CVE-2026-84886

A resource consumption vulnerability affects the OCR HTTP API component of simular-ai Agent-S versions up to 0.3.2. The flaw resides in the ImageData function within the file gui_agents/s1/utils/ocr_server.py, where manipulation of the img_bytes argument can exhaust system resources. The attack i...

CVE-2026-84885 simular-ai Agent-S CodeAgent code_agent.py denial of service

A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file codeagent.py of the component CodeAgent. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used...

PT-2026-84883

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui agents/s1/utils/ocr server.py of the component OCR HTTP API. Executing a manipulation of the argument img bytes can lead to resource consumption. The attack m...

PT-2026-84884

A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service. Remote exploitation of the attack is possibl...

PT-2026-84882

A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code agent.py of the component CodeAgent. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used...

pipelock v3.5.0

Pipelock Open-source AI agent firewall forVerifiable Egress Control. !pipelock...

LangAlpha v2026.09.01

A vibe investing agent harness LangAlpha is built to help interpret financial markets and support investment decisions. English ｜ 简体中文 ｜ 日本語 Getting Started • API Docs • Agent Core • Backend • Web • TUI • Skills • MCP Pin a curated news brief from the dashboard, kick off idea generation, and...

ship-safe v9.7.5

The independent security agent for AI-written software. It finds issues, investigates whether they are real, and shows you the evidence. Website · Docs · Security & Data Flow · Benchmark · Pricing · Blog · Contribute Ship Safe CLI Ship Safe runs locally in your repo and works in two layers. A...

hermes-agent v2026.8.18

Hermes Agent ☤ Hermes Agent | Hermes Desktop The self-improving AI agent built byNous Research. It's the only agent with a built-in learning loop — it creates skills from experience, improves them during use, nudges itself to persist knowledge, searches its own past conversations, and builds a...

CVE-2026-82233 SiYuan before v3.8.1 Path Traversal via asset.upload

SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into t...

CVE-2026-82233 SiYuan before v3.8.1 Path Traversal via asset.upload

SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into t...

OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Face

OpenAI on Wednesday revealed that reward hacking was a key driver behind the artificial intelligence AI-powered hack of Hugging Face last month, adding that it found evidence of misaligned behavior as early as late May. The incident, the company said, took place during cybersecurity evaluations o...

OpenClaw went viral. Meet the maintainers building and securing it.

What began as a personal experiment quickly became a global open source project with extraordinary momentum. OpenClaw is a personal AI assistant that runs on users' devices and connects with the messaging channels they already use. Started by Peter Steinberger as a weekend project in November 202...

When an AI Agent Turned Attacker: What Qualys Sees Across Every Phase of the Hugging Face Kubernetes Intrusion

A phase-by-phase detection mapping of the first publicly documented autonomous agent intrusion against production infrastructure — including the phases where no product in our category sees anything at all. Executive Summary On July 9, 2026, an autonomous AI agent running inside an OpenAI...

hermetic

Der agentenisolierte Credential-Broker. Ihr KI-Agent führt den authentifizierten Aufruf durch. Er sieht nie den Schlüssel. -brightgreen?style=flat-square Webseite · Installation · Schnellstart · Funktionsweise · Sicherheitsmodell · Schwachstelle melden !IMPORTANT Ihr KI-Agent arbeitet auf der ★★★...

CVE-2026-62674 Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/sessionid/agent checks LEVELEDIT permission for a session but does not reject a bound shared or template agent whose agent.sessionid is None. An authenticated user with ed...

WordPress AI Agent by SiteGround plugin <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Media Upload via /generate-content REST Endpoint vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin SG AI Studio versions = 1.2.7...

CVE-2026-18482

Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax and runPlaywrightTest functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS...

CVE-2026-18482 CVE-2026-18482

Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax and runPlaywrightTest functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS...

CVE-2026-17153

The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images...