729264 matches found
CVE-2026-77521 MaxKB: Prompt-injectable agent can lead to command execution
MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupton, so human approval is not required...
EUVD-2026-84161
MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupton, so human approval is not required...
CVE-2026-79916 MaxKB AWS Bedrock model credential injection leads to remote code execution
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...
CVE-2026-79916
MaxKB is an open-source enterprise AI assistant. Prior to 2.10.5-lts , authenticated workspace members can inject control characters into the AWS Bedrock access_key_id and secret_access_key fields. The _update_aws_credentials function writes these values to /root/.aws/credentials without safe par...
EUVD-2026-84153
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...
CVE-2026-79916 MaxKB AWS Bedrock model credential injection leads to remote code execution
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...
CVE-2026-79916 MaxKB AWS Bedrock model credential injection leads to remote code execution
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...
CGA-937V-F4JG-878H
Bulletin has no description...
CGA-WM6G-M9PC-49C7
Bulletin has no description...
CGA-R688-XWRP-JFX2
Bulletin has no description...
CGA-86VX-PWMC-X25Q
Bulletin has no description...
CGA-2RHF-4HHR-2F4Q
Bulletin has no description...
CGA-PR58-XCGH-3H6J
Bulletin has no description...
CGA-WWJ3-VGQ8-X4F3
Bulletin has no description...
CGA-36VH-R7HP-VPVW
Bulletin has no description...
CGA-66GP-X35C-4H69
Bulletin has no description...
CGA-G3HR-PFG7-4XPM
Bulletin has no description...
CGA-XJ8X-RHH4-QQCC
Bulletin has no description...