20160 matches found
The vulnerability of the collectConfigEnvVars() function in the OpenClaw AI agent (previously known as ClawdBot or MoltBot) allows a violator to execute arbitrary code.
The vulnerability of the collectConfigEnvVars function in the OpenClaw AI agent previously known as ClawdBot or MoltBot is related to errors in system configuration or settings. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
Medium: polkit
Issue Overview: A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the polkit-agent-helper-1 setuid binary via standard input stdin. This unbounded input can lead to an out-of-memory OOM condition, resulting in a Denial of Service...
EUVD-2026-21744
A vulnerability was detected in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects an unknown function of the component Agent Mode Service. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The...
CVE-2026-6129
The CVE-2026-6129 entry concerns zhayujie chatgpt-on-wechat CowAgent up to version 2.0.4. The vulnerability affects the Agent Mode Service component, with root cause described as a manipulation that results in missing authentication. Attack requires no privileges and can be initiated remotely ove...
CVE-2026-6129 zhayujie chatgpt-on-wechat CowAgent Agent Mode Service missing authentication
A vulnerability was detected in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects an unknown function of the component Agent Mode Service. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The...
CVE-2026-6129 zhayujie chatgpt-on-wechat CowAgent Agent Mode Service missing authentication
A vulnerability was detected in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects an unknown function of the component Agent Mode Service. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The...
CVE-2026-6129 zhayujie chatgpt-on-wechat CowAgent Agent Mode Service missing authentication
A vulnerability was detected in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects an unknown function of the component Agent Mode Service. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The...
EUVD-2026-21730
A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.0.4. The affected element is an unknown function of the component Administrative HTTP Endpoint. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been made...
CowAgent 访问控制错误漏洞
CowAgent is an intelligent assistant and scalable agent framework developed by zhayujie’s individual developer. Versions of CowAgent 2.0.4 and earlier contained a security vulnerability related to access control. This vulnerability stemmed from the absence of authentication in the Agent Mode...
CVE-2026-32282 vulnerabilities
Vulnerabilities for packages: aws-flb-kinesis, coredns, gitlab-kas, fscrypt, zot, fuse-overlayfs-snapshotter, snyk-cli, cert-manager, prometheus, dask-gateway, karpenter, cloud-provider-aws, nerdctl, newrelic-fluent-bit-output, redka, istio, argo-cd, hubble, kots, kubernetes, go, kine, gitaly,...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: direnv, x509-certificate-exporter, docker-credential-gcr, fscrypt, witness, spire-controller-manager, snyk-cli, ytt, kube-state-metrics, grafana-agent-operator, sftpgo-plugin-auth, hubble, stakater-reloader, kubeflow, vale, secrets-store-csi-driver-provider-aws,...
GHSA-7MR4-XJXG-34G6 vulnerabilities
Vulnerabilities for packages: knative-client, kubernetes-event-exporter, jitsucom-bulker, spqr, x509-certificate-exporter, docker-credential-gcr, promxy, fscrypt, witness, juicefs-csi-driver, dapr, fuse-overlayfs-snapshotter, goreleaser, snyk-cli, spire-controller-manager, dask-gateway,...
CVE-2026-32288 vulnerabilities
Vulnerabilities for packages: crossplane, nerdctl, kube-arangodb, licenseclassifier, jaeger, nuclei, kube-fluentd-operator, vault-secrets-operator, buf, helm, splunk-otel-collector, tofu-controller-fips, aws-flb-firehose-fips, runc, kube-state-metrics, spegel-fips, fscrypt, apko-fips,...
GHSA-X4JJ-H2V8-HQQV vulnerabilities
Vulnerabilities for packages: crossplane, nerdctl, kube-arangodb, licenseclassifier, jaeger, nuclei, kube-fluentd-operator, vault-secrets-operator, buf, helm, splunk-otel-collector, tofu-controller-fips, aws-flb-firehose-fips, runc, kube-state-metrics, spegel-fips, fscrypt, apko-fips,...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: crossplane, crossplane-function-environment-configs-fips, memcached-exporter-fips, nerdctl, nri-haproxy-fips, cloud-provider-vsphere, apisix-ingress-controller, nrdot-collector-k8s-fips, cue-fips, kube-arangodb, esbuild-fips, nri-f5, spiffe-helper-fips, falco-exporte...
GHSA-5W89-2C2X-6X66 vulnerabilities
Vulnerabilities for packages: nri-haproxy-fips, jaeger, wuzz, ginkgo, addon-resizer-fips, google-cloud-otel-ops-collector, go-discover, crossplane-provider-aws-cognitoidp, tofu-controller-fips, rancher-system-upgrade-controller, kyverno-policy-reporter-fips, spegel-fips,...
CVE-2026-39889
PraisonAI is a multi-agent teams system. Prior to 4.5.115, the A2U Agent-to-User event stream server in PraisonAI exposes all agent activity without authentication. The createa2uroutes function registers the following endpoints with NO authentication checks: /a2u/info, /a2u/subscribe,...
GHSA-X462-JJPC-Q4Q4 PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint
Summary The AGUI endpoint POST /agui has no authentication and hardcodes Access-Control-Allow-Origin: on all responses. Combined with Starlette/FastAPI's Content-Type-agnostic JSON parsing, any website a victim visits can silently trigger arbitrary agent execution against a locally-running AGUI...
GHSA-PM96-6XPR-978X PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS
Summary The AgentOS deployment platform exposes a GET /api/agents endpoint that returns agent names, roles, and the first 100 characters of agent system instructions to any unauthenticated caller. The AgentOS FastAPI application has no authentication middleware, no API key validation, and default...