OmniRoute < 3.8.49 - Unauthenticated RCE

OmniRoute = 3.8.49 contains a remote code execution caused by insufficient validation of interpreter arguments in the POST /api/acp/agents endpoint, letting remote attackers execute arbitrary code, exploit requires anonymous access when requireLogin is false or management session/API key when tru...

CVE-2026-73318

CVE-2026-73318: Missing authorization on force-agreement actions XenForo before 2.3.13 lets any ACP administrator trigger site-wide privacy-policy and terms re-agreement. What happens The ACP navigation entries are limited to administrators with the option permission, but ForceAgreementController...

CVE-2026-98779

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acphwinit registers ACP child devices with mfdadddevices before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domain...

SUSE CVE-2026-98779

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acphwinit registers ACP child devices with mfdadddevices before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domain...

AZL-109334 CVE-2026-98779 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acphwinit registers ACP child devices with mfdadddevices before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domain...

CVE-2026-98779 drm/amdgpu: fix ACP MFD device leak on init failure

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acphwinit registers ACP child devices with mfdadddevices before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domain...

CVE-2026-98779

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acphwinit registers ACP child devices with mfdadddevices before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domain...

CVE-2026-98779 drm/amdgpu: fix ACP MFD device leak on init failure

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acphwinit registers ACP child devices with mfdadddevices before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domain...

EUVD-2026-103864

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acphwinit registers ACP child devices with mfdadddevices before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domain...

CVE-2026-98779

The Linux kernel contains a device leak vulnerability in the drm/amdgpu driver. The acp_hw_init() function registers ACP child devices using mfd_add_devices() before completing hardware initialization. If attaching a child to the power domain fails, or if reset/clock enable operations time out, t...

PT-2026-116998

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acp hw init registers ACP child devices with mfd add devices before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domai...

Linux Distros Unpatched Vulnerability : CVE-2026-98779

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: fix ACP MFD device leak on init failure acphwinit registers ACP child devices with mfdadddevices before attaching them to the ACP power domain and...

CVE-2026-109556

EdgeEver Desktop versions 1.92.0 through 1.112.0 are vulnerable to a remote code execution vulnerability within the desktop:acp-probe IPC handler . The root cause is a lack of sender checks, allowing the handler to spawn a caller-supplied input.path executable. An attacker who achieves script exe...

CVE-2026-109559: Incorrect Authorization

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

agentc-llamaindex (0.2.5a2), agentia (>=0.0.2, <=0.0.10) +245 more potentially affected by CVE-2026-102994 via pypdf (5.9.0)

pypdf PYPI version 5.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agentc-llamaindex 0.2.5a2 - agentia =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =0.11.2, =1.1.0a20250429, =3.1.8, =1.0.5, =1.0.0, =0.1.0, =1.1.1,...

a2 (>=0.1.0, <=0.7.0), a2grunnerp (>=0.1.0, <=0.1.8) +1429 more potentially affected by CVE-2026-49265 via oauthlib (>=3.0.0, <=3.3.1)

oauthlib PYPI version =3.0.0, =0.1.0, =0.1.0, =1.0.32, =0.1.0, =3.2.1, =0.2.0, =3.2.0, =1.1.0, =0.1.31, =1.0.0, =0.0.8, =0.0.1, =1.1.73b0, =0.1.0, =2.2.0 and more Source cves: CVE-2026-49265 Source advisory: OSV:GHSA-XPV3-W29H-X7CV...

CVE-2026-100547

OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions 2026.7.1 through 2026.7.2, alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP were treated as relative paths and were incorrectly classified as reads scoped to the session...

CVE-2026-100547

The OpenClaw coding agent (npm package openclaw) versions 2026.7.1 through 2026.7.2 are vulnerable to a local file disclosure flaw. The root cause is that alternate but valid file: URL spellings supplied over the Agent Client Protocol (ACP) are incorrectly treated as relative paths and classified...

CVE-2026-100547 OpenClaw before 2026.8.1 Authentication Bypass via File URL

OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions 2026.7.1 through 2026.7.2, alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP were treated as relative paths and were incorrectly classified as reads scoped to the session...

VulnCheck KEV: CVE-2026-88062

OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before...