agent-vault-proxy v1.1.1

Keys on the Wire Your AI agent never holds your API keys. It sends a placeholder; the real secret is swapped in on the wire. Stops credential stealers Shai-Hulud and similar and prompt-injected agents from leaking your secrets. A compromised agent has nothing to take. How it works 1. Your agent...

agent-scan v0.6.1

Snyk Agent Scan Discover and scan agent components on your machine for prompt injections and vulnerabilities including agents, MCP servers, skills. Note: We don't publish an npm package for Agent Scan. Install it via uvx or as a standalone binary. Note: CLI output is experimental and subject to...

agentic-dm-gateway — Updated!

Agentic DM Gateway Security control plane for LLM agents over private chat typically Discord DMs. It sits in front of your agent. It decides who may talk, whether the session is unlocked, whether the process is paused, and whether this message is safe enough to forward. Your model and tools stay...

GO-2026-6305 Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none in github.com/pocket-id/pocket-id/backend

Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirecturi with prompt=none in github.com/pocket-id/pocket-id/backend. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this ...

DRUPAL-CONTRIB-2026-119

This AI Chatbot module enables you to have a Chatbot using assistants to help you with your Drupal website. The module doesn't sufficiently sanitize for cross site scripting XSS when using the structured results using legacy agent setups. This vulnerability is mitigated by the fact that an attack...

Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

Summary DirectoryPromptRegistry.set interpolates the attacker-controllable Prompt.name into a Path expression with no canonicalization. An application that derives the prompt name from request data lets a caller write attacker-controlled bytes outside the configured registry directory. Details...

EUVD-2026-69700

A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acpadapter/session.py of the component ACP Prompt Workflow. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has...

bromure agentic-coding-v4.6.0

Bromure Secure, ephemeral computing in disposable Linux VMs on macOS. → Full details, screenshots, and downloads at bromure.io This repo ships two sibling apps, both built on Apple's Virtualization.framework: Bromure — every browser session runs in a throwaway Linux VM. Close the window, the VM i...

CVE-2026-84288

A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acpadapter/session.py of the component ACP Prompt Workflow. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has...

CVE-2026-84288 NousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of service

A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acpadapter/session.py of the component ACP Prompt Workflow. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has...

CVE-2026-84288 NousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of service

A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acpadapter/session.py of the component ACP Prompt Workflow. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has...

CVE-2026-84288

NousResearch hermes-agent (up to version 0.18.2) contains a denial of service vulnerability in the HermesACPAgent.prompt function located in acp_adapter/session.py (ACP Prompt Workflow component). The attack can be performed remotely with low privileges and no user interaction required. A proof-o...

CVE-2026-16675

A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with Windows...

beelzebub v3.9.1

Beelzebub Deception Runtime Framework Beelzebub is an open-source deception runtime that deploys adaptive, LLM-powered decoy services across SSH, HTTP, TCP, TELNET, and MCP protocols. It goes beyond passive honeypots by actively engaging attackers in realistic interactions, collecting high-fideli...

CVE-2026-16675 Rockwell Automation FactoryTalk® Activation Manager - Privilege Escalation

A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with Windows...

PT-2026-84515

Name of the Vulnerable Software and Affected Versions hermes-agent versions prior to 0.18.3 Description A remote denial of service issue exists within the ACP Prompt Workflow component. The flaw is located in the HermesACPAgent.prompt function within the acp adapter/session.py file, where imprope...

Codeium Windsurf Path Traversal Vulnerability (CVE-2025-62353)

The version of Windsurf installed on the remote host is affected by a path traversal vulnerability: - A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write arbitrary local files in and outside of current projects on an end user's system. The...

CVE-2026-84288: Improper Resource Shutdown or Release

A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acpadapter/session.py of the component ACP Prompt Workflow. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has...

CVE-2026-79745

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

EUVD-2026-68689

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...