PT-2026-84882

A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code agent.py of the component CodeAgent. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used...

PT-2026-84883

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui agents/s1/utils/ocr server.py of the component OCR HTTP API. Executing a manipulation of the argument img bytes can lead to resource consumption. The attack m...

CVE-2026-78604: Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource CWE-732 in Elastic Agent can lead to local privilege escalation via Replace Binaries CAPEC-642. On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls...

CVE-2026-84427: Improper Resource Shutdown or Release

A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed an...

PT-2026-84798

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build...

PT-2026-84884

A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service. Remote exploitation of the attack is possibl...

CVE-2026-84648: Improper Neutralization of Input During Web Page Generation

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata source, level, and timestamp resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

PT-2026-84774

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure...

CVE-2026-84833: Uncontrolled Resource Consumption

A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of the file packages/core/src/agent/agent.ts of the component Browser Agent Message Construction. Performing a manipulation results in...

CVE-2026-84651: Improper Access Control

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure...

PT-2026-84839

A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of the file packages/core/src/agent/agent.ts of the component Browser Agent Message Construction. Performing a manipulation results in...

PT-2026-84887

This AI Chatbot module enables you to have a Chatbot using assistants to help you with your Drupal website. The module doesn't sufficiently sanitize for cross site scripting XSS when using the structured results using legacy agent setups. This vulnerability is mitigated by the fact that an attack...

PT-2026-84771

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata source, level, and timestamp resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-84675: Improper Neutralization of Special Elements used in an OS Command

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build...

PT-2026-84741

Incorrect Permission Assignment for Critical Resource CWE-732 in Elastic Agent can lead to local privilege escalation via Replace Binaries CAPEC-642. On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls...

AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119

This AI Chatbot module enables you to have a Chatbot using assistants to help you with your Drupal website. The module doesn't sufficiently sanitize for cross site scripting XSS when using the structured results using legacy agent setups. This vulnerability is mitigated by the fact that an attack...

Stored XSS vulnerability in system log viewer

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata source, level, and timestamp resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes. TIP: On Jenkins 2.539 and newer, LTS...

Unsafe deserialization allows overwriting other agents

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document. This allows attackers with...

OS command injection vulnerability on agents in tics

tics 2025.1.1 and earlier does not correctly escape build environment variable values when constructing the OS command it executes. This allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build. tics 2026.1.0 correctly escapes...

CVE-2026-84479

WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...