CVE-2026-77085

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...

EUVD-2026-63273

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...

CVE-2026-77085

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool . The tool used a raw HTTP client to send requests to a user-supplied API URL, bypassing n8n's centralized SSRF protection. On instances with N8N_SSRF_PROTECTION_ENABLED=true, an authenticated ...

xalgorix v4.5.153

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

agent-scan v0.6.0

Snyk Agent Scan Discover and scan agent components on your machine for prompt injections and vulnerabilities including agents, MCP servers, skills. Note: CLI output is experimental and subject to change Agent Scan v0.5.x planned for deprecation The raw output of this CLI — including issue codes,...

nono v0.74.0

Built by the team that brought you Sigstore The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central !NOTE In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum. !IMPORTANT Organization...

opencode v1.18.19

The open source AI coding agent. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Installation root@kitploit: YOLO curl -fsSL...

CVE-2026-76564

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7...

CVE-2026-76564 Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7...

CVE-2026-76564 Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7...

EUVD-2026-63215

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7...

CVE-2026-76564

PhocaCart (Joomla extension) versions 5.0.0–6.1.7 are affected by a Stored XSS (CWE-79) in the admin order view. When the non-default store_user_agent option is enabled, the raw User-Agent header from checkout requests is stored unsanitized in the orders database and rendered without HTML encodin...

CVE-2026-17153

The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images...

CVE-2026-17153 AI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint

The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images...

CVE-2026-17153 AI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint

The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images...

EUVD-2026-63200

The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images...

CVE-2026-17153

AI Agent by SiteGround plugin (≤1.2.7) has a missing authorization check on its /generate-content REST endpoint, allowing authenticated Contributor-level users to upload images to the media library despite lacking the upload_files capability. The sg_ai_studio_gutenberg_nonce is issued to any bloc...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler, spicedb, openbao, k3s, tetragon, cluster-api-gcp-controller, cluster-api, cert-manager, emissary, kube-metrics-adapter, gitlab-kas, kyverno, azure-service-operator, cluster-api-helm-controller, metrics-server, kube-rbac-proxy, kubeflow-pipelines,...

drakvuf-sandbox v0.21.0

DRAKVUF Sandbox !WARNING Here be dragons 🐉. Maintaining your own sandbox is a difficult task and this project uses technology that is not user-friendly. Be prepared to brush up on your debugging skills as bugs may be reproducible only on your configuration. On the other hand, it's not purely an R...

Directory Traversal

Overview agno is an Agno: a lightweight library for building Multi-Agent Systems Affected versions of this package are vulnerable to Directory Traversal through the readfile, savetofile, and runpythonfile actions. An attacker can read, write, or execute arbitrary files by supplying a filename wit...