CVE-2026-18775: Server-Side Request Forgery (SSRF)

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browsersnapshot of the file tools/browsertool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The...

Amazon Linux 2 : amazon-cloudwatch-agent, --advisory ALAS2-2026-3844 (ALAS-2026-3844)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300069.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3844 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject...

SUSE SLES12 Security Update : google-guest-agent (SUSE-SU-2026:3439-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3439-1 advisory. This update for google-guest-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...

PT-2026-67729

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description Flowise record manager and agent memory nodes allow authenticated users to set arbitrary TypeORM DataSource options via the additionalConfig input. This occurs in the following components: -...

PT-2026-67830

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An unauthenticated remote attacker can execute arbitrary code in the context of the service account or the user running the server. The issue occurs when a chatflow uses a CSV Agent node, where the r...

CVE-2026-70477: Improper Control of Generation of Code

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed...

PT-2026-67693

Name of the Vulnerable Software and Affected Versions oidcc plug versions 0.1.0-alpha.3 through 0.4.9 Description Improper handling of case sensitivity in the Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense-in-depth control against the replay of stolen...

PT-2026-67910

-- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: Flowise - Flowise -- VULNERABILITY DETAILS ------------------------ Version tested: 3.1.1 Installer file: https://github.com/FlowiseAI/Flowise npm...

PT-2026-67764

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw allows remote unauthenticated code execution on the agent host. Recommendations At the moment, there is no information about a newer version that contains...

Langflow agent Function Bypass

The vulnerability of the getflowbyidorendpointname function in the Langflow agent and workflow creation/execution tools relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions using an...

PT-2026-67731

Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent versions prior to 2026.6.6 Description An issue in the Quick Command Handler component allows for incorrect authorization. The flaw exists within the check slash access function located in the gateway/run.py file and...

PT-2026-67755

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browser snapshot of the file tools/browser tool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The...

PT-2026-67754

Name of the Vulnerable Software and Affected Versions hermes-agent versions prior to 0.16.1 Description A flaw in the xAI Image Generation Provider component allows for remote server-side request forgery SSRF, a condition where an attacker can induce the server to make requests to an unintended...

libretto v0.6.40

Libretto Libretto is a toolkit for building robust web integrations. It gives your coding agent a live browser and a token-efficient CLI to: Inspect live pages with minimal context overhead Capture network traffic to reverse-engineer site APIs Record user actions and replay them as automation...

CVE-2026-18738

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering...

aiodocker (0.7.0), aiopogo (>=1.6.0b1, <=2.0.0) +10 more potentially affected by CVE-2026-69243 via aiohttp (2.0.7)

aiohttp PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiodocker 0.7.0 - aiopogo =1.6.0b1, =0.1.0, =0.1.0, =0.42.4, =0.0.1, =0.9.6, =1.1.0, =1.3.3 Source cves: CVE-2026-69243 Source advisory:...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-73621 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-73621 Source advisory: OSV:GHSA-P538-C434-8V24...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-73619 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-73619 Source advisory: OSV:GHSA-539M-9XH6-Q6RR...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-73620 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-73620 Source advisory: OSV:GHSA-3F7W-8RR8-F37F...

agent-scan v0.5.16

Snyk Agent Scan Discover and scan agent components on your machine for prompt injections and vulnerabilities including agents, MCP servers, skills. Note: CLI output is experimental and subject to change Agent Scan v0.5.x planned for deprecation The raw output of this CLI — including issue codes,...