CVE-2026-110616 NullHub through 2026.5.29 Missing Authentication for /api Management API

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ management API because the authtoken field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback...

EUVD-2026-101244

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ management API because the authtoken field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback...

CVE-2026-110616

NullHub versions through 2026.5.29 are vulnerable to a missing authentication flaw in the */api/ management API. The root cause is that the auth_token field defaults to null and is never assigned, allowing unauthenticated attackers to access the API by sending requests without Authorization or Or...

CVE-2026-110652 ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in...

CVE-2026-110652 ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in...

CVE-2026-110652 ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in...

CVE-2026-110652

ONLYOFFICE DocumentServer before version 10.0.0 is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) in the /downloadfile/:docid endpoint. The vulnerability occurs when JWT verification is disabled in the default configuration, allowing attackers to exploit the isInJwtToken flag...

CVE-2026-54520

CVE-2026-54520 ai-agent-automation workflow file step path traversal allowed read/write outside the expected directory. Primary advisory: GHSA-cm8g-8jfq-887p Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54520 GHSA| GHSA-cm8g-8jfq-887p Project|...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation missing ownership checks in memory APIs allowed cross-user memory read and deletion. Primary advisory: GHSA-qv97-83w4-ff86 Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 Project|...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana within Instana Agent container image build 1.0.327 Vulnerability Details CVEID:CVE-2026-17508 DESCRIPTION: In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with...

Security update for amazon-cloudwatch-agent

This update for amazon-cloudwatch-agent fixes the following issue: CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index validation and cause a process crash bsc1283594. Changes for amazon-cloudwatch-agent: Update to version...

SUSE-SU-2026:4662-1 Security update for amazon-cloudwatch-agent

This update for amazon-cloudwatch-agent fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index validation and cause a process crash bsc1283594. Changes for amazon-cloudwatch-agent: Update to versi...

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issue: CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index validation and cause a process crash bsc1283672. Changes for google-osconfig-agent: Update to version...

SUSE-SU-2026:4661-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index validation and cause a process crash bsc1283672. Changes for google-osconfig-agent: Update to version...

CVE-2023-22496-PoC

CVE-2023-22496 — Netdata Agent OS Command Injection PoC Severity : Critical CVSS 9.8 Affected : Netdata Agent Fixed in : v1.37.0 Type : OS Command Injection CWE-78 Overview CVE-2023-22496 is an OS command injection vulnerability in Netdata's health alarm notification system. The registryhostname ...

CVE-2026-55797 vulnerabilities

Vulnerabilities for packages: argocd-agent, argocd-operator...

GHSA-J6CW-G6P4-7HCH vulnerabilities

Vulnerabilities for packages: argocd-agent, argocd-operator...

CVE-2026-107171

An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users...

log4j-vulnerability-patcher-agent

log4j-vulnerability-patcher-agent This agent fixes critical vulnerability CVE-2021-44228 in log4j by patching JndiLookup class, as recommended here. WARNING: this is not a substitute for proper upgrade to log4j 2.15.0 , where this vulnerability was fixed for good. Use this agent IF, and ONLY IF,...

CVE-2026-107171

A Hardcoded Cryptographic Key vulnerability exists in Trellix Agent 5.8.4 within the mfecryptc.dll component. This flaw allows Regular Users to perform Database Decryption , leading to a high impact on confidentiality. No specific remediation or exploit information is provided in the documents.