Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29 results
Oct 2, 2026TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py.CVE-2026-51916 · Other software · reported by MITREHigh 7.5
TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/{knowledge_id} deletes the selected knowledge object without requiring authentication in the route and without verifying organization ownership of the supplied knowledge_id.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller.CVE-2026-51915 · Other software · reported by MITRECritical 9.8
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a caller-supplied tool_id and fail to verify organization ownership through the associated toolkit. A remote authenticated attacker from one organization can read or modify another organization's tool metadata through /tools/get/{tool_id} and /tools/update/{tool_id}.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller.CVE-2026-51914 · Other software · reported by MITREHigh 8.8
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, save_agent_as_template and publish_template in superagi/controllers/agent_template.py accept caller-supplied agent_id or agent_execution_id values and do not verify that the referenced agent or execution belongs to the authenticated user's organization.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 2, 2026SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller.CVE-2026-51904 · Other software · reported by MITRECritical 9.8
SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id and fail to verify that the referenced agent belongs to the authenticated user's organization. A remote authenticated attacker from one organization can create or start execution records for agents owned by another organization through /agentexecutions/add or /agentexecutions/add_run.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 2, 2026SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control.CVE-2026-51901 · Other software · reported by MITREHigh 8.1
SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoint accepts an agent_id parameter but does not verify that the agent belongs to the authenticated user's organization.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 2, 2026In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_sCVE-2026-51899 · Other software · reported by MITREMedium 4.3
In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different organization's project. The endpoints accept a project_id parameter but do not verify that the project belongs to the authenticated user's organization.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 20, 2026A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14.CVE-2026-6616 · Other software · TransformerOptimus · reported by VulDBLow 2.1
A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extract_with_bs4/extract_with_3k/extract_with_lxml of the file superagi/helper/webpage_extractor.py of the component WebScraperTool. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SuperAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Apr 20, 2026A weakness has been identified in TransformerOptimus SuperAGI up to 0.0.14.CVE-2026-6615 · Other software · TransformerOptimus · reported by VulDBMedium 5.5
A weakness has been identified in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function Upload of the file superagi/controllers/resources.py of the component Multipart Upload Handler. This manipulation of the argument Name causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SuperAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Apr 20, 2026A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14.CVE-2026-6614 · Other software · TransformerOptimus · reported by VulDBLow 2.1
A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14. Affected by this vulnerability is the function get_project/update_project/get_projects_organisation of the file superagi/controllers/project.py. The manipulation results in authorization bypass. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SuperAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Apr 20, 2026A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14.CVE-2026-6613 · Other software · TransformerOptimus · reported by VulDBLow 2.1
A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function delete_agent/stop_schedule/get_schedule_data of the file superagi/controllers/agent.py. The manipulation of the argument agent_id leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SuperAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Apr 20, 2026A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14.CVE-2026-6612 · Other software · TransformerOptimus · reported by VulDBLow 2.1
A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This impacts the function get_agent_execution/update_agent_execution of the file superagi/controllers/agent_execution.py of the component Agent Execution Endpoint. Executing a manipulation of the argument agent_execution_id can lead to authorization bypass. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SuperAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Apr 19, 2026A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14.CVE-2026-6586 · Other software · TransformerOptimus · reported by VulDBLow 2.1
A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Impacted is the function get_budget/update_budget of the file superagi/controllers/budget.py of the component Budget Endpoint. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SuperAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Apr 19, 2026A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14.CVE-2026-6585 · Other software · TransformerOptimus · reported by VulDBLow 2.1
A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This issue affects the function update_organisation of the file superagi/controllers/organisation.py of the component Organisation Update Endpoint. This manipulation of the argument organisation_id causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SuperAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Apr 19, 2026A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14.CVE-2026-6584 · Other software · TransformerOptimus · reported by VulDBLow 2.1
A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function update_user of the file superagi/controllers/user.py of the component User Update Endpoint. The manipulation of the argument user_id results in authorization bypass. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SuperAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Apr 19, 2026A vulnerability has been found in TransformerOptimus SuperAGI up to 0.0.14.CVE-2026-6583 · Other software · TransformerOptimus · reported by VulDBLow 2.1
A vulnerability has been found in TransformerOptimus SuperAGI up to 0.0.14. This affects the function delete_api_key/edit_api_key of the file superagi/controllers/api_key.py of the component API Key Management Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SuperAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Apr 19, 2026A flaw has been found in TransformerOptimus SuperAGI up to 0.0.14.CVE-2026-6582 · Other software · TransformerOptimus · reported by VulDBMedium 5.5
A flaw has been found in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function get_vector_db_details of the file superagi/controllers/vector_dbs.py of the component Vector Database Management Endpoint. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SuperAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Jul 22, 2025Arbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to overwrite arbitrary filCVE-2025-51475 · Other software · Superagi · reported by MITREMedium 5
Arbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to overwrite arbitrary files via unsanitised filenames submitted to the file upload endpoint, due to improper handling of directory traversal in os.path.join() and lack of path validation in get_root_input_dir().
