CVE-2026-51914

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, saveagentastemplate and publishtemplate in superagi/controllers/agenttemplate.py accept caller-supplied agentid or agentexecutionid values and do not verif...

CVE-2026-51901

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoi...

CVE-2026-51901

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoi...

CVE-2026-51914

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, saveagentastemplate and publishtemplate in superagi/controllers/agenttemplate.py accept caller-supplied agentid or agentexecutionid values and do not verif...

EUVD-2026-91703

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoi...

CVE-2026-51901: Undefined Security Weakness

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoi...

CVE-2026-51914

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control within the agent template controller. The functions save_agent_as_template and publish_template in superagi/controllers/agent_template.py accept caller-supplied agent_id or agent_execution_id values without verifying if...

CVE-2026-51901

SuperAGI (versions up to 0.0.14 ) is vulnerable to an Incorrect Access Control issue (CWE-284) within the agent execution controller. The /api/agentexecutions/schedule endpoint fails to validate that an agent_id belongs to the authenticated user's organization. This allows authenticated users to ...

CVE-2026-51901

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoi...

CVE-2026-51914

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, saveagentastemplate and publishtemplate in superagi/controllers/agenttemplate.py accept caller-supplied agentid or agentexecutionid values and do not verif...

EUVD-2026-91759

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, saveagentastemplate and publishtemplate in superagi/controllers/agenttemplate.py accept caller-supplied agentid or agentexecutionid values and do not verif...

CVE-2026-51904

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, createagentexecution and createagentrun in superagi/controllers/agentexecution.py accept a caller-supplied agentid and fail to verify that the referenced agent...

CVE-2026-51904

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, createagentexecution and createagentrun in superagi/controllers/agentexecution.py accept a caller-supplied agentid and fail to verify that the referenced agent...

CVE-2026-50141: Authentication Bypass by Spoofing

Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged agentid value into outgoing gRPC metadata. The server correctl...

EUVD-2026-23791

A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function deleteagent/stopschedule/getscheduledata of the file superagi/controllers/agent.py. The manipulation of the argument agentid leads to authorization bypass. The attack is possible to be carried out...

CVE-2026-6613

The affected software is TransformerOptimus SuperAGI (up to 0.0.14). The vulnerability exists in the functions delete_agent, stop_schedule, and get_schedule_data in superagi/controllers/agent.py, where manipulating the argument agent_id leads to an authorization bypass. It can be exploited remote...

CVE-2026-6613: Authorization Bypass Through User-Controlled Key

A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function deleteagent/stopschedule/getscheduledata of the file superagi/controllers/agent.py. The manipulation of the argument agentid leads to authorization bypass. The attack is possible to be carried out...

CVE-2025-8135: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, has been found in itsourcecode Insurance Management System 1.0. This issue affects some unknown processing of the file /updateAgent.php. The manipulation of the argument agentid leads to sql injection. The attack may be initiated remotely. The...

CVE-2025-7212

A vulnerability was found in itsourcecode Insurance Management System up to 1.0. It has been rated as critical. This issue affects some unknown processing of the file /insertAgent.php. The manipulation of the argument agentid leads to sql injection. The attack may be initiated remotely. The explo...

CVE-2025-7212: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in itsourcecode Insurance Management System up to 1.0. It has been rated as critical. This issue affects some unknown processing of the file /insertAgent.php. The manipulation of the argument agentid leads to sql injection. The attack may be initiated remotely. The explo...