chat-with-mlx (>=0.1.0, <=0.1.11), crewai-files (>=1.9.0, <=1.10.1a1) +9 more potentially affected by CVE-2026-84311 via pypdf (4.0.2)

pypdf PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chat-with-mlx =0.1.0, =1.9.0, =3.2.0, =1.2.1, =1.0.9, =0.0.0, =0.1.2, =0.73.0, =0.94.0 Source cves: CVE-2026-84311 Source advisory:...

CVE-2026-84287

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/apiserver.py of the component Session Chat Interface. This manipulation causes denial of service. The attack is possible to be carried out remotely. The...

CVE-2026-84287

A denial-of-service vulnerability exists in NousResearch hermes-agent 0.18.0 , specifically within the Session Chat Interface component in the file gateway/platforms/api_server.py. The flaw allows a remote attacker with low privileges to cause a service disruption. The exploit is reported as publ...

CVE-2026-84287 NousResearch hermes-agent Session Chat api_server.py denial of service

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/apiserver.py of the component Session Chat Interface. This manipulation causes denial of service. The attack is possible to be carried out remotely. The...

EUVD-2026-69699

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/apiserver.py of the component Session Chat Interface. This manipulation causes denial of service. The attack is possible to be carried out remotely. The...

CVE-2026-84287 NousResearch hermes-agent Session Chat api_server.py denial of service

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/apiserver.py of the component Session Chat Interface. This manipulation causes denial of service. The attack is possible to be carried out remotely. The...

CVE-2026-84287: Improper Resource Shutdown or Release

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/apiserver.py of the component Session Chat Interface. This manipulation causes denial of service. The attack is possible to be carried out remotely. The...

PT-2026-84514

Name of the Vulnerable Software and Affected Versions hermes-agent version 0.18.0 Description A flaw in the Session Chat Interface component, specifically within the gateway/platforms/api server.py file, allows a remote attacker to cause a denial of service. Recommendations At the moment, there i...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

tfc — Updated!

Tinfoil Chat Tinfoil Chat TFC is a FOSS+FHD peer-to-peer messaging system that relies on high assurance hardware architecture to protect users from passive collection, MITM attacks and most importantly, remote key exfiltration. TFC is designed for people with one of the most complex threat models...

CVE-2026-82881 Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execut...

CVE-2026-82580 AshAi echoes raw tool exception messages into the conversation, disclosing internal details

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...

PT-2026-83669

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash ai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...

CVE-2026-79483: Improper Neutralization of Special Elements in Data Query Logic

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

Important: tomcat

Issue Overview: Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the...

CVE-2026-79483

FastGPT Community Edition versions 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection flaw in the POST /api/core/chat/getHistories endpoint. The root cause is that the authOutLinkInit() function fails to perform proper runtime type checks, allowing an unauthenticated attacker to inject mal...

PT-2026-83999

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...