2026-05-10 Daily Vulns

NEW:

CVE	vendor-product	description	metric	Referenceurl	title	GithubURL
CVE-2026-41496	MervinPraison - PraisonAI	PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.9 and praisonaiagents version 1.6.9, the fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends — MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB — pass table_prefix straight into f-string SQL. Same root cause, same code pattern, same exploitation. 52 unvalidated injection points across the codebase. postgres.py additionally accepts an unvalidated schema parameter used directly in DDL. This issue has been patched in praisonai version 4.6.9 and praisonaiagents version 1.6.9.	CVSS3.1: 8.1 - HIGH	0	Exploitation: pocAutomatable: noTechnical Impact: total	PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)	github
CVE-2025-63703	n/a - n/a	npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js().	CNA n/a CVSS3.1: 9.8 - CRITICAL	0 1	Exploitation: noneAutomatable: yesTechnical Impact: total	undefined	github
CVE-2024-33724	n/a - n/a	SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.	CNA n/a CVSS3.1: 5.4 - MEDIUM	0	Exploitation: pocAutomatable: noTechnical Impact: partial	undefined	github