CVE-2026-39890

Prais onAI’s AgentService.loadAgentFromFile parses YAML with js-yaml without disabling dangerous tags (e.g., !!js/function, !!js/undefined), enabling attacker to upload a malicious agent definition and achieve remote code execution on the server. Affected software: PraisonAI (before 4.5.115). Roo...

CVE-2017-15936

In Artica Pandora FMS version 7.0, an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, the script will get executed...

CVE-2017-15936

Artica Pandora FMS 7.0 contains a Cross‑Site Scripting vulnerability. An attacker with write permission can create an agent carrying an XSS payload, which executes when a user visits the agent definitions page. The underlying root cause is not specified in the provided documents. The exact affect...