agent-vm-hermes-adapter (>=0.0.116, <=0.0.132), apify-hermes-agent-plugin (>=0.1.0, <=0.1.5) +18 more potentially affected by CVE-2026-10221 via hermes-agent (>=0.13.0, <=0.19.0)

hermes-agent PYPI version =0.13.0, =0.0.116, =0.1.0, =0.1.3, =0.1.0, =3.0.0, =0.1.2, =2.5.17, =0.3.0, =0.9.0, =0.1.0a16, =1.0.1, =1.0.0, =1.0.2, =1.0.21 and more Source cves: CVE-2026-10221 Source advisory: OSV:PYSEC-2026-3577...

agent-vm-hermes-adapter (>=0.0.116, <=0.0.132), apify-hermes-agent-plugin (>=0.1.0, <=0.1.5) +18 more potentially affected by CVE-2026-10224 via hermes-agent (>=0.13.0, <=0.19.0)

hermes-agent PYPI version =0.13.0, =0.0.116, =0.1.0, =0.1.3, =0.1.0, =3.0.0, =0.1.2, =2.5.17, =0.3.0, =0.9.0, =0.1.0a16, =1.0.1, =1.0.0, =1.0.2, =1.0.21 and more Source cves: CVE-2026-10224 Source advisory: OSV:PYSEC-2026-3576...

chatlytics-hermes (>=3.0.0, <=3.0.1), mtmai (>=0.10.0, <=0.10.5) potentially affected by CVE-2026-10223 via hermes-agent (>=0.13.0, <=0.14.0)

hermes-agent PYPI version =0.13.0, =3.0.0, =0.10.0, =0.10.5 Source cves: CVE-2026-10223 Source advisory: OSV:PYSEC-2026-3575...

hermes-agent has an Injection issue

A vulnerability was identified in NousResearch hermes-agent up to 0.12.0. Affected by this vulnerability is the function compresscontext of the file runagent.py. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be use...

PYSEC-2026-3575 hermes-agent has an Injection issue

A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. This affects the function scanmemorycontent of the file tools/memorytool.py. This manipulation causes injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used f...

golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions

A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the...

skill-scanner v2.0.13

Skill Scanner A best-effort security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. Combines pattern-based detection YAML + YARA, LLM-as-a-judge , and behavioral dataflow analysis to maximize detection coverage of probable threats while...

agent-vault v0.39.1

HTTP credential proxy and vault An open-source credential broker by Infisical that sits between your agents and the APIs they call. Agents should not possess credentials. Agent Vault eliminates credential exfiltration risk with brokered access. New here? Thelaunch blog post has the full story...

opencode v1.18.12

The open source AI coding agent. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Installation root@kitploit: YOLO curl -fsSL...

CSV Injection

Overview Affected versions of this package are vulnerable to CSV Injection via the visit export process. An attacker can cause arbitrary spreadsheet formulas to be embedded in exported CSV files by supplying specially crafted values in the User-Agent, Referer, or request path headers that begin...

PT-2026-73956

TuxCare rebuilt tunnel-agent to address 1 CVE. Fixed in 0.4.3-tuxcare.1...

PT-2026-73954

TuxCare rebuilt tunnel-agent to address 1 CVE. Fixed in 0.4.0-tuxcare.1...

PT-2026-73953

TuxCare rebuilt tunnel-agent to address 1 CVE. Fixed in 0.3.0-tuxcare.1...

PT-2026-67759

Name of the Vulnerable Software and Affected Versions Veeam Service Provider Console affected versions not specified Description An unauthenticated attacker can impersonate a managed agent to obtain the credentials of that agent. Recommendations At the moment, there is no information about a newe...

PT-2026-74549

TuxCare rebuilt https-proxy-agent to address 2 CVEs. Fixed in 1.0.0-tuxcare.1...

CVE-2026-18773: Incorrect Authorization

A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function checkslashaccess of the file gateway/run.py of the component Quick Command Handler. The manipulation results in incorrect authorization. The attack can be launched remotely. The exploi...

CVE-2026-18774: Server-Side Request Forgery (SSRF)

A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function saveurlimage of the file agent/imagegenprovider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has...

CLEAR: Causal Context-Based Agentic Reasoning for Vulnerability Detection

Detecting source code vulnerabilities is increasingly difficult as modern security flaws are rooted in complex causal dependencies between execution flows, control conditions, and program states. Despite recent advances in Large Language Models LLMs and multi-agent frameworks, existing approaches...

CVE-2026-58073: Authentication Bypass Using an Alternate Path or Channel

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials...

CVE-2026-18775: Server-Side Request Forgery (SSRF)

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browsersnapshot of the file tools/browsertool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The...