CVE-2026-109437

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

CVE-2026-109437 Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

CVE-2026-109437

The Cognition software (versions prior to 0.13.0 ) is vulnerable to unauthenticated remote code execution (RCE) . The root cause is the lack of authentication on the REST/SSE API combined with the agent sandbox backend defaulting to local execution . An attacker can exploit this by creating a ses...

CVE-2026-109437 Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

CVE-2025-10966 missing SFTP host verification with wolfSSH

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more...