@agor-live/opencode (>=0.24.0, <=0.26.3), @botpress/adk (>=1.19.0-beta.3, <=3.0.0-beta.6) +25 more potentially affected by unknown CVE via opencode-ai (>=1.14.33, <=1.18.16)

opencode-ai NPM version =1.14.33, =0.24.0, =1.19.0-beta.3, =1.19.0-beta.2, =0.2.0, =0.3.0-beta.1, =0.5.0, =0.22.0, =0.33.0, =2.0.10, =0.5.8, =0.1.10, =1.142.1-test.7, =0.0.1, =0.0.17 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0073...

Malicious code in @holocronlab/botruntime-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad15bd6ba410e0c0ca88ac22f1632a4b6707c4c66396c49c0ba90f906b19ae33 The package is published as a runtime for 'brt-built botruntime agents' and its client.d.ts describes the exported client as 'the authenticated...

MAL-2026-13419 Malicious code in @holocronlab/botruntime-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad15bd6ba410e0c0ca88ac22f1632a4b6707c4c66396c49c0ba90f906b19ae33 The package is published as a runtime for 'brt-built botruntime agents' and its client.d.ts describes the exported client as 'the authenticated...

Botpress Admin Panel - Detect

Botpress admin panel was detected. Botpress is an open-source conversational AI platform for building chatbots and virtual assistants. !/usr/bin/env python3 -- coding: utf-8 -- """Botpress admin panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

CVE-2026-4984 Botpress - Credential Disclosure via Twilio Webhook Handler

The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, it fetches user-controlled URLs 'MediaUrlN' parameters using HTTP requests that include the integration's Twilio credentials in the 'Authorization'...

CVE-2026-4984 Botpress - Credential Disclosure via Twilio Webhook Handler

The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, it fetches user-controlled URLs 'MediaUrlN' parameters using HTTP requests that include the integration's Twilio credentials in the 'Authorization'...

CVE-2026-4984

CVE-2026-4984 affects Botpress’s Twilio integration webhook handler. The vulnerability arises because the webhook accepts POST requests without validating Twilio’s X-Twilio-Signature, and when processing media messages it fetches user-controlled URLs (MediaUrlN) via HTTP requests that include the...

BentoML Detected

This is an informational plugin to inform the user that the scanner has detected a publicly accessible BentoML instance on the target application. BentoML is an open-source inference platform. This detection is included in the AI and LLM category. No source data...

Botpress Chatbot Detected

This is an informational plugin to inform the user that the scanner has detected a publicly accessible Botpress chatbot on the target application. Botpress is an open-source visual framework to build & deploy GPT/LLM Agents. This detection is included in the AI and LLM category. No source data...