57138", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvl3xsfimc2t", "content": "CVE-2026-57138 - praisonai\nVersions of PraisonAI from 1.4.0 through 1.7.1 run user\u2011provided JavaScript in a weak isolation that can be bypassed. An attacker could read confidential files, change data\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#praisonai #mervinpraison #CVE #infosec", "creation_timestamp": "2026-09-15T17:00:07.665066Z"}, {"uuid": "8bd3e5f5-272d-4b74-8019-0ef6e0d5d36e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57139", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvl3xv5apz2j", "content": "CVE-2026-57139 - praisonai\nVersions 1.5.0 through 1.7.2 of PraisonAI run an HTTP listener that does not restrict which computer can connect and does not check who is making the request. Any device\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#praisonai #mervinpraison #CVE #infosec", "creation_timestamp": "2026-09-15T17:00:10.290786Z"}, {"uuid": "4bf072bc-527d-4a05-9404-2c0d084ab6d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57138", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvmdnemcih25", "content": "CVE-2026-57138 - praisonai\nVersions 1.4.0 through 1.7.1 of PraisonAI allow code entered into the codeMode feature to break out of its sandbox and run arbitrary commands on the server. An\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#praisonai #mervinpraison #npm #CVE #infosec", "creation_timestamp": "2026-09-16T04:50:06.956200Z"}, {"uuid": "a19f8c74-2c29-4d9b-821f-1b54557c8784", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57139", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvme77zlib2y", "content": "CVE-2026-57139 - praisonai\nVersions 1.5.0 through 1.7.1 of PraisonAI\u2019s MCPServer open a network port that accepts requests without requiring a login. Anyone who can reach that port can ask the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#praisonai #mervinpraison #npm #CVE #infosec", "creation_timestamp": "2026-09-16T05:00:06.065414Z"}]}