14 matches found
CVE-2026-115718
Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improveprompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improveprompt API to leverage the site owner's...
CVE-2026-115718
Frappe Builder versions 1.33.0 before 1.36.0 are susceptible to a missing authorization vulnerability within the improve_prompt endpoint. This flaw allows any authenticated non-Guest session to bypass permission checks and invoke LLM completions. By calling the improve_prompt API, an attacker can...
EUVD-2026-109780
Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improveprompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improveprompt API to leverage the site owner's...
CVE-2026-115718 Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt
Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improveprompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improveprompt API to leverage the site owner's...
PT-2026-123287
Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improve prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improve prompt API to leverage the site owner...
invoice-ocr-poc
invoice-ocr-poc Proof of concept HTTP API: upload a receipt i...
Malicious code in zyr-agent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6dd19313881a0bcfd90734ce897e3134af348bce2b7447eaf4e5dbc910f432c zyr-agent ships an AI coding agent whose default 'free' provider routes chat completions to a hardcoded preview-slug endpoint at...
MAL-2026-13471 Malicious code in zyr-agent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6dd19313881a0bcfd90734ce897e3134af348bce2b7447eaf4e5dbc910f432c zyr-agent ships an AI coding agent whose default 'free' provider routes chat completions to a hardcoded preview-slug endpoint at...
Malicious code in @jemavidev/betteragents-pi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b6e1a3902ad5cc75204b7a6eea3727c6a6c31797d7cfd7a0cd12a64892887bd The package brands itself as an OpenRouter LLM extension and instructs users to obtain a key with the canonical sk-or-v1- prefix from...
MAL-2026-4397 Malicious code in @jemavidev/betteragents-pi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b6e1a3902ad5cc75204b7a6eea3727c6a6c31797d7cfd7a0cd12a64892887bd The package brands itself as an OpenRouter LLM extension and instructs users to obtain a key with the canonical sk-or-v1- prefix from...
CVE-2026-3788 Bytedesk SpringAIOpenrouterRestController SpringAIOpenrouterRestService.java getModels server-side request forgery
A security vulnerability has been detected in Bytedesk up to 1.3.9. This impacts the function getModels of the file source-code/src/main/java/com/bytedesk/ai/springai/providers/openrouter/SpringAIOpenrouterRestService.java of the component SpringAIOpenrouterRestController. Such manipulation of th...
CVE-2026-3788 Bytedesk SpringAIOpenrouterRestController SpringAIOpenrouterRestService.java getModels server-side request forgery
A security vulnerability has been detected in Bytedesk up to 1.3.9. This impacts the function getModels of the file source-code/src/main/java/com/bytedesk/ai/springai/providers/openrouter/SpringAIOpenrouterRestService.java of the component SpringAIOpenrouterRestController. Such manipulation of th...
CVE-2026-3788 Bytedesk SpringAIOpenrouterRestController SpringAIOpenrouterRestService.java getModels server-side request forgery
A security vulnerability has been detected in Bytedesk up to 1.3.9. This impacts the function getModels of the file source-code/src/main/java/com/bytedesk/ai/springai/providers/openrouter/SpringAIOpenrouterRestService.java of the component SpringAIOpenrouterRestController. Such manipulation of th...
CVE-2026-3788
A security vulnerability has been detected in Bytedesk up to 1.3.9. This impacts the function getModels of the file source-code/src/main/java/com/bytedesk/ai/springai/providers/openrouter/SpringAIOpenrouterRestService.java of the component SpringAIOpenrouterRestController. Such manipulation of th...