CVE-2026-51904

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, createagentexecution and createagentrun in superagi/controllers/agentexecution.py accept a caller-supplied agentid and fail to verify that the referenced agent...

CVE-2026-51915

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, gettool and updatetool in superagi/controllers/tool.py accept a caller-supplied toolid and fail to verify organization ownership through the associated toolkit. A...

CVE-2026-51914

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, saveagentastemplate and publishtemplate in superagi/controllers/agenttemplate.py accept caller-supplied agentid or agentexecutionid values and do not verif...

POC-CVE-2026-54121-Certighost

CertiGhost CVE-2026-54121 - Kit de explotación de AD CS Chase Fallback Resumen CertiGhost es una vulnerabilidad crítica CVSS 8.8 en Active Directory Certificate Services AD CS que permite a un usuario de dominio con privilegios bajos suplantar un Controlador de Dominio y lograr el compromiso tota...

CVE-2021-46417

CVE-2021-46417 Franklin Fueling Systems Módulo Controlador Colibri - Inclusión de Archivos Locales Argumentos Opcionales: -h, --help muestra este mensaje de ayuda y sale -u url, --url url URL objetivo ej:"http://127.0.0.1" -f file, --file file Objetivos en archivo ej:"ip.txt" Uso python3...

Invoke-DCSync

Invoke-DCSync Invoke-DCSync Referencia: https://adsecurity.org/?p=1729 Referencia: https://silentbreaksecurity.com/invoke-dcsync-because-we-all-wanted-it/ Objetivo: recuperar los hashes de contraseñas de todas las cuentas de usuario en un controlador de dominio utilizando la función DCSync de...

CVE-2026-51914

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, saveagentastemplate and publishtemplate in superagi/controllers/agenttemplate.py accept caller-supplied agentid or agentexecutionid values and do not verif...

CVE-2026-51914

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, saveagentastemplate and publishtemplate in superagi/controllers/agenttemplate.py accept caller-supplied agentid or agentexecutionid values and do not verif...

CVE-2026-51915

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, gettool and updatetool in superagi/controllers/tool.py accept a caller-supplied toolid and fail to verify organization ownership through the associated toolkit. A...

EUVD-2026-91702

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, createagentexecution and createagentrun in superagi/controllers/agentexecution.py accept a caller-supplied agentid and fail to verify that the referenced agent...

CVE-2026-51904

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, createagentexecution and createagentrun in superagi/controllers/agentexecution.py accept a caller-supplied agentid and fail to verify that the referenced agent...

CVE-2026-51899

In SuperAGI v0.0.14 and prior, controller endpoints /api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/editschedule, /api/agents/stopschedule allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different...

CVE-2026-51904

SuperAGI versions up to v0.0.14 are vulnerable to an improper access control vulnerability within the agent execution controller. Specifically, the functions create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id but fail to verify...

EUVD-2026-91758

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, gettool and updatetool in superagi/controllers/tool.py accept a caller-supplied toolid and fail to verify organization ownership through the associated toolkit. A...

EUVD-2026-91703

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoi...

CVE-2026-51915

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, gettool and updatetool in superagi/controllers/tool.py accept a caller-supplied toolid and fail to verify organization ownership through the associated toolkit. A...

CVE-2026-51915

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control within the tool controller. Specifically, the get_tool and update_tool functions in superagi/controllers/tool.py accept a caller-supplied tool_id but fail to verify if the organization owns the associated toolkit. This ...

CVE-2026-51914

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control within the agent template controller. The functions save_agent_as_template and publish_template in superagi/controllers/agent_template.py accept caller-supplied agent_id or agent_execution_id values without verifying if...

EUVD-2026-91759

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, saveagentastemplate and publishtemplate in superagi/controllers/agenttemplate.py accept caller-supplied agentid or agentexecutionid values and do not verif...

CVE-2023-35793-CSRF-On-Web-SSH

CVE-2023-35793-Web-SSH上的CSRF 此仓库包含Dodge工业团队在Dodge OPTIFY平台中发现的CVE-2023-35793的描述。 CVE ID: CVE-2023-35793 厂商: Cassia Networks 产品: Access Controller 版本: Cassia-AC-2.1.1.2303271039 漏洞: 跨站请求伪造 CSRF 影响: Web SSH, 网关 描述: WebSSH功能可通过CSRF初始化。 状态: 厂商确认，已修复 修复版本: Cassia-AC-2.1.1.2308181707 详情...