- Product
- Superagi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Code Injection in AgentTemplate.eval_agent_config in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious vCVE-2025-51472 · Other software · Superagi · reported by MITREMedium 6.5
Code Injection in AgentTemplate.eval_agent_config in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious values in agent template configurations such as the goal, constraints, or instruction field, which are evaluated using eval() without validation during template loading or updates.
- Product
- Superagi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability, which was classified as critical, was found in TransformerOptimus SuperAGI up to 0.0.14.CVE-2025-6280 · Other software · TransformerOptimus · reported by VulDBLow 2
A vulnerability, which was classified as critical, was found in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function download_attachment of the file SuperAGI/superagi/helper/read_email.py of the component EmailToolKit. The manipulation of the argument filename leads to path traversal. The exploit has been disclosed to the public and may be used.
- Product
- SuperAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi.CVE-2024-9447 · Other software · transformeroptimus · reported by security@huntr.devMedium 6.5
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. The `/get/organisation/` endpoint does not verify the user's organization, allowing any authenticated user to retrieve sensitive configuration details, including API keys, of any organization. This could lead to unauthorized access to services and significant data breaches or financial loss.
- Product
- transformeroptimus/superagi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025SuperAGI is vulnerable to remote code execution in the latest version.CVE-2024-9439 · Other software · transformeroptimus · reported by security@huntr.devHigh 8.8
SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.
- Product
- transformeroptimus/superagi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025SuperAGI version v0.0.14 is vulnerable to an unauthenticated Denial of Service (DoS) attack.CVE-2024-9437 · Other software · transformeroptimus · reported by security@huntr.devHigh 7.5
SuperAGI version v0.0.14 is vulnerable to an unauthenticated Denial of Service (DoS) attack. The vulnerability exists in the resource upload request, where appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request causes the server to continuously process each character. This leads to excessive resource consumption and renders the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.
- Product
- transformeroptimus/superagi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In version v0.0.14 of transformeroptimus/superagi, there is an improper privilege management vulnerability.CVE-2024-9431 · Other software · transformeroptimus · reported by security@huntr.devHigh 8.8
In version v0.0.14 of transformeroptimus/superagi, there is an improper privilege management vulnerability. After logging into the system, users can change the passwords of other users, leading to potential account takeover.
- Product
- transformeroptimus/superagi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in plaintext.CVE-2024-9418 · Other software · transformeroptimus · reported by security@huntr.devMedium 6.5
In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in plaintext. This vulnerability allows an attacker to retrieve the password of another user, leading to potential account takeover.
- Product
- transformeroptimus/superagi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14.CVE-2024-9415 · Other software · transformeroptimus · reported by security@huntr.devHigh 8.8
A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. This vulnerability allows an attacker to upload an arbitrary file to the server, potentially leading to remote code execution or overwriting any file on the server.
- Product
- transformeroptimus/superagi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14.CVE-2024-12048 · Other software · transformeroptimus · reported by security@huntr.devHigh 8.8
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.
- Product
- transformeroptimus/superagi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi.CVE-2024-10267 · Other software · transformeroptimus · reported by security@huntr.devHigh 7.5
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. An attacker can leak sensitive user information, including names, emails, and passwords, by attempting to register a new account with an email that is already in use. The server returns all information associated with the existing account. The vulnerable endpoint is located in the user registration functionality.
- Product
- transformeroptimus/superagi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2024All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function.CVE-2024-21552 · Other software · superagi · reported by report@snyk.ioCritical 9.8
All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the LLM output to exploit this vulnerability and gain arbitrary code execution on the SuperAGI application server.
- Product
- superagi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations.CVE-2023-48055 · Other software · Superagi · reported by MITREHigh 7.5
SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. This vulnerability can lead to the disclosure of information and communications.
- Product
- Superagi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgxx777.github.iogxx777.github.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.