Lucene search
+L

525 matches found

CNNVD
CNNVD
•added 2026/06/11 12:00 a.m.•30 views

OpenClaw 权限许可和访问控制问题漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.5.27 had code-related vulnerabilities. These vulnerabilities stemmed from issues with code execution during the skill installation process. The workarea.env file could override th...

8.8CVSS6.3AI score0.00415EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/06/11 12:00 a.m.•0 views

CVE-2026-53808: Incorrect Authorization

OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows agent tool calls to set apply: true despite approvalPolicy: pending configuration. Attackers can exploit this by reaching the affected apply path to apply workshop changes before...

6.5CVSS5.8AI score0.00343EPSS
SaveExploits0References4
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/06/11 12:00 a.m.•1 views

CVE-2026-53819: Untrusted Search Path

OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to trusted operator workspaces can execute unintended Homebrew-compatible executables during skill...

8.8CVSS6.5AI score0.00415EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/11 12:00 a.m.•31 views

PT-2026-48749

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.27 Description An arbitrary code execution issue exists in skill install flows. This occurs because workspace .env files can override the Homebrew executable selection, allowing attackers with access to truste...

8.8CVSS6.2AI score0.00415EPSS
SaveExploits0References7
CNNVD
CNNVD
•added 2026/06/11 12:00 a.m.•32 views

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.5.6 contained a security vulnerability. This vulnerability stemmed from a bypass of the approval policy in the Skill Workshop application process, allowing proxy tools to set appl...

6.5CVSS5.4AI score0.00343EPSS
SaveExploits0References1
Packet Storm News
Packet Storm News
•added 2026/06/10 12:00 a.m.•73 views

Runtime Skill Audit: Targeted Runtime Probing for Agent Skill Security

Agent skills let LLM agents reuse instructions, resources, tools, and workflows, but they also create a new place for malicious behavior to hide. A skill may look benign in its documentation or code while becoming harmful only when it is invoked with particular user requests, local assets,...

5.7AI score
SaveExploits0
RedhatCVE
RedhatCVE
•added 2026/06/05 7:48 p.m.•15 views

CVE-2026-10210

A vulnerability was found in AstrBotDevs AstrBot 4.23.6. Affected by this vulnerability is the function sanitizepromptdescription of the file astrbot/core/skills/skillmanager.py. The manipulation results in injection. The attack may be performed from remote. The exploit has been made public and...

6.5CVSS6.1AI score0.00228EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
•added 2026/06/05 7:27 p.m.•19 views

CVE-2026-40117

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, readskillfile in skilltools.py allows reading arbitrary files from the filesystem by accepting an unrestricted skillpath parameter. Unlike filetools.readfile which enforces workspace boundary confinement, and unlike runskillscript...

7.5CVSS5.6AI score0.00332EPSS
SaveExploits1References1
Packet Storm News
Packet Storm News
•added 2026/06/05 12:00 a.m.•33 views

POISE: Position-Aware Undetectable Skill Injection on LLM Agents

Agent skills provide a lightweight mechanism for extending general-purpose agents, but their open format exposes them to skill-poisoning attacks. A practically dangerous injection must stay invisible: if executing the payload derails the user's legitimate task, the resulting failure signal invite...

5.7AI score
SaveExploits0
RedhatCVE
RedhatCVE
•added 2026/06/02 4:01 p.m.•27 views

CVE-2026-10220

A vulnerability was determined in NousResearch hermes-agent up to 2026.4.30. Affected is the function servepluginskill/skillview of the file tools/skillstool.py. Executing a manipulation can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed and ma...

7.5CVSS5.5AI score0.00304EPSS
SaveExploits0References1
NVD
NVD
•added 2026/06/01 4:16 a.m.•23 views

CVE-2026-10220

A vulnerability was determined in NousResearch hermes-agent up to 2026.4.30. Affected is the function servepluginskill/skillview of the file tools/skillstool.py. Executing a manipulation can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed and ma...

