Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,489 results · page 6 of 70
Sep 29, 2026Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to CVE-2026-102697 · Other software · ollama · reported by VulnCheckHigh 8.5
Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by appending control operators like semicolons or logical operators to approved commands, bypassing the session approval requirement.
- Product
- ollama
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 verCVE-2026-96440 · Other software · Flowring Technology Corp · reported by ART@zuso.aiHigh 7.1
Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via the path parameter.
- Product
- Agentflow 4.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allowCVE-2026-96431 · Other software · Flowring Technology Corp · reported by ART@zuso.aiCritical 9.3
Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.
- Product
- Agentflow 4.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated usCVE-2026-96430 · Other software · Flowring Technology Corp · reported by ART@zuso.aiHigh 8.7
Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter.
- Product
- Agentflow 4.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbiCVE-2026-96429 · Other software · Flowring Technology Corp · reported by ART@zuso.aiCritical 9.3
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- Agentflow 4.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitCVE-2026-96428 · Other software · Flowring Technology Corp · reported by ART@zuso.aiCritical 9.3
SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter.
- Product
- Agentflow 4.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients.CVE-2026-55157 · Other software · ooples · reported by GitHubHigh 8.4
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool. Any MCP client that can call the smart_user tool can execute arbitrary shell commands through the username argument of the get-user-info operation. The commands execute with the privileges of the user running the token-optimizer-mcp server. This issue has been patched in version 5.1.0.
- Product
- token-optimizer-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients.CVE-2026-55156 · Other software · ooples · reported by GitHubMedium 5.3
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication middleware — any network-accessible client can reach them without credentials. Both handlers concatenate the caller-supplied sessionId query parameter directly into a filesystem path via path.join, and Node.js normalizes .. segments at resolution time, allowing an unauthenticated attacker to read any .jsonl file reachable from the server's filesystem. This issue has been patched in version 5.1.0.
- Product
- token-optimizer-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials CVE-2026-88808 · Other software · SUSE · reported by meissner@suse.deHigh 8.8
A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files. This issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11.
- Product
- Rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A vulnerability was found in agentverus agentverus-scanner up to 0.8.1.CVE-2026-101079 · Other software · agentverus · reported by VulDBLow 0.9
A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function isSecurityDefenseSkill of the file dist/scanner/analyzers/context.js. Performing a manipulation results in reliance on untrusted inputs in a security decision. The attack must be initiated from a local position. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- agentverus-scanner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies Tourism Industry and TraCVE-2026-87752 · Other software · Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. · reported by iletisim@usom.gov.trMedium 6.1
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes. This issue affects Agentis: from 4.44 before 4.6.
- Product
- Agentis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2026Obot is an open-source AI agent/MCP platform.CVE-2026-101065 · Other software · obot-platform · reported by VulnCheckCritical 9.3
Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the README starts the container listening on 0.0.0.0:8080 with authentication disabled by default. When authentication is disabled, every request is mapped to a synthetic "nobody" user that holds the Owner and Admin roles, so any unauthenticated party who can reach the exposed port obtains full administrative access to the Obot API and UI, including the ability to register and launch attacker-controlled MCP servers. Because the quickstart also mounts /var/run/docker.sock into the container, the MCP runtime backend reachable this way has access to the host's Docker control surface. The fix is documentation-only: the quickstart now enables authentication, and operators who followed the previous instructions should set OBOT_SERVER_ENABLE_AUTHENTICATION=true before exposing the host to any untrusted network.
- Product
- obot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 27, 2026python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback intCVE-2026-101058 · Other software · universal-tool-calling-protocol · reported by VulnCheckHigh 7.1
python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that manual is discovered from a remote, non-loopback origin. Because ensure_secure_url intentionally permits loopback HTTP for local development and native manuals bypassed the loopback check performed by the OpenAPI converter, an attacker who can serve a UTCP manual that a victim registers can cause the client to issue requests to services bound only to 127.0.0.1 on the victim host and have the response bodies returned to the caller (server-side request forgery). The http, sse and streamable_http protocols are all affected. Reach is limited to loopback, and exploitation further requires a loopback service that answers unauthenticated requests with useful data. Fixed in utcp-http 1.1.12, which rejects manuals fetched from a non-loopback origin that declare loopback tool URLs, keyed off the final post-redirect discovery URL.
