The vulnerability of the Directum Web Agent component of the Directum RX system, which arises due to insufficient validation of input data, allows a perpetrator to execute arbitrary code.

The vulnerability of the Directum Web Agent component of the Directum RX system exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially crafted file...

CVE-2026-70477

Flowise CSV Agent prompt injection leads to remote code execution. In Flowise prior to 3.1.3, the CSV_Agents.run method uses untrusted data to build an LLM prompt, and the resulting pythonCode is executed after a validation step, which can bypass safeguards and run arbitrary code in the service a...

CVE-2026-64633

A vulnerability allowing remote unauthenticated code execution on the agent host...

CVE-2026-58073

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials...

CVE-2026-18775

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browsersnapshot of the file tools/browsertool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The...

CVE-2026-18773

A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function checkslashaccess of the file gateway/run.py of the component Quick Command Handler. The manipulation results in incorrect authorization. The attack can be launched remotely. The exploi...

CVE-2026-18775

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-18775

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browsersnapshot of the file tools/browsertool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The...

EUVD-2026-52766

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browsersnapshot of the file tools/browsertool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The...

CVE-2026-18775 NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browsersnapshot of the file tools/browsertool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The...

CVE-2026-18774

CVE-2026-18774 affects NousResearch hermes-agent up to 0.16.0, specifically the xAI Image Generation Provider component. The vulnerability lies in the save_url_image function in agent/image_gen_provider.py, enabling server-side request forgery. The attack vector is network-based with low privileg...

EUVD-2026-52764

A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function saveurlimage of the file agent/imagegenprovider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has...

EUVD-2026-52758

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials...

CVE-2026-58073

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials...

CVE-2026-64633

The CVE-2026-6463? document describes a vulnerability allowing remote unauthenticated code execution on the agent host. Based on the provided metrics, this is a CRITICAL (CVSSv4.0: 10.0) issue with a NETWORK attack vector, no privileges required and no user interaction needed. Impact is rated HIG...

EUVD-2026-52755

A vulnerability allowing remote unauthenticated code execution on the agent host...

CVE-2026-58073

Technical details about CVE-2026-58073 are not publicly available in the provided documents. No specifics on affected versions, root cause, or remediation are given. Monitor for updates from Veeam and CVE records.

CVE-2026-64633

A vulnerability allowing remote unauthenticated code execution on the agent host...

Flowise: Remote Code Execution Vulnerability in CSVAgent

Summary The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to utilise the pandas library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, panda...

CVE-2026-69256

Flowise CVE-2026-69256 affects the CSVAgent node prior to version 3.1.3. A user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc} and can execute via Pyodide, bypassing a denylist with a pandas.read_pickle payload. An authenticated user who can create/modify a chatflow can add th...