19567 matches found
EUVD-2026-21730
A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.0.4. The affected element is an unknown function of the component Administrative HTTP Endpoint. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been made...
CowAgent 访问控制错误漏洞
CowAgent is an intelligent assistant and scalable agent framework developed by zhayujie’s individual developer. Versions of CowAgent 2.0.4 and earlier contained a security vulnerability related to access control. This vulnerability stemmed from the absence of authentication in the Agent Mode...
CVE-2026-32282 vulnerabilities
Vulnerabilities for packages: kots, aws-flb-kinesis, ingress-nginx-controller, aws-flb-cloudwatch, redka, libnvidia-container, argo-cd, cilium-cli, chezmoi, falco-no-driver, kubescape, spire-server, kyverno, go, mattermost, newrelic-fluent-bit-output, kubernetes, telegraf, kubernetes-dashboard,...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: kots, wave, cloud-provider-azure, harbor, mailpit, ip-masq-agent, neuvector-scanner, rancher-helm, dfc, pulumi, nri-mongodb, otel-cli, mattermost, gitsign, kubernetes-dashboard, pguser, xeol, node-problem-detector, nri-postgresql, juicefs-csi-driver, spegel,...
GHSA-7MR4-XJXG-34G6 vulnerabilities
Vulnerabilities for packages: kots, wave, cloud-provider-azure, harbor, bom, ingress-nginx-controller, prometheus-operator, mc, net-kourier, litestream, aws-efs-csi-driver, crossplane-provider-family-azure, neuvector-scanner, rancher-helm, spiffe-helper, x509-certificate-exporter, filebrowser,...
CVE-2026-32288 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller-fips, ko-fips, tekton-pipelines-fips, scorecard, splunk-otel-collector, external-secrets-operator-fips, chartmuseum, nuclei, syncthing-fips, cephcsi, localstack, knative-operator-fips, aws-flb-kinesis-fips, gh, prometheus-fips, docker-cli,...
GHSA-X4JJ-H2V8-HQQV vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller-fips, ko-fips, tekton-pipelines-fips, scorecard, splunk-otel-collector, external-secrets-operator-fips, chartmuseum, nuclei, syncthing-fips, cephcsi, localstack, knative-operator-fips, aws-flb-kinesis-fips, gh, prometheus-fips, docker-cli,...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: amazon-cloudwatch-agent-operator-fips, crossplane-provider-azure-storage, ingress-nginx-controller-fips, cert-manager-google-cas-issuer-fips, dynamic-localpv-provisioner-fips, terraform-provider-random, ucd, kyverno-policy-reporter-ui, apache-exporter,...
GHSA-5W89-2C2X-6X66 vulnerabilities
Vulnerabilities for packages: terraform-provider-random, crossplane-aws-provider, ghaudit, fq, cert-manager-istio-csr-fips, splunk-otel-collector, prometheus-nats-exporter, mongo-tools, external-secrets-operator-fips, secrets-store-csi-driver, falco-exporter, localstack, newrelic-infra-operator,...
CVE-2026-39889
PraisonAI is a multi-agent teams system. Prior to 4.5.115, the A2U Agent-to-User event stream server in PraisonAI exposes all agent activity without authentication. The createa2uroutes function registers the following endpoints with NO authentication checks: /a2u/info, /a2u/subscribe,...
GHSA-X462-JJPC-Q4Q4 PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint
Summary The AGUI endpoint POST /agui has no authentication and hardcodes Access-Control-Allow-Origin: on all responses. Combined with Starlette/FastAPI's Content-Type-agnostic JSON parsing, any website a victim visits can silently trigger arbitrary agent execution against a locally-running AGUI...
GHSA-PM96-6XPR-978X PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS
Summary The AgentOS deployment platform exposes a GET /api/agents endpoint that returns agent names, roles, and the first 100 characters of agent system instructions to any unauthenticated caller. The AgentOS FastAPI application has no authentication middleware, no API key validation, and default...
Missing Authentication for Critical Function
Overview praisonaiagents is a Praison AI agents for completing complex tasks with Self Reflection Agents Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the listagents function. An attacker can access sensitive agent names, roles, and partial...
PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS
Summary The AgentOS deployment platform exposes a GET /api/agents endpoint that returns agent names, roles, and the first 100 characters of agent system instructions to any unauthenticated caller. The AgentOS FastAPI application has no authentication middleware, no API key validation, and default...
EUVD-2026-21172
PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS...
CVE-2026-35660
OpenClaw before 2026.3.23 contains an insufficient access control vulnerability in the Gateway agent /reset endpoint that allows callers with operator.write permission to reset admin sessions. Attackers with operator.write privileges can invoke /reset or /new messages with an explicit sessionKey ...
The Increasing Role of AI in Vulnerability Research
At Wordfence, we run a bug bounty program that pays out mid-six figures per year to researchers in bug bounties for WordPress related vulnerabilities. Funding this research helps us improve security for the WordPress community overall, and helps us secure our customers by rolling out protection f...
CVE-2026-35660
OpenClaw is affected by a vulnerability in the Gateway agent’s /reset endpoint, prior to version 2026.3.23. The flaw grants callers with operator.write permission the ability to reset admin sessions by invoking /reset or /new with an explicit sessionKey, bypassing operator.admin requirements and ...