- Product
- python-utcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 26, 2026Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation.CVE-2026-72668 · Other software · Elastic · reported by security@elastic.coHigh 7.3
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026OpenClaw is an agent gateway distributed via npm.CVE-2026-100592 · Other software · OpenClaw · reported by VulnCheckMedium 5.3
OpenClaw is an agent gateway distributed via npm. In versions >= 2026.4.10 and < 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dreaming off' commands to enable or disable the Gateway's Memory Core dreaming behavior, disabling background memory processing or re-enabling durable memory promotion where the owner expected it to remain disabled; the practical confidentiality, integrity, and availability impact depends on stored conversation material and subsequent memory use. Read-only status and help commands remain governed by normal command policy. The issue is fixed in version 2026.7.1. As a workaround, disable dreaming commands in external channels or restrict channel command access to owners.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 25, 2026OpenClaw is an npm-distributed agent gateway.CVE-2026-100591 · Other software · OpenClaw · reported by VulnCheckMedium 5.3
OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for future sessions or re-enabling global recall where the owner expected it to remain disabled. The issue is limited to persistent global on/off mutations; session-level controls and read-only status remain governed by existing command policy. The issue is fixed in version 2026.7.1. (Suggested title: "OpenClaw before 2026.7.1 missing owner authorization check on Active Memory global toggles".)
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 25, 2026OpenClaw is an npm-distributed agent runtime.CVE-2026-100584 · Other software · OpenClaw · reported by VulnCheckMedium 5.4
OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named executable located in the workspace directory. If lower-trust content can place an executable with an approved basename into an agent-writable workspace and steer an approved PowerShell command that uses a bare executable name, OpenClaw may run the workspace file instead of the allowlisted path, executing arbitrary code with the privileges of the Gateway or node-host user. The issue does not require replacement of the approved executable itself. Version 2026.7.1 contains a fix; as a workaround, avoid bare executable names in approved PowerShell commands and keep executable files out of agent-writable workspaces.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 25, 2026OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invCVE-2026-100573 · Other software · OpenClaw · reported by VulnCheckMedium 4.8
OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions the operator intended to exclude from the sandbox.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 25, 2026OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerCVE-2026-100568 · Other software · OpenClaw · reported by VulnCheckHigh 8.7
OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless command jobs. Attackers can inspect stored environment variables and force-run disabled or unscheduled command jobs to access secrets and execute operator-authored commands.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 25, 2026OpenClaw is an agent gateway distributed as the npm package 'openclaw'.CVE-2026-100567 · Other software · OpenClaw · reported by VulnCheckHigh 8.9
OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions >= 2026.4.5 and < 2026.8.1, the Gateway validated a single DNS resolution result for a configured remote Chrome DevTools Protocol (CDP) hostname, but the raw WebSocket and Playwright transports performed a later, independent DNS resolution, discarding the DNS pinning enforced at validation time. An attacker who controls an approved CDP hostname or its DNS answers can exploit this check-then-use gap via DNS rebinding to make the Gateway connect to a loopback, private, link-local, cloud metadata, or other SSRF-policy-denied address. The impact depends on the remote CDP configuration, DNS timing, and the services reachable from the Gateway host. The issue is fixed in 2026.8.1; as a mitigation, disable hostname-based remote CDP endpoints or restrict them to trusted, stable infrastructure.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 25, 2026OpenClaw is a coding agent distributed as the npm package `openclaw`.CVE-2026-100547 · Other software · OpenClaw · reported by VulnCheckMedium 6.8
OpenClaw is a coding agent distributed as the npm package `openclaw`. In affected versions (2026.7.1 through 2026.7.2), alternate but valid `file:` URL spellings supplied over the Agent Client Protocol (ACP) were treated as relative paths and were incorrectly classified as reads scoped to the session working directory. When an operator connected `openclaw acp client` to an untrusted or compromised ACP peer, that peer could request a read of a file outside the session working directory without the approval prompt normally required for that path, resulting in disclosure of local file contents. The demonstrated impact is limited to file confidentiality; mutating and command-capable tool classes are not affected. This issue is fixed in OpenClaw 2026.8.1.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 25, 2026openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity CVE-2026-100544 · Other software · openclaw · reported by VulnCheckHigh 8.7
openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the agent's normal tool authority to a remote caller. A caller who is admitted by the configured inbound-call policy (open, pairing, or allowlist) on a deployment with inbound calling enabled can therefore drive tools intended for the trusted owner, potentially reading data, modifying files, executing commands, or controlling connected services depending on the agent's configuration. The issue is fixed in 2026.8.1.
