CVE-2026-19009 TinyAGI Message API Endpoint response.ts collectFiles file inclusion

A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core/src/response.ts of the component Message API Endpoint. This manipulation causes file inclusion. The attack can be initiated remotely. The exploit has been made available to the...

CVE-2026-19009 TinyAGI Message API Endpoint response.ts collectFiles file inclusion

A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core/src/response.ts of the component Message API Endpoint. This manipulation causes file inclusion. The attack can be initiated remotely. The exploit has been made available to the...

EUVD-2026-53767

A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core/src/response.ts of the component Message API Endpoint. This manipulation causes file inclusion. The attack can be initiated remotely. The exploit has been made available to the...

CVE-2026-11588

The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts...

opencode v1.18.14

The open source AI coding agent. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Installation root@kitploit: YOLO curl -fsSL...

EUVD-2025-210623

SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the...

RLSA-2026:49838 Important: osbuild-composer security, bug fix, and enhancement update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: crypto/x50...

PT-2026-68628

Name of the Vulnerable Software and Affected Versions Packetfence version 13.2.0 Description The WebGui interface setting allows an authenticated user to perform remote code execution, which is the ability to execute arbitrary commands on the host machine. Recommendations At the moment, there is ...

Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture

AI agents performing cryptographic operations signing Git commits, authenticating API calls, issuing certificates currently store private keys in software-accessible locations: plaintext files, environment variables, or container memory. Any process with sufficient read privileges can extract the...

Joern 4.0.597

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

KLA91193 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Azure Service Bus can be exploited...

ALSA-2026:51035 Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: futex: Fix UaF between futexkeytonodeopt and vmareplacepolicy CVE-2026-23415 kernel: netfilter: nfnetlinkcthelper: fix OOB read in nfnlcthelperdumptable CVE-2026-43450 Bug Fixes and...

CVE-2024-39024

In Packetfence 13.2.0 , an authenticated remote code execution (RCE) vulnerability exists within the WebGui interface setting. The root cause is located in Interface.pm at line 64 within the create function, where the $vlan_id variable—derived from user input—is only validated on the client side....

CVE-2024-39024

In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution...

EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-2971)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : USB: core: Limit the length of unkillable synchronous timeoutsCVE-2026-43428 usb: typec: ucsi: validate connector number in...

JetBrains TeamCity Command Execution

The vulnerability of the web interface of the CI/CD application integration and delivery system JetBrains TeamCity is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to bypass existing security measures and execute arbitrary operati...

PT-2026-68577

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.11 Description Broken access control exists within the subscriber role, allowing unauthorized access or actions within the administrative interface. Recommendations Update to a version newer...

Views Component Spear Phishing

The vulnerability of the Views component in Google Chrome and Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow an attacker to perform spear-phishing attacks remotely...

ALSA-2026:51153 Important: gpsd-minimal security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. The AlmaLinux support for this package is limited...

SUSE SLES15: libpcp-devel / libpcp3 / libpcp_gui2 / libpcp_import1 / libpcp_mmv1 / etc (SUSE-SU-2026:3505-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3505-1 advisory. - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. - CVE-2026-16526: pmdaroot...