Security Advisories

NusaSec responsibly discloses every vulnerability we discover. The following table is our public record of coordinated disclosures, sorted newest first.

18 / 18 advisories

Date	CVE	Title	Researchers
Jun 17 2026	CVE-2026-55538	Auth Bypass praisonai serve agents --api-key run unauthenticated	riodrwn
Jun 17 2026	CVE-2026-55539	Auth Bypass async Jobs API leads to unauthenticated job execution, result theft, cancel and delete	riodrwn
Jun 17 2026	CVE-2026-55540	Path Traversal agent tools escape the configured workspace via symlinks	riodrwn
Jun 17 2026	CVE-2026-55232	SSRF in Vvveb Editor oEmbed Proxy via IPv6 URL-Filter Bypass	eo420
Jun 17 2026	CVE-2026-55231	Path Traversal in Vvveb Backup Tools Allows Arbitrary File Read & Delete	eo420
Jun 17 2026	CVE-2026-55230	Stored XSS in Vvveb Post & Product Content via HTML Sanitizer Bypass	eo420
Jun 17 2026	CVE-2026-55599	SSRF in phpseclib X.509 Validation via Attacker-Controlled Authority Information Access URL	eo420
Jun 17 2026	CVE-2026-55184	Stored XSS via HTML Sanitizer Bypass in EspoCRM Wysiwyg Fields	eo420
Jun 16 2026	CVE-2026-55104	Stored XSS in InvoicePlane via CSV Import	eo420
Jun 13 2026	CVE-2026-54261	Wagtail Image Preview IDOR via Missing Object-Level Permission Check	type5afe