CVE-2026-30968 Coral Server has insufficient validation of agent identity for SSE connections

Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, the SSE endpoint /sse/v1/... in Coral Server did not strongly validate that a connecting agent was a legitimate participant in the session. Th...

CVE-2026-26117 Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability

...

CVE-2026-26117

Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally...

CVE-2026-26117

CVE-2026-26117 concerns Arc Enabled Servers running the Azure Connected Machine Agent. The vulnerability is an Elevation of Privilege issue affecting the Azure Arc-enabled machine agent on Arc-enabled servers. According to the CVSS data, it is a local, low-complexity attack requiring LOW privileg...

CVE-2025-54659

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability CWE-22 vulnerability in Fortinet FortiSOAR Agent Communication Bridge 1.1.0, FortiSOAR Agent Communication Bridge 1.0 all versions may allow an unauthenticated attacker to read files accessible to the...

CVE-2025-54659

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability CWE-22 vulnerability in Fortinet FortiSOAR Agent Communication Bridge 1.1.0, FortiSOAR Agent Communication Bridge 1.0 all versions may allow an unauthenticated attacker to read files accessible to the...

Exploit for CVE-2026-30741

Security Advisory: CVE-2026-30741 Product: OpenClaw Agent Pla...

Study Finds ROME AI Agent Attempted Cryptomining Without Instructions

A recent research paper describing the training of an experimental AI agent has started a discussion after the…...

Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability

Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: trino, mariadb-operator, net-kourier, lvm-driver, crossplane-provider-aws-elasticache, syft, crossplane-provider-aws-cloudfront, gitaly, restic, sriov-network-device-plugin, flux-image-reflector-controller, kubernetes-csi-external-attacher, kubernetes-event-exporter,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: trino, mariadb-operator, net-kourier, lvm-driver, crossplane-provider-aws-elasticache, syft, crossplane-provider-aws-cloudfront, gitaly, restic, sriov-network-device-plugin, flux-image-reflector-controller, kubernetes-csi-external-attacher, kubernetes-event-exporter,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: mariadb-operator, crossplane-provider-aws-cloudfront, restic, wgcf, flux-image-reflector-controller, opentofu, azcopy, swagger, knative-operator, tailscale, prometheus-operator, rootlesskit, step, libnvidia-container, smokescreen, crossplane-provider-aws-ec2,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: mariadb-operator, crossplane-provider-aws-cloudfront, restic, wgcf, flux-image-reflector-controller, opentofu, azcopy, swagger, knative-operator, tailscale, prometheus-operator, rootlesskit, step, libnvidia-container, smokescreen, crossplane-provider-aws-ec2,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: mariadb-operator, crossplane-provider-aws-cloudfront, restic, wgcf, flux-image-reflector-controller, opentofu, azcopy, swagger, knative-operator, tailscale, prometheus-operator, rootlesskit, step, libnvidia-container, smokescreen, crossplane-provider-aws-ec2,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, azurefile-csi-fips, aws-fsx-csi-driver-fips, knative-operator-fips, nri-apache, atlantis, kubewatch, crossplane-provider-aws-efs-fips, apache-exporter, nats, step-fips, gitlab-runner, ytt, opensearch-k8s-operator-fips,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, azurefile-csi-fips, aws-fsx-csi-driver-fips, knative-operator-fips, atlantis, crossplane-provider-aws-efs-fips, apache-exporter, step-fips, gitlab-runner, ingress-nginx-controller-fips, gosu, oauth2-proxy-fips, kube-arangodb-fips,...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana within Instana Agent container image build 1.0.314 Vulnerability Details CVEID:CVE-2025-61727 DESCRIPTION: An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana within Instana Agent container image build 1.0.311 Vulnerability Details CVEID:CVE-2025-61725 DESCRIPTION: The ParseAddress function constructs domain-literal address components through repeated string concatenatio...

Microsoft Azure Connected Machine Agent 安全漏洞

Microsoft Azure Connected Machine Agent is a core component of Microsoft that connects non-Azure servers to the Azure console. There is a security vulnerability present in Microsoft Azure Connected Machine Agent. Attackers can exploit this vulnerability to gain higher privileges...

PT-2026-24327

Name of the Vulnerable Software and Affected Versions Azure Windows Virtual Machine Agent affected versions not specified Azure Arc on Windows affected versions not specified Description A security issue exists in Azure Windows Virtual Machine Agent and Azure Arc on Windows that allows an attacke...