7.5CVSS0.00304EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/06/01 3:30 a.m.•61 views

CVE-2026-10220 NousResearch hermes-agent skills_tool.py skill_view injection

A vulnerability was determined in NousResearch hermes-agent up to 2026.4.30. Affected is the function servepluginskill/skillview of the file tools/skillstool.py. Executing a manipulation can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed and ma...

7.5CVSS0.00304EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
•added 2026/06/01 3:30 a.m.•18 views

CVE-2026-10220 NousResearch hermes-agent skills_tool.py skill_view injection

A vulnerability was determined in NousResearch hermes-agent up to 2026.4.30. Affected is the function servepluginskill/skillview of the file tools/skillstool.py. Executing a manipulation can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed and ma...

7.5CVSS6.8AI score0.00304EPSS
SaveExploits0References5
attackerkb
attackerkb
•added 2026/06/01 3:30 a.m.•13 views

CVE-2026-10220

A vulnerability was determined in NousResearch hermes-agent up to 2026.4.30. Affected is the function servepluginskill/skillview of the file tools/skillstool.py. Executing a manipulation can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed and ma...

7.5CVSS6.8AI score0.00304EPSS
SaveExploits0References5Affected Software1
EUVD
EUVD
•added 2026/06/01 3:30 a.m.•21 views

EUVD-2026-33546

A vulnerability was determined in NousResearch hermes-agent up to 2026.4.30. Affected is the function servepluginskill/skillview of the file tools/skillstool.py. Executing a manipulation can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed and ma...

7.5CVSS6.8AI score0.00304EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/06/01 1:00 a.m.•55 views

CVE-2026-10210 AstrBotDevs AstrBot skill_manager.py _sanitize_prompt_description injection

A vulnerability was found in AstrBotDevs AstrBot 4.23.6. Affected by this vulnerability is the function sanitizepromptdescription of the file astrbot/core/skills/skillmanager.py. The manipulation results in injection. The attack may be performed from remote. The exploit has been made public and...

6.5CVSS0.00228EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
•added 2026/06/01 1:00 a.m.•17 views

CVE-2026-10210 AstrBotDevs AstrBot skill_manager.py _sanitize_prompt_description injection

A vulnerability was found in AstrBotDevs AstrBot 4.23.6. Affected by this vulnerability is the function sanitizepromptdescription of the file astrbot/core/skills/skillmanager.py. The manipulation results in injection. The attack may be performed from remote. The exploit has been made public and...

6.5CVSS6.2AI score0.00228EPSS
SaveExploits0References5
attackerkb
attackerkb
•added 2026/06/01 1:00 a.m.•14 views

CVE-2026-10210

A vulnerability was found in AstrBotDevs AstrBot 4.23.6. Affected by this vulnerability is the function sanitizepromptdescription of the file astrbot/core/skills/skillmanager.py. The manipulation results in injection. The attack may be performed from remote. The exploit has been made public and...

6.5CVSS6.2AI score0.00228EPSS
SaveExploits0References5Affected Software1
CVE
CVE
•added 2026/06/01 1:00 a.m.•52 views

CVE-2026-10210

The CVE affects AstrBotDevs AstrBot 4.23.6. The vulnerable component is the function _sanitize_prompt_description in astrbot/core/skills/skill_manager.py, where input handling allows injection due to improper sanitization. This vulnerability is reachable over a network (remote exploit) and, per t...

6.5CVSS6.2AI score0.00228EPSS
SaveExploits0References5
CNNVD
CNNVD
•added 2026/06/01 12:00 a.m.•70 views

Hermes Agent 安全漏洞

Hermes Agent is an AI agent tool developed by Nous Research, featuring a self-learning mechanism. Versions of Hermes Agent prior to 2026.4.30 contained a security vulnerability, which was caused by issues with the servepluginskill/skillview function in the tools/skillstool.py file. This...

7.5CVSS7.3AI score0.00304EPSS
SaveExploits0References5
Rows per page
Query Builder