agent-api-server (>=2.1.7, <=2.2.1), agent-playbook (>=0.1.0, <=0.1.2) +140 more potentially affected by CVE-2026-54282 via starlette (0.49.3)

starlette PYPI version 0.49.3 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - agent-api-server =2.1.7, =0.1.0, =0.1.0, =0.5.0b2, =0.2.47, =1.4.0a20251029, =1.4.0a20251029, =1.3.46, =0.1.10, =0.4.0, =0.4.0, =0.1.1rc61,...

CVE-2026-53471 Migration-planner: agent api ignores jwt source_id claim

A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens JWTs for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the sourceid claim within these tokens against the requested source ID. This oversight allows an...

CVE-2026-53471 Migration-planner: agent api ignores jwt source_id claim

A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens JWTs for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the sourceid claim within these tokens against the requested source ID. This oversight allows an...

PT-2026-75913

A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens JWTs for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the source id claim within these tokens against the requested source ID. This oversight allows an...

CVE-2026-53471: Authorization Bypass Through User-Controlled Key

A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens JWTs for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the sourceid claim within these tokens against the requested source ID. This oversight allows an...

agent-api-server (>=2.1.7, <=2.2.1), agent-playbook (>=0.1.0, <=0.1.2) +140 more potentially affected by CVE-2026-48710 via starlette (0.49.3)

starlette PYPI version 0.49.3 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - agent-api-server =2.1.7, =0.1.0, =0.1.0, =0.5.0b2, =0.2.47, =1.4.0a20251029, =1.4.0a20251029, =1.3.46, =0.1.10, =0.4.0, =0.4.0, =0.1.1rc61,...

agent-api-server (>=2.1.7, <=2.2.1), agent-playbook (>=0.1.0, <=0.1.2) +140 more potentially affected by CVE-2026-48710 via starlette (0.49.3)

starlette PYPI version 0.49.3 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - agent-api-server =2.1.7, =0.1.0, =0.1.0, =0.5.0b2, =0.2.47, =1.4.0a20251029, =1.4.0a20251029, =1.3.46, =0.1.10, =0.4.0, =0.4.0, =0.1.1rc61,...

ai.mindconnect:mc-agent-admin-ui-app (>=0.0.2, <=0.8.4), ai.mindconnect:mc-agent-admin-ui-rest (>=0.0.2, <=0.8.4) +4164 more potentially affected by CVE-2026-22751 via org.springframework.security:spring-security-core (>=6.4.0, <=6.5.9)

org.springframework.security:spring-security-core MAVEN version =6.4.0, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =0.5.8, =0.0.1, =55.v51410e712e0c, =0.1.0, =0.1.0, =0.1.0, =1.5.4.release, =1.5.8.release and more Source cves: CVE-2026-22751 Source advisory:...

PT-2026-35291

Summary The GET, POST, and DELETE handlers under /agents/:id/keys in the Paperclip control-plane API only call assertBoardreq, which verifies that the caller has a board-type session but does not verify that the caller has access to the company owning the target agent. A board user whose membersh...

PT-2026-35290

Summary Paperclip contains an arbitrary file read vulnerability that allows an attacker with an Agent API key to read files from the Paperclip server host filesystem. The vulnerability occurs because agents are allowed to modify their own adapterConfig through the /agents/:id API endpoint. The...

PT-2026-35293

Isolated paperclip instance running in authenticated mode default config on a clean Docker image matching commit b649bd4 2026.411.0-canary.8, post the 2026.410.0 patch. This advisory was verified on an unmodified build. Summary POST /api/agents/:id/keys, GET /api/agents/:id/keys, and DELETE...

agent-api-server (>=2.1.7, <=2.1.13), agentc-langchain (1.0.0) +5 more potentially affected by CVE-2026-34070 via langchain-core (0.3.76)

langchain-core PYPI version 0.3.76 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - agent-api-server =2.1.7, =0.0.2, =0.3.0, =1.0.0rc1, =0.0.91, =0.0.118 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2...

agent-api-server (>=2.1.7, <=2.1.13), agentc-langchain (1.0.0) +5 more potentially affected by CVE-2026-34070 via langchain-core (0.3.76)

langchain-core PYPI version 0.3.76 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - agent-api-server =2.1.7, =0.0.2, =0.3.0, =1.0.0rc1, =0.0.91, =0.0.118 Source cves: CVE-2026-34070 Source advisory:...

abs-langchain-suite (>=0.2.1, <=0.3.1), adxp-cli (>=0.1.1, <=0.1.21) +147 more potentially affected by CVE-2026-27794 via langgraph-checkpoint (3.0.1)

langgraph-checkpoint PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - abs-langchain-suite =0.2.1, =0.1.1, =0.0.1a1, =2.1.7, =0.0.2, =1.3.9, =0.1.3, =0.1.0, =0.6.0, =0.2.0, =0.1.0, =1.1.0 -...

EUVD-2026-8595

Parse Dashboard has incomplete authentication on AI Agent endpoint...

CVE-2026-27595

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint POST /apps/:appId/agent has multiple security vulnerabilities that, when chained, allow unauthenticated remote attackers to perform arbitrary read...

CVE-2026-27609: Cross-Site Request Forgery (CSRF)

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint POST /apps/:appId/agent lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submit...

Parse Dashboard Cross-Site Request Forgery Vulnerability

Parse Dashboard is an dashboard tool open source by the Parse Platform. Versions of Parse Dashboard from 7.3.0-alpha.42 to 9.0.0-alpha.7 have a cross-site request forgeing vulnerability. This vulnerability stems from the lack of CSRF protection on the AI Agent API endpoints, which may allow...

PT-2026-21836

Name of the Vulnerable Software and Affected Versions Parse Dashboard versions 7.3.0-alpha.42 through 9.0.0-alpha.7 Description Parse Dashboard, a standalone dashboard for managing Parse Server apps, contains an issue where the AI Agent API endpoint POST /apps/:appId lacks proper authorization...

CVE-2026-27608: Missing Authorization

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint POST /apps/:appId/agent does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by...