Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers

Cybersecurity researchers have disclosed details of a vulnerability in Amazon Kiro, an artificial intelligence AI-powered, agentic integrated development environment IDE, that could facilitate data exfiltration via prompt injection and Kiro Powers. The security flaw, which does not have a CVE...

CVE-2026-71492

A flaw was found in Banks. The DirectoryPromptRegistry.set function improperly handles attacker-controlled Prompt.name and Prompt.version values. This allows for path traversal, enabling an attacker to write arbitrary files outside the intended registry root. This vulnerability could lead to...

tryhackme-ctf-writeups

TryHackMe Write-Ups Thirteen rooms, solved and then explain...

CVE-2026-37003

Agno versions up to and including 2.5.8 are vulnerable to Remote Code Execution (RCE) via prompt injection . The issue stems from the PythonTools and ShellTools components, which pass unsanitized, LLM-generated arguments directly to execution sinks such as exec() , runpy.run_path() , and subproce...

CVE-2026-37003

Agno up to and including 2.5.8 is vulnerable to Remote Code Execution RCE via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec, runpy.runpath, and subprocess.run. An unauthenticated attacker can exploi...

PT-2026-82661

Name of the Vulnerable Software and Affected Versions Agno versions prior to 2.5.9 Description Remote Code Execution RCE is possible via prompt injection. The PythonTools and ShellTools components pass unsanitized arguments generated by a Large Language Model LLM directly to execution sinks,...

CVE-2026-37003: Improper Control of Generation of Code

Agno up to and including 2.5.8 is vulnerable to Remote Code Execution RCE via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec, runpy.runpath, and subprocess.run. An unauthenticated attacker can exploi...

EUVD-2026-67272

Agno up to and including 2.5.8 is vulnerable to Remote Code Execution RCE via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec, runpy.runpath, and subprocess.run. An unauthenticated attacker can exploi...

CVE-2026-37003

Agno up to and including 2.5.8 is vulnerable to Remote Code Execution RCE via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec, runpy.runpath, and subprocess.run. An unauthenticated attacker can exploi...

PT-2026-82206

Name of the Vulnerable Software and Affected Versions langfun versions prior to 0.1.2 Description An Eval Injection occurs in the default lf.query Python protocol. This issue allows remote unauthenticated attackers to execute arbitrary Python code within the host application context. The flaw is...

Improper Neutralization of Input Used for LLM Prompting

Overview strands-agents-tools is an A collection of specialized tools for Strands Agents Affected versions of this package are vulnerable to Improper Neutralization of Input Used for LLM Prompting via the pythonrepl function in src/strandstools/pythonrepl.py. An attacker can execute arbitrary...

CVE-2026-78379

Improper neutralization of input used for LLM prompting in the pythonrepl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards noninteractivemode as a...

EUVD-2026-65735

Improper neutralization of input used for LLM prompting in the pythonrepl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards noninteractivemode as a...

CVE-2026-55557

browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2 , the browser_download function writes a fetched response body to join(save_dir, filename) without validating the caller-controlled save_dir, and browser_save_state / browser_load_state honor a cal...

PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

Summary The PraisonAI MCP server exposes an HTTP-stream transport praisonai mcp serve --transport http-stream that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP...

CVE-2026-45134

A flaw was found in the LangSmith Client SDKs. This vulnerability allows an external attacker to control the content of prompt manifests when a user pulls a public prompt from the LangSmith Hub. By exploiting the deserialization of untrusted data, an attacker could achieve high confidentiality...

PT-2026-81489

Name of the Vulnerable Software and Affected Versions Amazon Strands Agents Tools versions prior to 0.8.5 Description Improper neutralization of input used for Large Language Model LLM prompting in the python repl tool allows remote actors to execute arbitrary Python code on the agent's host. Thi...

CVE-2026-76072

The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts...

EUVD-2026-65059

The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts...

CVE-2026-76072

Continue CLI through 1.5.47 uses an incomplete denylist in evaluateTerminalCommandSecurity.ts as its sole barrier against destructive shell commands in headless and auto modes. The dangerous-path check covers only /, ~, /usr, /etc, /bin, and /sbin, leaving paths like /home, /root, /var, /opt, and...