Malicious code in aclade-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2b361ca760d6a5ed8413f5b9212bc775b6c321183c15f60fb14973b83fddc3d The package runs as a daemon that polls https://aclade.com/api/connector/poll and executes task objects returned by the remote server. Supported...

Malicious code in agenthub-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f29f622134cd387e49d4293fb004554b677e44f972187d6798d6c885a3aa5b0 The package runs as a persistent daemon that opens a WebSocket to the hardcoded production endpoint wss://agenthub-agent.fyenet.com and dispatches...

MAL-2026-13615 Malicious code in agenthub-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f29f622134cd387e49d4293fb004554b677e44f972187d6798d6c885a3aa5b0 The package runs as a persistent daemon that opens a WebSocket to the hardcoded production endpoint wss://agenthub-agent.fyenet.com and dispatches...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-76220 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-76220 Source advisory: OSV:GHSA-WVPP-8HX9-P66J...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-76222 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-76222 Source advisory: OSV:GHSA-HMQ2-W58F-27JC...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-76217 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-76217 Source advisory: OSV:GHSA-HH9P-6WH2-4MFC...

opencode v1.18.15

The open source AI coding agent. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Installation root@kitploit: YOLO curl -fsSL...

SkillSpector v2.8.1

SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. Research shows that 26.1% of...

MAL-2026-13611 Malicious code in mangomind-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6512bd1cea27977e679186d569d524555fdf0ed5ea9e4b965aa640b1ae8326cb src/index.js opens a persistent WebSocket to a hardcoded default relay at wss://relay.mangomindbd.com and dispatches on message types received from...

Malicious code in mangomind-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6512bd1cea27977e679186d569d524555fdf0ed5ea9e4b965aa640b1ae8326cb src/index.js opens a persistent WebSocket to a hardcoded default relay at wss://relay.mangomindbd.com and dispatches on message types received from...

langgraph-agentic-research-api-poc

LANGGRAPH-AGENTIC-RESEARCH-API-POC - High-Impact Autonomous Ag...

EUVD-2026-54321

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...

CVE-2026-62830

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...

PT-2026-69124

Name of the Vulnerable Software and Affected Versions Consul Community Edition versions 1.3.0 through 2.0.2 Consul Enterprise versions 1.3.0 through 2.0.2 Description An unauthenticated denial of service exists in several agent HTTP API endpoints due to unbounded request body processing. A remote...

CVE-2026-64676: Missing Authorization

Kata Containers is an open source implementation of lightweight Virtual Machines VMs that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnerable to an authorization bypass in confidential-guest memory management. In Confidential Containers CoCo deployments, the kata-age...

PT-2026-69139

Name of the Vulnerable Software and Affected Versions HKUDS nanobot versions prior to 0.3.0 Description Improper access controls exist within the MCP enabledTools Scope Handler component. The issue resides in the connect mcp servers function located in the nanobot/agent/tools/mcp.py file. This fl...

SynChain: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains

Computer-use agentsCUAs have transformed large language models into persistent execution systems capable of generating, storing, and reusing artifacts like skills and memory entries. However, existing security defenses largely treat attacks as externally triggered or temporally bounded, leaving a...

PT-2026-69153

Name of the Vulnerable Software and Affected Versions Kata Containers versions prior to 4.0.0 Description The kata-agent contains an authorization bypass in confidential-guest memory management. In Confidential Containers CoCo deployments, the kata-agent uses an OPA/Rego-based AgentPolicy to...

The Anatomy of a Prompt Injection: A Component Model for Structured Analysis

Four years after prompt injection was first identified in 2022, attacks are still predominantly documented as verbatim strings rather than structured exploits, despite advancing agent capabilities and threat actors embedding injections to subvert AI-assisted security analysis. This paper formaliz...

SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:3520-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3520-1 advisory. Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF an...