- Product
- voice-call
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 25, 2026OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling outbound attachCVE-2026-100538 · Other software · OpenClaw · reported by VulnCheckHigh 7.1
OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling outbound attachments. A sender that has been explicitly denied filesystem read tools can still cause a known local file to be read and returned via a final-response media directive or a message attachment, disclosing local file contents to an admitted requester whose agent turn did not include the read tool. Exploitation requires knowledge or derivation of a useful host path and a delivery flow that accepts local attachments. The issue is fixed in version 2026.8.1.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 24, 2026An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary CVE-2026-89325 · Other software · Rapid7 · reported by cve@rapid7.comHigh 7.8
An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Assessment content at or below version 0.0.261.0 included a check that invoked the `code` command without a fully qualified path from a process running as SYSTEM. The command was resolved against the machine PATH environment variable at execution time. Where the machine PATH contained a directory writable by non-administrative users and ordered ahead of the legitimate Visual Studio Code installation, a local user could place an executable named `code` in that directory and cause the agent to execute it with SYSTEM privileges. The version range above refers to InsightVM assessment content versions, not Insight Agent versions. All Insight Agent versions were affected while running assessment content at or below 0.0.261.0. Assessment content is delivered to all Insight Agents via the Rapid7 Insight Platform independently of the Insight Agent version and is not customer-managed. This issue was resolved in assessment content version 0.0.269.0, which was ma
- Product
- Insight Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's contextCVE-2026-95985 · Other software · Amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.6
The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths. We recommend you upgrade to Kiro IDE version 1.0.242 or later. Users who ran the agent in an untrusted workspace on an earlier version should also review the global Kiro configuration directory (~/.kiro) for entries they did not create.
- Product
- Kiro IDE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comkiro.dev
Sep 24, 2026Decepticon is an autonomous hacking agent for red teams.CVE-2026-61732 · Other software · BitterSecurity · reported by GitHubCritical 10
Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue.
- Product
- Decepticon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.CVE-2026-93529 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.
- Affected
- up to 2.7.0
- What to do
- Affects up to 2.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent servCVE-2026-18875 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.3
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent server (api.vectordb.runbooks.js:51). An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer AI-driven MCP tool calls, potentially triggering unauthorized payment actions or exfiltrating payment data.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6.CVE-2026-95930 · Other software · iFlytek · reported by VulDBMedium 5.3
A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version reward-1575 addresses this issue. The identifier of the patch is 45ee5fb647e9894e73b0d7720fa94a66e4540bbb. The affected component should be upgraded.
- Product
- astron-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026A weakness has been identified in iFlytek astron-agent up to 1.0.7.CVE-2026-95929 · Other software · iFlytek · reported by VulDBMedium 5.3
A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sql injection. It is possible to launch the attack remotely. Upgrading to version reward-1575 is able to address this issue. This patch is called 6702be70ae802b1048f5fbec91e690e7b71a4165. You should upgrade the affected component.
- Product
- astron-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data.CVE-2026-95815 · Other software · OpenClaw · reported by VulnCheckHigh 7.2
OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation prompts.
