CVE-2026-50603

CVE-2026-50603 affects the Acer Agent Service component bundled with NitroSense and PredatorSense . The root cause is a hard-coded AES encryption key embedded in the software, which under certain circumstances allows a local attacker (with no privileges and no user interaction) to access protecte...

CVE-2026-50603 Hard-coded encryption key vulnerability in Acer Agent Service for NitroSense and PredatorSense

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to...

EUVD-2026-81284

AVideo through 29.0 current revision e01e41ecc contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php reaches VideoStatistic::save, which writes the caller's User-Agent via getUserAgentInfo, which returns unrecognized age...

PT-2026-94188

Name of the Vulnerable Software and Affected Versions NitroSense affected versions not specified PredatorSense affected versions not specified Description Insufficient access controls within the Acer Agent Service component may allow an authenticated local user to perform unauthorized registry...

PT-2026-94153

Name of the Vulnerable Software and Affected Versions Acer Agent Service affected versions not specified Description The Acer Agent Service component, included with NitroSense and PredatorSense, uses a hard-coded AES encryption key. This allows a local attacker to potentially access protected...

PT-2026-95148

Name of the Vulnerable Software and Affected Versions AI Agent Automation versions prior to 0.9.1 Description An issue exists in the backend/src/controllers/memory.controller.js file where requests are authenticated, but the listMemories, deleteMemory, and clearAgentMemory functions fail to verif...

CVE-2026-54519: Missing Authorization

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory id...

CVE-2026-92611: Incorrect Authorization

In Eclipse Ankaios versions 0.6.0 to before 1.0.4, LogRule::matches in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of evaluating later entries, which can cause deny LogRule entries to be skipped and allow unauthorized access to another...

PT-2026-95104

Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.07 Description An authenticated user with Technician privileges or higher who has access to at least one client invoice can perform SQL injection. The issue occurs at the 'agent/post/recurring invoice.php' endpoint...

CVE-2026-50605: Improper Access Control

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to...

CVE-2026-54597: Improper Neutralization of Special Elements used in an SQL Command

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

CVE-2026-54596: Improper Neutralization of Special Elements used in an SQL Command

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-50603: Use of Hard-coded Cryptographic Key

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to...

SUSE SLES15 Security Update : google-cloud-sap-agent (SUSE-SU-2026:4206-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4206-1 advisory. Security issues fixed: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272128....

PT-2026-94154

Name of the Vulnerable Software and Affected Versions NitroSense affected versions not specified PredatorSense affected versions not specified Description The Acer Agent Service component fails to properly require authentication during the socket handshake process. This flaw allows an unauthorize...

CVE-2026-50604: Missing Authentication for Critical Function

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an unauthorized connection may be...

Robust Workflow Generation Via Adversarial Learning for Audio Deepfake Detection

The rapid advancement of speech synthesis and voice conversion technologies has made audio deepfakes increasingly realistic, posing serious security risks in practical applications. While existing detection methods achieve strong performance under controlled conditions, they often fail to...

SoK: Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes

Autonomous large language model LLM agents are moving rapidly into high-stakes domains, yet existing agentic-AI security studies remain largely domain-agnostic and overlook the distinctive, high-consequence attack surface such settings create. We examine this gap through financial trading agents,...

CVE-2026-54520: Improper Limitation of a Pathname to a Restricted Directory

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

PT-2026-95149

Name of the Vulnerable Software and Affected Versions AI Agent Automation versions prior to 0.9.1 Description An authenticated user capable of creating or modifying workflow file steps can exploit a path traversal flaw in the executeStep file-step implementation located in...