CVE-2026-2123

CVE-2026-2123 describes a local privilege escalation in Windows where the Operations Agent (versions

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: minio, prometheus, terraform-mcp-server, ollama, datadog-agent, nuclei, rclone, opentelemetry-collector-contrib, vcluster, mcp-grafana, teleport, loki, weaviate, tempo, gitlab-runner, dgraph, grafana, malcontent, grafana-alloy, nfpm, dagger, lazygit, goreleaser,...

Vertex AI Vulnerability Exposes Google Cloud Data and Private Artifacts

Cybersecurity researchers have disclosed a security "blind spot" in Google Cloud's Vertex AI platform that could allow artificial intelligence AI agents to be weaponized by an attacker to gain unauthorized access to sensitive data and compromise an organization's cloud environment. According to...

EUVD-2026-17369

OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to plugin-owned routes can invoke runtime.subagent...

Agentic-Security-Code-Review

🔍 Agentic Security Code Review !Claude Codehttps://img.sh...

CVE-2026-32916 OpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin Scopes

OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to plugin-owned routes can invoke runtime.subagent...

CVE-2026-32916

Summary (concrete details): CVE-2026-32916 affects OpenClaw 2026.3.7 prior to 2026.3.11. The vulnerability is an authorization bypass in plugin subagent routes, where these routes execute gateway methods through a synthetic operator client with broad administrative scopes. Impact: remote unauthen...

CVE-2026-32916 OpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin Scopes

OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to plugin-owned routes can invoke runtime.subagent...

CVE-2026-29872

A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 2026-01-19. The affected Streamlit-based GitHub MCP Agent stores user-supplied API tokens in process-wide environment variables using os.environ without...

PT-2026-29297

Name of the Vulnerable Software and Affected Versions Operations Agent versions prior to 12.30 Description A privilege escalation issue exists on Windows where the software may execute files from specific locations that allow write access under certain conditions. Recommendations Update to a...

libpolkit-agent-1-0-127-3.1 on GA media (moderate)

libpolkit-agent-1-0-127-3.1 on GA media Announcement ID: openSUSE-SU-2026:10453-1 Rating: moderate Cross-References: CVE-2025-7519 CVE-2026-4897 CVSS scores: CVE-2025-7519 SUSE : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2025-7519 SUSE : 7.1...

Claude SDK for Python 安全漏洞

Claude SDK for Python is an open-source Python software development toolkit developed by Anthropic for calling the Claude API. Versions of Claude SDK for Python prior to 0.87.0 contained a security vulnerability. This vulnerability stemmed from improper file permission settings created by memory...

OpenText Operations Agent 安全漏洞

OpenText Operations Agent is a software developed by OpenText Corporation in Canada, used for managing and monitoring OpenText products and solutions. Versions of OpenText Operations Agent prior to 12.29 contained security vulnerabilities. These vulnerabilities stemmed from the possibility of...

CVE-2026-32287 vulnerabilities

Vulnerabilities for packages: crossplane-provider-keycloak-fips, crossplane-provider-aws-kms-fips, grafana-alloy-fips, crossplane-provider-aws-dynamodb, crossplane-provider-aws-ssm, crossplane-provider-aws-cloudfront-fips, crossplane-provider-aws-sqs-fips, nuclei, crossplane-provider-aws-iam,...

GHSA-65XW-VW82-R86X vulnerabilities

Vulnerabilities for packages: crossplane-provider-keycloak-fips, crossplane-provider-aws-kms-fips, grafana-alloy-fips, crossplane-provider-aws-dynamodb, crossplane-provider-aws-ssm, crossplane-provider-aws-cloudfront-fips, crossplane-provider-aws-sqs-fips, nuclei, crossplane-provider-aws-iam,...

Addressing the OWASP Top 10 Risks in Agentic AI with Microsoft Copilot Studio

Agentic AI is moving fast from pilots to production. That shift changes the security conversation. These systems do not just generate content. They can retrieve sensitive data, invoke tools, and take action using real identities and permissions. When something goes wrong, the failure is not limit...

Elastic OTel Java 1.10.0 Security Update (ESA-2026-22 / GHSA-xw7x-h9fj-p2c7)

Dependency on Vulnerable Third-Party Component in Elastic OTel Java Leading to Remote Code Execution Dependency on Vulnerable Third-Party Component CWE-1395 exists in Elastic OTel Java via a dependency on OpenTelemetry Java instrumentation library. This vulnerability could allow an attacker to...

The Wiz Blue Agent, now Generally Available

Accelerate your SecOps team with the Blue Agent for threat investigation, now Generally Available...

WordPress Blackhole for Bad Bots plugin <= 3.8 - Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP Header vulnerability

Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP Header vulnerability discovered by Huynh Pham Thanh Luc in WordPress Plugin Blackhole for Bad Bots versions = 3.8...

CVE-2026-29872

The CVE-2026-29872 issue affects the awesome-llm-apps project, specifically a Streamlit-based GitHub MCP Agent. The underlying problem is storing user-provided API tokens in process-wide environment variables via os.environ without proper session isolation, allowing cross-session information disc...