PT-2026-68366

Name of the Vulnerable Software and Affected Versions heshengtao super-agent-party versions prior to 0.4.2 Description Remote attackers can trigger server-side request forgery SSRF by manipulating the url argument within the sanitize proxy url function located in the server.py file of the extensi...

PT-2026-68451

Name of the Vulnerable Software and Affected Versions poco-ai poco-agent versions prior to 0.5.5 Description A security flaw exists in the Claude File Handler component within the WorkspaceManager. setup session persistence function located in the executor/app/core/workspace.py file. Remote...

CVE-2026-41861 - Arbitrary Root File Write via Path Traversal in BOSH agent | Cloud Foundry

Severity Low CVSSv4: Low 2.3 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSSv3: Medium 4.2 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Vendor CloudFoundry Foundation Versions Affected Severity is Medium unless otherwise noted. BOSH – All bosh agent versions v2.847.0 jammy =...

CVE-2026-19019: Incomplete Cleanup

A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager.setupsessionpersistence of the file executor/app/core/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed fro...

@whalent/agent (0.3.288) potentially affected by unknown CVE via @whalent/agent-core (0.3.288)

@whalent/agent-core NPM version 0.3.288 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.288 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.252) potentially affected by unknown CVE via @whalent/agent-core (0.3.252)

@whalent/agent-core NPM version 0.3.252 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.252 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.271) potentially affected by unknown CVE via @whalent/agent-core (0.3.271)

@whalent/agent-core NPM version 0.3.271 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.271 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.244) potentially affected by unknown CVE via @whalent/agent-core (0.3.244)

@whalent/agent-core NPM version 0.3.244 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.244 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

Malicious Package

Overview @agenthub-ai/agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

@whalent/agent (0.3.258) potentially affected by unknown CVE via @whalent/agent-core (0.3.258)

@whalent/agent-core NPM version 0.3.258 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.258 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.289) potentially affected by unknown CVE via @whalent/agent-core (0.3.289)

@whalent/agent-core NPM version 0.3.289 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.289 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

Malicious Package

Overview claude-remote-agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

@whalent/agent (0.3.296) potentially affected by unknown CVE via @whalent/agent-core (0.3.296)

@whalent/agent-core NPM version 0.3.296 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.296 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.234) potentially affected by unknown CVE via @whalent/agent-core (0.3.234)

@whalent/agent-core NPM version 0.3.234 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.234 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.279) potentially affected by unknown CVE via @whalent/agent-core (0.3.279)

@whalent/agent-core NPM version 0.3.279 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.279 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.266) potentially affected by unknown CVE via @whalent/agent-core (0.3.266)

@whalent/agent-core NPM version 0.3.266 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.266 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.276) potentially affected by unknown CVE via @whalent/agent-core (0.3.276)

@whalent/agent-core NPM version 0.3.276 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.276 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.280) potentially affected by unknown CVE via @whalent/agent-core (0.3.280)

@whalent/agent-core NPM version 0.3.280 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.280 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.230) potentially affected by unknown CVE via @whalent/agent-core (0.3.230)

@whalent/agent-core NPM version 0.3.230 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.230 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

@whalent/agent (0.3.231) potentially affected by unknown CVE via @whalent/agent-core (0.3.231)

@whalent/agent-core NPM version 0.3.231 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.231 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...