Design-and-Evaluation-of-an-MCP-Governed-Pentest-Agent

Design-and-Evaluation-of-an-MCP-Governed-Pentest-Agent Dissert...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-78676 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-78676 Source advisory: OSV:PYSEC-2026-3786...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-78678 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-78678 Source advisory: OSV:PYSEC-2026-3788...

PT-2026-81269

Name of the Vulnerable Software and Affected Versions WatchGuard Agent affected versions not specified Description A path traversal issue allows a remote, unauthenticated attacker located on an adjacent network to execute arbitrary code on the system. Path traversal is a flaw that allows an...

PT-2026-81328

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description An authentication bypass exists in the multi-agent teams system where the create agents app function fails to authenticate requests to the 'POST /agents' and 'POST /agents/agent name' endpoints...

CVE-2026-57909: Missing Authentication for Critical Function

A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system...

CVE-2026-57910: Missing Authentication for Critical Function

Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges...

PT-2026-81270

Name of the Vulnerable Software and Affected Versions WatchGuard Agent affected versions not specified Description Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to execute arbitrary code with elevated privileges. Recommendations At the...

PT-2026-81201

My two cents is that this democratises AI-availability and Privacy. Doom on hardware Y is an existence proof and dies there! For fulfilling your curiosity running a glm-5.1 UD-IQ1 M on one Mac studio M3 ultra plus a iogpu sysctl made us at byteray CVE-2026-55706 a 27-year old bug on OpenBSD just ...

PT-2026-81323

Name of the Vulnerable Software and Affected Versions PraisonAI versions 4.6.34 through 4.6.57 Description In the praisonai serve agents command, the system fails to enforce authentication on public agent invocation endpoints even when an API key is provided via the --api-key flag. The create...

CVE-2026-55538: Missing Authentication for Critical Function

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, praisonai serve agents parses config"apikey" but createagentsapp does not authenticate POST /agents or POST /agents/agentname. Missing or incorrect bearer and X-API-Key values still reach agent execution. This issue is fixed in...

PT-2026-81208

U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read slotted partition that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on...

JetBrains TeamCity < 2021.1.2 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2021.1.2. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible. CVE-2021-43193 - In JetBrains TeamCity before...

JetBrains TeamCity < 2021.1.1 (CVE-2021-37545)

The version of JetBrains TeamCity installed on the remote host is prior to 2021.1.1. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made. CVE-2021-37545 Note that Nessus has not tested for this iss...

PT-2026-81330

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description In the serve subsystem, the praisonai serve agents and praisonai serve unified commands accept an --api-key flag for authentication, but the parsed value is not implemented within the FastAPI...

PT-2026-81209

U-Boot before 2026.10-rc5 contains a buffer overflow in nfs read reply function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the...

Wazuh Server 1.0.0 < 4.14.6 Out-of-Bounds Write (CVE-2026-44254)

The version of Wazuh Server on the remote host is at least 1.0.0 and prior to 4.14.6. It is, therefore, affected by an out-of-bounds write vulnerability: - HandleSecureMessage passes a pointer inside its stack buffer to ReadSecMSG, which decompresses up to OSMAXSTR bytes at that offset. An...

JetBrains TeamCity < 2021.2.3 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2021.2.3. It is, therefore, affected by multiple vulnerabilities: - JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. CVE-2022-25263 - In JetBrains TeamCity...

JetBrains TeamCity < 2022.04 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2022.04. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible CVE-2022-29927 - In JetBrains TeamCity before 2022.04 leak o...

MAL-2026-14431 Malicious code in hydration-ui-dim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64f9565680b71c54ed88e29ed3950f1561764f4b86a260a3ebb5eadb528edfa3 On import 'hydration-ui-dim', dist/index.mjs runs a top-level async IIFE that chmods dist/internal/calc-math.dat to 0755 and spawns it detached via...