25886 matches found
CVE-2026-77021: Improper Handling of Highly Compressed Data (Data Amplification)
Improper handling of highly compressed data data amplification in Checkmk 2.5.0p14, 2.4.0p37, 2.3.0p51 and 2.2.0 EOL allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an...
CVE-2025-71420: Authorization Bypass Through User-Controlled Key
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLEAGENT can enumerate saved reply identifiers and read content reserved for groups...
Embedded Assessments for Frontier AI
Third-party evaluations for frontier AI have mostly tested models through external interfaces before deployment. But the risks from frontier AI models depend on how their developers use and govern them internally. Recently, CEOs of frontier AI companies have committed to hosting embedded...
SUSE SLES15 Security Update : amazon-cloudwatch-agent (SUSE-SU-2026:4045-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4045-1 advisory. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through...
PT-2026-96098
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE AGENT can enumerate saved reply identifiers and read content reserved for groups...
Red Hat: CVE-2026-80110: pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...
ALSA-2026:69130 Important: openssh security update
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: OpenSSH: sftp client allows attacker to control downloaded file location...
ALSA-2026:69129 Important: openssh security update
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: OpenSSH: sftp client allows attacker to control downloaded file location...
OPENSUSE-SU-2026:11828-1 amazon-cloudwatch-agent-1.300072.0-1.1 on GA media
These are all security issues fixed in the amazon-cloudwatch-agent-1.300072.0-1.1 package on the GA media of openSUSE Tumbleweed...
auto-vuln-research
auto-vuln-research Agent harness for high-volume open-sourc...
CVE-2026-94111
Tencent BrowserSkill through 0.3.0 contains an authentication bypass in the local daemon WebSocket origin validation . The flawed logic accepts any chrome-extension origin whose identifier is 32 characters long and falls within the range a-p , allowing an attacker to register a malicious browser ...
CVE-2026-94111 Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon
Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate...
OPENSUSE-SU-2026:21884-1 Security update for amazon-ssm-agent
This update for amazon-ssm-agent fixes the following issues: - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library bsc1278681. - CVE-2026-71556: github.com/go-git/go-git/v5: arbitrary file read/write via symbolic lin...
CVE-2026-94111: Origin Validation Error
Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate...
Xalgorix Autonomous AI Pentesting Agent 4.6.83
Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...
OPENSUSE-SU-2026:21882-1 Security update for google-osconfig-agent
This update for google-osconfig-agent fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276722. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on...
wechat-employee-assistant
Starting the Web Interface and Listening Process To start t...
agent-scan v0.6.4-snapshot-6e2d290-1638
Snyk Agent Scan Discover and scan agent components on your machine for prompt injections and vulnerabilities including agents, MCP servers, skills. Note: We don't publish an npm package for Agent Scan. Install it via uvx or as a standalone binary. Note: CLI output is experimental and subject to...
