osiris

⬡ OSIRIS Open Source Intelligence & Reconnaissance Integrated System A real-time global intelligence dashboard that aggregates live flight tracking, CCTV networks, earthquake monitoring, conflict zone mapping, and 24/7 news feeds into a single GPU-accelerated interface. Live Demo · Report Bug ·...

gitea-restore-file-open

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · gitea-restore-file-open Write-up: https://abraxaslabs.tech/research/gitea-restore-file-open gitea-restore-file-open Gitea 1.27.3 - Gitea CVE-2026-59765 put a hostmatcher HTTP client on OpenWithClient. The file://...

PYSEC-2026-4010 Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit

The /v1/chat/agents/agentid/edit endpoint in local-operator versions before 0.47.5 resolves the caller-supplied filepath with expanduser.resolve and reads it without checking that it lies inside the agent's workspace. An unauthenticated client with network access to the API can supply an absolute...

Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit

The /v1/chat/agents/agentid/edit endpoint in local-operator versions before 0.47.5 resolves the caller-supplied filepath with expanduser.resolve and reads it without checking that it lies inside the agent's workspace. An unauthenticated client with network access to the API can supply an absolute...

Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator

The /v1/agents/import endpoint and AgentRegistry.importagent in local-operator versions before 0.47.5 trust the id field inside agent.yml of an uploaded agent profile archive when constructing the destination directory. A crafted id containing directory traversal sequences makes shutil.rmtree and...

PYSEC-2026-4009 Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator

The /v1/agents/import endpoint and AgentRegistry.importagent in local-operator versions before 0.47.5 trust the id field inside agent.yml of an uploaded agent profile archive when constructing the destination directory. A crafted id containing directory traversal sequences makes shutil.rmtree and...

PT-2026-105771

The /v1/chat/agents/agent id/edit endpoint in local-operator versions before 0.47.5 resolves the caller-supplied file path with expanduser.resolve and reads it without checking that it lies inside the agent's workspace. An unauthenticated client with network access to the API can supply an absolu...

PT-2026-105770

The /v1/agents/import endpoint and AgentRegistry.import agent in local-operator versions before 0.47.5 trust the id field inside agent.yml of an uploaded agent profile archive when constructing the destination directory. A crafted id containing directory traversal sequences makes shutil.rmtree an...

actbench (0.0.1a5), browser-use (>=0.1.42, <=0.2.5) +4 more potentially affected by CVE-2026-31245 via mem0ai (0.1.93)

mem0ai PYPI version 0.1.93 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - actbench 0.0.1a5 - browser-use =0.1.42, =0.1.13, =0.1.7, =0.1.3, =0.1.48, =0.2.2 Source cves: CVE-2026-31245 Source advisory: OSV:PYSEC-2026-2633...

actbench (0.0.1a5), browser-use (>=0.1.42, <=0.2.5) +4 more potentially affected by CVE-2026-31245 via mem0ai (0.1.93)

mem0ai PYPI version 0.1.93 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - actbench 0.0.1a5 - browser-use =0.1.42, =0.1.13, =0.1.7, =0.1.3, =0.1.48, =0.2.2 Source cves: CVE-2026-31245 Source advisory: OSV:GHSA-CGX8-QGVR-F7...

actbench (0.0.1a5), browser-use (>=0.1.42, <=0.2.5) +4 more potentially affected by CVE-2026-31240 via mem0ai (0.1.93)

mem0ai PYPI version 0.1.93 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - actbench 0.0.1a5 - browser-use =0.1.42, =0.1.13, =0.1.7, =0.1.3, =0.1.48, =0.2.2 Source cves: CVE-2026-31240 Source advisory: OSV:GHSA-JFV9-68M5-GJ...