Malicious code in @rafaelsene01/agent-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3855afe87d31e428546f226e1da9236cd0e4dc45a477afb9f6ba1c707a4b05ec The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfuscator declared as a...

CVE-2026-48524 vulnerabilities

Vulnerabilities for packages: kserve, datadog-agent, superset, ggshield...

GHSA-FHV5-28VV-H8M8 vulnerabilities

Vulnerabilities for packages: kserve, datadog-agent, superset, ggshield...

GHSA-993G-76C3-P5M4 vulnerabilities

Vulnerabilities for packages: kserve, datadog-agent, superset, ggshield...

GHSA-JQ35-7PRP-9V3F vulnerabilities

Vulnerabilities for packages: kserve, datadog-agent, superset, ggshield...

CVE-2026-48522 vulnerabilities

Vulnerabilities for packages: kserve, datadog-agent, superset, ggshield...

CVE-2026-48526 vulnerabilities

Vulnerabilities for packages: kserve, datadog-agent, superset, ggshield...

CVE-2026-48523 vulnerabilities

Vulnerabilities for packages: kserve, datadog-agent, superset, ggshield...

CVE-2026-48525 vulnerabilities

Vulnerabilities for packages: kserve, datadog-agent, superset, ggshield...

GHSA-W7VC-732C-9M39 vulnerabilities

Vulnerabilities for packages: kserve, datadog-agent, superset, ggshield...

GHSA-XGMM-8J9V-C9WX vulnerabilities

Vulnerabilities for packages: kserve, datadog-agent, superset, ggshield...

PT-2026-50807

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.5.128 Description A cross-origin agent execution issue exists in the 'POST /agui' endpoint, allowing remote attackers to trigger arbitrary agent execution. The endpoint lacks authentication and utilizes hardcoded...

PT-2026-61738

Name of the Vulnerable Software and Affected Versions @agenticmail/api versions prior to 0.9.64 Description A low-privileged authenticated agent can perform a cross-agent authorization bypass. By using the GET /api/agenticmail/accounts/directory endpoint, an attacker can discover agent names. The...

google-osconfig-agent-20260615.01-1.1 on GA media (moderate)

google-osconfig-agent-20260615.01-1.1 on GA media Announcement ID: openSUSE-SU-2026:11046-1 Rating: moderate Cross-References: CVE-2026-39827 CVE-2026-39829 CVE-2026-39830 CVE-2026-46595 CVSS scores: CVE-2026-39827 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2026-39827 SUSE : 7.1...

PT-2026-50808

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.5.115 Description An information disclosure issue exists in the MultiAgentLedger component. The system fails to enforce the uniqueness of agent IDs, allowing attackers to register agents with duplicate IDs. This...

PT-2026-50713

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 2.641 Description Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header. This behavior allows the bypass of additional multi-factor authentication MFA...

GHSA-99F9-J8R3-P853 Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)

Hermes Agent before 0.16.0 creates responsestore.db and webhooksubscriptions.json with world-readable permissions mode 0o644, exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including...

GHSA-4PQM-J46F-795X Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on /api/pty, /api/ws, /api/pub, and /api/events endpoints, enabling...

Missing Authentication for Critical Function

Overview hermes-agent is a The self-improving AI agent — creates skills from experience, improves them during use, and runs anywhere Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the handling of WebSocket upgrade requests on /api/pty, /api/ws,...

CVE-2026-53870

Hermes Agent before 0.16.0 creates responsestore.db and webhooksubscriptions.json with world-readable permissions mode 0o644, exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including...