79 matches found
EUVD-2026-114361
praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory stored instruction injection...
praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)
Impact A remote Telegram user can write files to arbitrary paths inside an agent's persistent workspace volume praktor-wk-, mounted at /workspace/agent, escaping the documented uploads/ directory. The attacker controls the Telegram document filename, which was concatenated into the destination pa...
ASM-Obfuscator
ASM-Obfuscator Advanced x86-64 assembly obfuscator. Description The Assembly Code Obfuscator is a powerful and versatile tool designed to enhance the security of your x86-64 assembly code. It shields your projects from reverse engineering and analysis by employing a wide range of obfuscation...
-SCTT-2026-33-0002-DWM-Visual-Field-Singularity
SCTT-2026-33-0002: DWM Visual-Field Singularity π‘ Theoretical Classification ID: SCTT-2026-33-0002 Researcher: Americo Simoes SimoesCTT Physics: Theorem 4.2 - Turbulent Phase Transition TPT Constant: Ξ± = 0.0302011 Target: Desktop Window Manager dwm.exe / Windows Graphics Component Obsoletes:...
compaction-laundering
Compaction Laundering When a coding agent summarizes its own conversation, a line an attacker planted in a file it read can come out recorded as the user's own instruction β and get executed. Security research into context compaction conversation summarization in open-source coding agents. The...
AETHER-PROTOCOL-P
⬑ AETHER PROTOCOL β Aether AI LLC. 2026 Cryptographically Verified Short-Lived Identity Infrastructure for Autonomous AI Systems Patent Pending β US Application 64/006,746 β Filed March 16, 2026 "Every AI system in the world can be compromised by injecting false instructions into its pipeline...
CVE-2026-62331
praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in internal/telegram/bot.go concatenate the attacker-controlled document filename into a destination path without sanitization,...
CVE-2026-62331 praktor: Telegram upload traversal permits persistent agent instruction injection
praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in internal/telegram/bot.go concatenate the attacker-controlled document filename into a destination path without sanitization,...
CVE-2026-62331 praktor: Telegram upload traversal permits persistent agent instruction injection
praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in internal/telegram/bot.go concatenate the attacker-controlled document filename into a destination path without sanitization,...
CVE-2026-62331
The praktor multi-agent Claude Code orchestrator (versions prior to 0.9.1 ) contains a path traversal vulnerability in the internal/telegram/bot.go file. The application fails to sanitize attacker-controlled document filenames during Telegram uploads, allowing path.Join to collapse parent-directo...
CVE-2026-62331 praktor: Telegram upload traversal permits persistent agent instruction injection
praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in internal/telegram/bot.go concatenate the attacker-controlled document filename into a destination path without sanitization,...
CVE-2026-62331: mtzanidakis praktor: praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Missionβ¦
praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in internal/telegram/bot.go concatenate the attacker-controlled document filename into a destination path without sanitization,...
PT-2026-134132
Name of the Vulnerable Software and Affected Versions praktor versions prior to 0.9.1 Description In internal/telegram/bot.go, Telegram upload sites concatenate document filenames provided by the user into a destination path without proper sanitization. Because path.Join collapses parent-director...
CVE-2023-30575
Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through specially-crafted data...
Exposure of Data Element to Wrong Session
Overview @strands-agents/sdk is a TypeScript SDK for Strands Agents framework Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the A2A server component multiagent.a2a module, which does not properly isolate conversation state between callers. An...
CVE-2026-112264
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...
CVE-2026-112264 BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...
CVE-2026-112264
BentoML versions through 1.4.39 are vulnerable to a Dockerfile instruction injection vulnerability (CWE-78). The root cause is the lack of proper sanitization of docker.env mapping keys rendered by the legacy base.j2 template, which allows attackers to embed newlines into the configuration. By pr...
CVE-2026-112264 BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...
CVE-2026-112264
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...