Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the WebTool.Execute function in the web.go file when processing the url argument. An attacker can make unauthorized requests to internal or external systems by supplying crafted URLs. Remediation The...

CVE-2026-15668

A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotel...

CVE-2026-15669 louisho5 picobot exec Tool exec.go ExecTool.Execute os command injection

A vulnerability was found in louisho5 picobot up to 0.2.0. This issue affects the function ExecTool.Execute of the file internal/agent/tools/exec.go of the component exec Tool. The manipulation results in os command injection. The attack requires a local approach. The exploit has been made public...

CVE-2026-15669

Technical details (affected products, vulnerable components, exploit vectors) are not publicly available in the provided documents. Monitor for updates.

CVE-2026-15668

The CVE affects louisho5 picobot up to version 0.2.0, specifically the web Tool component. The vulnerability resides in WebTool.Execute (internal/agent/tools/web.go) where manipulation of the url argument enables server-side request forgery (SSRF). It is a network-vector, with low privileges requ...

CVE-2026-15668 louisho5 picobot web Tool web.go WebTool.Execute server-side request forgery

A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotel...

CVE-2026-15668 louisho5 picobot web Tool web.go WebTool.Execute server-side request forgery

A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotel...

MAL-2026-10529 Malicious code in @wrenfield/abitype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d1b16f2fdde2184bdcfb6f2c91f18c328dee9aa1bb111f86d3130f47c42c9e5 Package @wrenfield/abitype impersonates the well-known wevm/abitype library: it copies the upstream README verbatim links to abitype.dev, wevm.eth,...

Malicious code in @wrenfield/abitype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d1b16f2fdde2184bdcfb6f2c91f18c328dee9aa1bb111f86d3130f47c42c9e5 Package @wrenfield/abitype impersonates the well-known wevm/abitype library: it copies the upstream README verbatim links to abitype.dev, wevm.eth,...

PT-2026-58850

Name of the Vulnerable Software and Affected Versions mastergo-design mastergo-magic-mcp versions prior to 0.2.1 Description Path traversal occurs in the execute function within the mastergo/component-workflow.md file of the mcp getComponentGenerator component. This issue arises from the improper...

PT-2026-58165

Name of the Vulnerable Software and Affected Versions Windows Resilient File System ReFS affected versions not specified Description A heap-based buffer overflow exists in the Windows Resilient File System ReFS. A heap-based buffer overflow occurs when a program writes more data to a heap memory...

PT-2026-58311

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...

PT-2026-58187

Name of the Vulnerable Software and Affected Versions Windows Storage Spaces Direct affected versions not specified Description An integer overflow or wraparound issue exists in Windows Storage Spaces Direct. This flaw allows an unauthorized attacker with physical access to the system to execute...

PT-2026-58523

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description A use after free condition exists in Microsoft Office, which allows an unauthorized attacker to execute arbitrary code locally or remotely, potentially affecting the entire system. U...

CVE-2026-15751: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in mastergo-design mastergo-magic-mcp up to 0.2.0. The affected element is the function execute of the file mastergo/component-workflow.md of the component mcpgetComponentGenerator. The manipulation of the argument rootPath leads to path traversal. An...

PT-2026-58280

Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally...

PT-2026-58536

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

PT-2026-58449

Name of the Vulnerable Software and Affected Versions Remote Desktop Client affected versions not specified Description A use after free issue exists in the Remote Desktop Client, which allows an unauthorized attacker to execute arbitrary code over a network and affect the system. Use after free ...

PT-2026-57932

Name of the Vulnerable Software and Affected Versions SAProuter on Microsoft Windows affected versions not specified Description An issue in the DLL loading mechanism of the SAProuter proxy server involves an uncontrolled search path element. This allows an unauthenticated attacker to load librar...

CVE-2026-15749: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in mastergo-design mastergo-magic-mcp up to 0.2.0. This issue affects the function execute of the file src/tools/get-c2d.ts of the component mcpC2d. Performing a manipulation of the argument filePath results in path traversal. The attack requires a local...