EUVD-2026-53712

A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegatetask Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The...

CVE-2026-18998 cosmicstack-labs mercury-agent delegate_task Tool sub-agent.ts SubAgent.run improper authorization

A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegatetask Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The...

CVE-2026-18997

A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorrect authorization. It is possible to initiate the attack...

CVE-2026-18997 cosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorization

A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorrect authorization. It is possible to initiate the attack...

CVE-2026-18993 NousResearch hermes-agent Memory Toolset model_tools.py access control

A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/modeltools.py of the component Memory Toolset. The manipulation results in improper access controls. The attack can be executed remotely. The explo...

CVE-2026-18325

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18991 nanocoai NanoClaw send_file core.ts path traversal

A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runner/src/mcp-tools/core.ts of the component sendfile. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been...

CVE-2026-18976

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function gettooldefinitions of the file agent/agentinit.py of the component disabledtoolsets Handler. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely. The explo...

CVE-2026-18990 letta-ai LettaBot API Status Route server.ts missing authentication

A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation results in missing authentication. The attack may be performed from remote. The exploit is now public and may be used. The...

CVE-2026-18990

CVE-2026-18990 affects letta-ai LettaBot 0.2.0. The issue concerns an unexplained vulnerability in the file src/api/server.ts of the API Status Route, resulting in missing authentication. Exploitation can be performed remotely, and public exploit code exists. Vendor was contacted but did not resp...

CVE-2026-18990 letta-ai LettaBot API Status Route server.ts missing authentication

A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation results in missing authentication. The attack may be performed from remote. The exploit is now public and may be used. The...

CVE-2026-18980

Affected software: nearai ironclaw (up to 0.29.1). Vulnerable component: function classify_command_risk in src/tools/builtin/shell.rs. Root cause: command injection due to manipulation of input handling. Impact: remote attack possibility; exploitation is publicly available (exploit maturity: PROO...

CVE-2026-18980 nearai ironclaw shell.rs classify_command_risk command injection

A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classifycommandrisk of the file src/tools/builtin/shell.rs. Such manipulation leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The name of...

EUVD-2026-53698

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function gettooldefinitions of the file agent/agentinit.py of the component disabledtoolsets Handler. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely. The explo...

ncentral-compromise-ioc-triage

N-central Compromise IoC Triage Read-only defensive hunting t...

PT-2026-68832

Name of the Vulnerable Software and Affected Versions Azure SQL Managed Instance affected versions not specified Description Improper restriction of the communication channel to intended endpoints allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment,...

CVE-2026-19067: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /treatment.php. Performing a manipulation of the argument editid results in sql injection. Remote exploitation of the attack is possible. The exploit has bee...

CVE-2026-19005: Improper Privilege Management

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the...

PT-2026-68408

Name of the Vulnerable Software and Affected Versions nanocoai NanoClaw versions prior to 2.0.65 Description Improper privilege management exists within the Child-Agent Creation component. The issue resides in the handleCreateAgent function located in the src/modules/agent-to-agent/create-agent.t...

EulerOS 2.0 SP13 : libxml2 (EulerOS-SA-2026-2980)

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatal...