25998 matches found
PT-2026-87187
Name of the Vulnerable Software and Affected Versions DeepSeek Harness versions prior to 0.1.2-alpha.1 Description An authentication bypass exists in the local HTTP agent-control API. The system grants unauthenticated access by accepting a client-supplied loopback Host header instead of validatin...
PT-2026-88505
Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.37.7 n8n versions prior to 2.38.2 Description An authorization bypass exists when a workflow is attached to an Agent as a tool. While the setting This workflow can be called by is enforced by the Execute Workflow node, ...
PT-2026-88165
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata source, level, and timestamp resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...
CVE-2026-82533: Reliance on Untrusted Inputs in a Security Decision
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a...
CVE-2026-86996: Missing Authorization
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted...
PT-2026-88441
Name of the Vulnerable Software and Affected Versions Okta Hyperdrive Agent affected versions not specified Description The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level following every successful MFA completion. This...
amazon-ssm-agent-3.3.5226.0-1.1 on GA media (moderate)
amazon-ssm-agent-3.3.5226.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11694-1 Rating: moderate Cross-References: CVE-2025-22869 CVE-2026-25934 CVE-2026-71556 CVSS scores: CVE-2025-22869 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-22869 SUSE : 8.2...
CVE-2026-19397: Missing Authentication for Critical Function
Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent '...
CVE-2026-86732: Improper Control of Generation of Code
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...
google-guest-agent-20260903.00-1.1 on GA media (moderate)
google-guest-agent-20260903.00-1.1 on GA media Announcement ID: openSUSE-SU-2026:11699-1 Rating: moderate Cross-References: CVE-2026-56854 CVE-2026-84445 CVSS scores: CVE-2026-56854 SUSE : 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2026-56854 SUSE : 8.6...
About Remote Code Execution - TeamCity (CVE-2026-63077) vulnerability
About Remote Code Execution - TeamCity CVE-2026-63077 vulnerability. TeamCity is a proprietary solution developed by JetBrains for automating software build, testing, and deployment processes. TeamCity uses a central server to coordinate builds and separate build agents to execute them. An agent...
Malicious Package
Overview prime-coding-agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview agent-free is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Security update for amazon-cloudwatch-agent
This update for amazon-cloudwatch-agent fixes the following issues: CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control bsc1277995. CVE-2026-41178:...
SUSE-SU-2026:4045-1 Security update for amazon-cloudwatch-agent
This update for amazon-cloudwatch-agent fixes the following issues: - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control bsc1277995. -...
CVE-2026-77698
Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade...
CVE-2026-85201
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded...
CVE-2026-85201
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded...
