CVE-2026-51853: Improper Limitation of a Pathname to a Restricted Directory

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.init. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction...

CVE-2026-51866

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...

CVE-2026-51870

DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute...

PT-2026-103618

Name of the Vulnerable Software and Affected Versions DeepTutor version 1.4.0 Description An OS command injection issue exists in the execute function within the /tutorbot/agent/tools/shell.py:ExecTool component, allowing for remote command execution. Recommendations At the moment, there is no...

PT-2026-103603

Name of the Vulnerable Software and Affected Versions agent-zero versions 1.7 through 1.10 Description A directory traversal issue exists in the FileBrowser. init function within the python/helpers/file browser.py file. The FileBrowser class initializes using the host root directory as the...

CVE-2026-51853

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.init. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction...

EUVD-2026-90425

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.init. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction...

CVE-2026-51853

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.init. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction...

CVE-2026-51853

Versions 1.7, 1.8, 1.9, and 1.10 of agent-zero are vulnerable to a Directory Traversal flaw in python/helpers/file_browser.py:FileBrowser.__init__. The vulnerability exists because the FileBrowser class initializes with the host root directory as the workspace, granting the agent unrestricted acc...

EUVD-2026-90416

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...

pi-coding-agent-0.87.1-1.1 on GA media (moderate)

pi-coding-agent-0.87.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11884-1 Rating: moderate Cross-References: CVE-2026-84933 CVE-2026-84947 CVE-2026-84961 CVSS scores: CVE-2026-84933 SUSE : 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CVE-2026-84933 SUSE : 8.3...

CVE-2026-13224: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request...

CVE-2026-97347: Improper Neutralization of Input During Web Page Generation

The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-103470

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT SECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py,...

PT-2026-103310

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18991 Description Stored HTML injection is possible through the User-Agent header. Recommendations Update to version 2026.2.18991...

PT-2026-103615

Name of the Vulnerable Software and Affected Versions DB-GPT versions 0.7.5 through 0.8.0 Description A code injection issue exists where a skill uploaded via the '/api/v1/skills/upload' endpoint can subsequently be executed through the '/api/v1/chat/react-agent' flow. Recommendations At the...

EUVD-2026-90426

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.savefileb64. The savefileb64 method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks...

ABSENTIA: Detecting Broken Access Control Vulnerabilities in Web Applications

Broken access control, the failure of authorization, is one of the most prevalent web security risks. Unlike injection, a flow of untrusted input into a dangerous operation, authorization is a relation: who may act on what, not how data moves. Each application decides that relation for itself, so...

Aletheia: Permission-Minimality Testing for Coding-Agent Rules

Repository instruction files guide coding agents, but also expose them to prompt injection. Malicious rules can request credential access or data transfer while the agent produces a correct patch. We present Aletheia, a framework for permission-minimality testing. Aletheia translates requested...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1771663697)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1771663697 advisory. - When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL th...