19525 matches found
CVE-2026-12496
Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...
EUVD-2026-48589
Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...
ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
Cybersecurity researchers have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence AI agent inside a victim's organization. The vulnerability has bee...
Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry
Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection. The agent then worked through the ministry's...
CVE-2026-14172
Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential Scan Engine or as root/SYSTEM Insight Agent. Fixed in Scan Engine content...
CVE-2026-14172 Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation
Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential Scan Engine or as root/SYSTEM Insight Agent. Fixed in Scan Engine content...
EUVD-2026-48487
Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential Scan Engine or as root/SYSTEM Insight Agent. Fixed in Scan Engine content...
CVE-2026-14172
CVE-2026-14172 affects Rapid7 InsightVM, Nexpose, and the Insight Agent. The issue allows a local, low-privilege user to execute discovered executables during authenticated assessments due to lack of file ownership validation, enabling code execution as the scan credential (Scan Engine) or as roo...
CVE-2026-66138
In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntpserver is passed to a shell...
CVE-2026-54422
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...
DEBIAN-CVE-2026-54422
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...
UBUNTU-CVE-2026-66138
In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntpserver is passed to a shell...
UBUNTU-CVE-2026-54422
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...
CVE-2026-66138
In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntpserver is passed to a shell...
CVE-2026-66138
OpenStack Ironic Python Agent (up to 11.6.0) is affected. A project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent by supplying a malicious configuration that causes the ntp_server value to be passed to a shell. The vulnerability allows rem...
CVE-2026-66138
In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntpserver is passed to a shell...
EUVD-2026-48476
In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntpserver is passed to a shell...
CVE-2026-54422
CVE-2026-54422 affects OpenStack Ironic Python Agent up to and including 11.5.0. A malicious boot container deployed via ironic-python-agent can extract the credentials used to download it, enabling credential disclosure on a local attacker. The CVSS metrics indicate a LOCAL attack vector with HI...
CVE-2026-54422
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...