EUVD-2026-117121

Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows attackers to write files outside the workspace via dangling symlinks. Attackers supplying a malicious repository can use prompt injection to make the write or edit tools follow...

CVE-2026-122235

The Jan application (versions 0.8.5 through 0.8.7 ) contains a workspace guard bypass vulnerability in the agent-tools gate.rs component. This flaw allows attackers to perform Improper Link Resolution Before File Access (CWE-59) by utilizing dangling symlinks . By providing a malicious repository...

CVE-2026-118038 Path Traversal in Telerik Document Processing Libraries AI Agent Tools

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments to read files outside the configured output directory, and to...

PT-2026-128220

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments to read files outside the configured output directory, and to...

CVE-2026-118038: Progress Software Telerik Document Processing Libraries: In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the…

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments to read files outside the configured output directory, and to...

CVE-2026-107292

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.toweb and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a...

GO-2026-6657 SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF) in github.com/siyuan-note/siyuan/kernel

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU Bypass of CheckHostSSRF in github.com/siyuan-note/siyuan/kernel...

ai.hyacinth.framework:core-service-bus-support (>=0.5.0, <=0.5.24), ai.platon.pulsar:browser4-agent-tools (>=4.13.5, <=4.14.3) +3418 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (>=5.0.0, <=5.36.0)

com.rabbitmq:amqp-client MAVEN version =5.0.0, =0.5.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.3 and more Source cves: CVE-2026-106121 Source advisory: MEND:CVE-2026-106121...

CVE-2026-51870

DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute...

PT-2026-103618

Name of the Vulnerable Software and Affected Versions DeepTutor version 1.4.0 Description An OS command injection issue exists in the execute function within the /tutorbot/agent/tools/shell.py:ExecTool component, allowing for remote command execution. Recommendations At the moment, there is no...

CVE-2026-51870

DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute...

EUVD-2026-78394

PraisonAI is a multi-agent teams system. From 1.6.0 until 1.7.2, AgentOS in src/praisonai-ts/src/os/agentos.ts uses the 0.0.0.0 default from src/praisonai-ts/src/os/config.ts and registers GET /api/agents and POST /api/chat without authentication middleware. A remote caller who can reach the...

CVE-2026-90809

A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. T...

CVE-2026-90808

A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name:...

CVE-2026-90809: Improper Neutralization of Argument Delimiters in a Command

A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. T...

CVE-2026-90808: Incomplete List of Disallowed Inputs

A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name:...

PYSEC-2026-3888 PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

Summary PraisonAI's praisonai.code tool wrappers exported as CODETOOLS for agents expose a workspace setting that the module itself treats as a path-traversal security boundary — readfile, writefile, applydiff, and searchreplace explicitly call ispathwithindirectory and return "… is outside the...

CVE-2026-84427

A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed an...

CVE-2026-84427: Improper Resource Shutdown or Release

A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed an...

CVE-2026-82234 SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU

SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the httprequest and webfetch agent tools that perform DNS resolution only at guard time without validating the connect-time resolution. Attackers can use DNS rebinding to answer the guard resolution with a public...