- Product
- OpenClaw iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses.CVE-2026-62985 · Other software · azu · reported by GitHubHigh 7.5
request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or 127.0.0.1. Because Node.js http.request and http.get expect connection failures to be delivered asynchronously, the throw bypassed req.on('error') and became an uncaught exception that could terminate the application process. Hostnames resolved through the asynchronous lookup path were not affected by this error-delivery asymmetry. This issue is fixed in version 3.2.1.
- Product
- request-filtering-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.CVE-2026-88978 · Other software · hatchet-dev · reported by GitHubMedium 4.3
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.
- Product
- hatchet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.CVE-2026-84298 · Other software · hatchet-dev · reported by GitHubLow 3.1
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified, and callback delivery resolves that map by task UUID without tenant identity. An authenticated tenant worker that knows another tenant's durable task UUID and keeps a stream open on the same dispatcher process can receive that task's durable callback result payload. UUIDv4 values are not enumerable, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.95.3.
- Product
- hatchet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.CVE-2026-63342 · Other software · hatchet-dev · reported by GitHubMedium 6.3
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant's durable task UUID to read that task's event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.
- Product
- hatchet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.CVE-2026-61687 · Other software · hatchet-dev · reported by GitHubHigh 7.1
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1.
- Product
- hatchet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.CVE-2026-61681 · Other software · hatchet-dev · reported by GitHubMedium 4.1
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.
- Product
- hatchet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design.CVE-2026-55071 · Other software · SepineTam · reported by GitHubHigh 8.4
MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python API can embed newline characters in the package argument to inject arbitrary Stata commands. Because Stata supports a shell escape command, this leads to full OS-level arbitrary command execution (RCE) under the account running the Stata-MCP server. The tool is registered in the default all profile, so no non-default configuration is required. This issue has been patched in version 1.19.0.
- Product
- mcp-for-stata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management prCVE-2025-71421 · Other software · uvdesk · reported by VulnCheckHigh 8.6
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.
- Product
- core-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access repliesCVE-2025-71420 · Other software · uvdesk · reported by VulnCheckMedium 5.3
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.
- Product
- core-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Mnemosyne is a memory layer for artificial intelligence agents.CVE-2026-59163 · Other software · AxDSan · reported by GitHubCritical 9.1
Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_server.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. The server accepted any well-formed token regardless of the signature, including tokens with alg: none and tokens signed with the wrong key. The fix in v3.10.1 replaces the broken decode with a from-scratch HS256 verifier using only the Python standard library. For users who cannot upgrade immediately, restrict network access to the sync server endpoint to trusted clients only. Firewall, reverse proxy with mTLS, or localhost bind with SSH tunnel are all viable. The vulnerability is not exploitable against an unreachable endpoint.
- Product
- mnemosyne
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting.CVE-2026-1037 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- Common Licensing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting.CVE-2026-1031 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- Common Licensing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive informatiCVE-2026-1030 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data.
- Product
- Common Licensing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting.CVE-2026-1029 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- Common Licensing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting.CVE-2026-1025 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- Common Licensing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could alloCVE-2025-15399 · Other software · IBM · reported by psirt@us.ibm.comCritical 10
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
- Product
- Common Licensing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI: Sensitive Information ExposureCVE-2026-89278 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.34.6 via the enqueue_frontend_scripts. This makes it possible for unauthenticated attackers to extract the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation) — a credential granting billed account access — by fetching any public page and applying the inverse transformation bundled in the plugin's own public JavaScript asset. This exposure affects the default configuration (gpt-3.5-turbo in client mode) and all supported non-DeepSeek providers; only deepseek-* models and gpt-* models configured in server-proxy mode correctly suppress key emission.
- Product
- GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI
- Affected
- up to 2.34.6
- What to do
- Affects up to 2.34.6. Update GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 18, 2026A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent.CVE-2024-27123 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.2
A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.9 and later
- Product
- QcalAgent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without properCVE-2026-18911 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.5
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.
- Product
- ManageEngine DataSecurity Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.