157 matches found
Trinity Audio <= 5.21.0 - Information Exposure
The Trinity Audio Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the /admin/inc/phpinfo.php file that gets created on install. This makes it possible for...
Trinity-Audio-CVE-Report
Trinity-Audio-CVE-Report Disclosure for CVE-2025-9196 CVE-2025-9196 - Vulnerability in Trinity Audio This repository discloses a vulnerability discovered in Trinity Audio = 5.20.1,WordPress plugin developed by sergiotrinity. 🛠 Affected Version Product : Trinity Audio Version : v5.20.1 URL :...
Trinity-Audio-CVE-Report2
Trinity-Audio-CVE-Report 2 Disclosure for CVE-2025-9886 and CVE-2025-9952. CVE-2025-9886 and CVE-2025-9952 - Vulnerability in Trinity Audio This repository discloses a vulnerability discovered in Trinity Audio = 5.20.1,WordPress plugin developed by sergiotrinity. 🛠 Affected Version Product :...
CVE-2026-108756
Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token,...
CVE-2026-108756 Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes
Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token,...
CVE-2026-108756 Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes
Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token,...
CVE-2026-108756
The Abilityai Trinity software (versions through 0.9.5 ) contains a missing authorization vulnerability within the Telegram router . This flaw allows agent-scoped MCP API keys to execute operations restricted to human users, specifically binding operations . An attacker who gains control of an ag...
EUVD-2026-96921
Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token,...
CVE-2026-108756: Missing Authorization
Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token,...
PT-2026-110158
Name of the Vulnerable Software and Affected Versions Abilityai Trinity versions prior to 0.9.6 Description A missing authorization issue exists in the Telegram router. This allows agent-scoped MCP API keys to execute binding operations that should be restricted to humans. An attacker who gains...
diap-sdk (>=0.1.4, <=0.1.5), p2pclient (>=0.1.2, <=0.1.3) +1 more potentially affected by CVE-2026-73568 via libp2p (>=0.1.1, <=0.7.0)
libp2p PYPI version =0.1.1, =0.1.4, =0.1.2, =0.1.0a28, =0.1.0a36 Source cves: CVE-2026-73568 Source advisory: OSV:PYSEC-2026-3681...
Trinity Audio <= 5.21.0 - Information Exposure Detection
The Trinity Audio Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the /admin/inc/phpinfo.php file that gets created on install. This makes it possible for...
diap-sdk (>=0.1.4, <=0.1.5), p2pclient (>=0.1.2, <=0.1.3) +1 more potentially affected by CVE-2026-73568 via libp2p (>=0.1.1, <=0.7.0)
libp2p PYPI version =0.1.1, =0.1.4, =0.1.2, =0.1.0a28, =0.1.0a36 Source cves: CVE-2026-73568 Source advisory: OSV:GHSA-HMJ8-5XMH-5573...
diap-sdk (>=0.1.4, <=0.1.5), p2pclient (>=0.1.2, <=0.1.3) +1 more potentially affected by CVE-2026-73568 via libp2p (>=0.1.1, <=0.7.0)
libp2p PYPI version =0.1.1, =0.1.4, =0.1.2, =0.1.0a28, =0.1.0a36 Source cves: CVE-2026-73568 Source advisory: GHSA-HMJ8-5XMH-5573...
diap-sdk (>=0.1.4, <=0.1.5), p2pclient (>=0.1.2, <=0.1.3) +1 more potentially affected by unknown CVE via libp2p (>=0.1.1, <=0.7.0)
libp2p PYPI version =0.1.1, =0.1.4, =0.1.2, =0.1.0a28, =0.1.0a36 Source cves: unknown CVE Source advisory: SNYK:PYTHON-LIBP2P-18313058...
trinity-rft (>=0.1.0, <=0.3.0) potentially affected by CVE-2026-6878 via verl (>=0.3.0.post1, <=0.5.0)
verl PYPI version =0.3.0.post1, =0.1.0, =0.3.0 Source cves: CVE-2026-6878 Source advisory: OSV:PYSEC-2026-3402...
Malicious code in trinity-scheme (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d576c0487668f599137a479e17ddc1335935fdec631f7d5adfa9e73049d7652 On npm install, the package's preinstall lifecycle reads a hex-encoded command string from preinstall.json, decodes it via Buffer.from..., 'hex', and...
trinity (>=0.1.0a28, <=0.1.0a36) potentially affected by CVE-2025-29606 via libp2p (>=0.1.1, <=0.1.5)
libp2p PYPI version =0.1.1, =0.1.0a28, =0.1.0a36 Source cves: CVE-2025-29606 Source advisory: OSV:PYSEC-2026-1536...
bq-jobrunner (0.0.1), libp2p (>=0.1.1, <=0.1.2) +6 more potentially affected by CVE-2025-4565 via protobuf (3.9.0)
protobuf PYPI version 3.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - bq-jobrunner 0.0.1 - libp2p =0.1.1, =1.0.6, =0.0.20, =0.1.0a31, =1.2.0rc2, =1.2.0rc3, =1.2.0 Source cves: CVE-2025-4565 Source advisory:...