3790 matches found
CVE-2026-48119: Missing Authorization
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.12, authenticated agents can forge service-monitor results for other users' services. This issue has been patched in version 2.0.12...
CVE-2026-49396: Cross-Site Request Forgery (CSRF)
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim's agents. This issue has been patched in version 2.0.14...
Incorrect Privilege Assignment
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Privilege Assignment due to the incorrect assignment of owner-scoped MCP loopback authority to hook-triggered agent processes. An attacker can perform unauthorized privileged...
MAL-2026-5563 Malicious code in @sentry-internal-sdk/profiling-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7951165844874f57819b0d63b8c8511e4e9217bf0f9231ec02f06cb6e059c47 Package name @sentry-internal-sdk/profiling-node impersonates the legitimate @sentry/profiling-node Sentry publishes under the @sentry org; no...
SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agents
Large language model LLM reviewers are increasingly used in pull-request PR workflows, where their approvals help decide which code is merged into a repository. This raises a question that benchmarks for static vulnerability detection or code generation do not address: can an automated reviewer...
CVE-2026-53469
A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments,...
CVE-2026-53469 Migration-planner: unprotected delete endpoint wipes all tenant data
A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments,...
CVE-2026-53469 Migration-planner: unprotected delete endpoint wipes all tenant data
A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments,...
KubeV2V Migration assessment 跨站脚本漏洞
The Migration Planner UI is an open-source migration planning front-end tool developed by KubeV2V. The Migration Planner UI has a cross-site scripting vulnerability. This vulnerability arises from the ability of attackers to register malicious discovery agents containing JavaScript code. When an...
MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents
External memory has become a core component of modern web agents, enabling long-horizon reasoning through the retrieval of past experiences. However, this paradigm introduces a critical vulnerability: malicious content injected into memory can be persistently recalled and repeatedly influence age...
llm-endpoint-vulnerability-poc
LLM Endpoint Vulnerability PoC A proof-of-concept for exposin...
EUVD-2026-34985
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. Affected by this issue is the function checkcmdexists of the file metagpt/utils/common.py. This manipulation of the argument mermaid.path causes command injection. The attack may be initiated remotely. A high degree of...
Data Agents under Attack: Vulnerabilities in LLM-Driven Analytical Systems
Data agents integrate LLM-driven reasoning with relational data access, executable analytical tools, and multi-step workflow orchestration, making them increasingly central to enterprise analytics. This integration introduces new security vulnerabilities across data resources, database execution,...
pantheon-agents (>=0.3.0, <=0.3.3), pantheon-cli (>=0.1.1, <=0.1.4) potentially affected by unknown CVE via pantheon-toolsets (0.5.4)
pantheon-toolsets PYPI version 0.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on pantheon-toolsets and may be impacted: - pantheon-agents =0.3.0, =0.1.1, =0.1.4 Source cves: unknown CVE Source advisory: SNYK:PYTHON-PANTHEONTOOLSETS-17220147...
pantheon-cli (>=0.1.1, <=0.1.4) potentially affected by unknown CVE via pantheon-agents (0.6.4)
pantheon-agents PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on pantheon-agents and may be impacted: - pantheon-cli =0.1.1, =0.1.4 Source cves: unknown CVE Source advisory: SNYK:PYTHON-PANTHEONAGENTS-17220146...
magique-ai (>=0.1.0, <=0.4.3), pantheon-agents (>=0.3.0, <=0.3.3) +2 more potentially affected by unknown CVE via magique (0.6.7)
magique PYPI version 0.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on magique and may be impacted: - magique-ai =0.1.0, =0.3.0, =0.1.1, =0.5.0, =0.5.4 Source cves: unknown CVE Source advisory: SNYK:PYTHON-MAGIQUE-17220140...
offensive-claude-533
Offensive Security Research Config for Claude Code !TIP...
offensive-claude-604
Offensive Security Research Config for Claude Code !TIP...