CVE-2026-96749 vulnerabilities

Vulnerabilities for packages: datadog-agent...

CVE-2026-88029 vulnerabilities

Vulnerabilities for packages: datadog-agent...

CLEANSTART-2026-CD04274 Security fix for GHSA-hrxh-6v49-42gf applied in: aws-network-policy-agent 1.2.7-r0, fabric-peer 3.1.5-r1, gotenberg 8.33.0-r0, step 0.30.2-r4, kube-state-metrics-fips 2.20.0-r4, eks-distro-kube-apiserver 1.36.8-r0, eks-distro-kube-apiserver-fips 1.36.8-r0

GHSA-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VX91878 SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read

Security vulnerability affects the external-dns package. SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read...

CLEANSTART-2026-KW79982 Security fix for GHSA-259r-337f-4rfw applied in: aws-network-policy-agent 1.1.6-r4, caddy 2.11.4-r1, fabric-peer 2.5.16-r2, fabric-peer 3.1.5-r1, gotenberg 8.33.0-r0, kubernetes-dns-node-cache 1.23.1-r2, step 0.30.2-r4

GHSA-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-107399: Exposure of Sensitive Information to an Unauthorized Actor

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

PT-2026-108019

Name of the Vulnerable Software and Affected Versions Checkmk versions 2.5.0 through 2.5.0p9 Description A local privilege escalation issue exists when the mk-oracle agent plugin is enabled. A user who has permissions to edit the Oracle Instant Client referenced by this plugin can escalate their...

KLA91325 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of...

CVE-2026-107322: Incomplete List of Disallowed Inputs

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent contex...

PT-2026-107835

The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile da...

pi-coding-agent-1.0.0-1.1 on GA media (moderate)

pi-coding-agent-1.0.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11967-1 Rating: moderate Cross-References: CVE-2026-102277 CVE-2026-102278 CVSS scores: CVE-2026-102277 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2026-102277 SUSE : 6.9...

PT-2026-108215

Name of the Vulnerable Software and Affected Versions Mechanize versions prior to 2.14.1 Description The Mechanize library, used for automating website interactions, contains an issue where the response redirect function in Mechanize::HTTP::Agent incorrectly identifies redirects as same-origin if...

CVE-2026-69435: Server-Side Request Forgery (SSRF)

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...

SUSE SLES12 Security Update : google-osconfig-agent (SUSE-SU-2026:4554-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4554-1 advisory. This update for google-osconfig-agent fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in...

Zabbix Server 7.0.x < 7.0.29 / 7.4.x < 7.4.13 Authentication Bypass (ZBX-28196)

The version of Zabbix Server installed on the remote host is 7.0.x prior to 7.0.29, or 7.4.x prior to 7.4.13. It is, therefore, affected by an authentication bypass vulnerability: - Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate...

Zabbix Proxy 7.0.x < 7.0.29 / 7.4.x < 7.4.13 Authentication Bypass (ZBX-28196)

The version of Zabbix Proxy installed on the remote host is 7.0.x prior to 7.0.29, or 7.4.x prior to 7.4.13. It is, therefore, affected by an authentication bypass vulnerability: - Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate...

PT-2026-108712

Name of the Vulnerable Software and Affected Versions praisonai version 4.6.62 Description An authentication bypass exists in the n8n/call agent invocation API when the PRAISONAI CALL AUTH=disabled setting is enabled. The system attempts to restrict this opt-out to localhost bindings by checking...

CVE-2026-107714: Exposure of Sensitive Information to an Unauthorized Actor

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

PT-2026-108142

Name of the Vulnerable Software and Affected Versions Amazon Agent Plugins for AWS databases-on-aws versions prior to 1.7.1 Description An incomplete list of disallowed inputs allows a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper. This...

CVE-2026-105196: Authorization Bypass Through User-Controlled Key

The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile da...