EUVD-2026-64016

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/sessionid/agent checks LEVELEDIT permission for a session but does not reject a bound shared or template agent whose agent.sessionid is None. An authenticated user with ed...

CVE-2026-62674

Omnigent (open-source AI agent framework) prior to 0.3.0 is vulnerable to an authenticated Remote Code Execution via the PUT /sessions/{session_id}/agent endpoint. The endpoint validates LEVEL_EDIT permission for the session but fails to reject a bound shared or template agent whose agent.session...

EUVD-2026-64015

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing osenv.cwd value because omnigent/spec/parser.py stores the value verbatim and...

CVE-2026-62677

Omnigent , an open-source AI agent framework for orchestrating coding agents, is vulnerable to arbitrary host filesystem access prior to version 0.3.0. An authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value. The parser (omnigent/sp...

CVE-2026-62677 Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing osenv.cwd value because omnigent/spec/parser.py stores the value verbatim and...

CVE-2026-62677 Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing osenv.cwd value because omnigent/spec/parser.py stores the value verbatim and...

Exploit for CVE-2026-76564

Stored XSS via User-Agent in Admin Order View in PhocaCart...

PoC

PoC Repository di exploit proof of concept e strumenti. BMCRSCDRCE Exploit di esecuzione remota di comandi non autenticato per l'agente RSCD di BMC Server Automation. L'exploit funziona contro i server affetti da CVE-2016-1542 rilevato da Nessus. Questo è ora un modulo Metasploit, vedi...

prismsec

PrismSec 🔷 Server MCP sicuro e modulare per strumenti di pentesting. Raggruppa 7 strumenti di sicurezza standard del settore nmap, nuclei, gobuster, subfinder, httpx, nikto, sqlmap in 13 strumenti MCP registrati — pronti per l'uso con Claude, Cursor, Copilot e qualsiasi agente AI compatibile con...

CVE-2026-15576

CVE-2026-15576 is an improper authentication vulnerability in the agent receiver of Checkmk versions prior to 2.5.0p10 . An unauthenticated remote attacker can bypass mutual TLS (mTLS) client certificate verification on relay endpoints by supplying a fixed placeholder identity in the request URL....

CVE-2026-15576 Agent receiver accepts mTLS requests without a client certificate

Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and...

EUVD-2026-63903

Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and...

WordPress AI Agent by SiteGround plugin <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Media Upload via /generate-content REST Endpoint vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin SG AI Studio versions = 1.2.7...

CVE-2026-63046

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before...

CVE-2026-63046

Apache InLong (versions 2.0.0 through before 2.4.0) is affected by an argument injection vulnerability in the Agent Installer's ModuleManager component. The root cause is that ExcuteLinux.exeCmd() executes arbitrary shell commands with no filtering or whitelist validation , allowing an authentica...

EUVD-2026-63849

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before...

kestrel

Die Sichtbarkeit auf Kernel-Ebene von Falco, mit der Live-Oberfläche, die kernel-native Werkzeuge nicht mitbringen. Schnellstart · Spezifikation · Ansichten · Roadmap Kestrel verfolgt Kernel-Ereignisse Prozess-Exec, Dateizugriff, Netzwerkverbindungen mit einem eBPF -Agenten und streamt sie an ein...

jvmtiAgentLoad-Exploit

Esecuzione arbitraria di codice tramite jvmtiAgentLoad Descrizione: Strumenti e codice per generare un JAR dannoso per sfruttare jvmtiAgentLoad Utilizzo: root@kitploit: $ bash createjar.sh Usage: createjar.sh Supported TARGETOS options: linux|windows Target Linux Il seguente comando genera un JAR...

reternal-quickstart

RE:TERNAL Note: Still under development, only use for testing and do not expose interfaces! Current compose doesn't work yet, only try when you know what you're doing RE:TERNAL is a centralised purple team orchestration service to manage third-party C2 frameworks. Agents are installed on endpoint...

frida-fuzzer

Frida API Fuzzer v1.4 Copyright C 2020 Andrea Fioraldi [email protected] Released under the Apache License v2.0 This experimental fuzzer is meant to be used for API in-memory fuzzing. The design is highly inspired and based on AFL/AFL++. ATM the mutator is quite simple, just the AFL's havoc...