CVE-database
132.662 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-51872 CRITICAL · 9.8 Devika v1.0 is kwetsbaar voor code-injectie via de functie Runner.run_code in src/agents/runner/runner.py.
- CVE-2026-51871 CRITICAL · 9.8 Devika v1.0 is kwetsbaar voor code-injectie in de Runner.execute-functie in src/agents/runner/runner.py waarmee een aanvaller willekeurige code-uitvoering kan bereiken door de directe uitvoering van door LLM…
- CVE-2026-51870 CRITICAL · 9.8 DeepTutor v1.4.0 is kwetsbaar voor het uitvoeren van opdrachten in /tutorbot/agent/tools/shell.py:ExecTool.execute.
- CVE-2026-51869 CRITICAL · 9.8 DB-GPT v0.8.0 sandbox API valt stilletjes terug naar LocalRuntime en voert code uit op host.
- CVE-2026-51867 CRITICAL · 9.8 agentgpt v.1.0.0 is kwetsbaar voor onjuiste toegangscontrole in next/src/server/api/routers/agentRouter.ts. Een extern bereikbaar pad accepteert een door de beller geselecteerd object of tenant-ID en bereikt een…
- CVE-2026-51866 CRITICAL · 9.8 In DB-GPT 0.7.5 en 0.8.0 kan een vaardigheid die is geüpload via de echte /api/v1/vaardigheden/uploadroute later worden uitgevoerd via de echte /api/v1/chat/react-agent-flow.
- CVE-2026-51864 CRITICAL · 9.1 DB-GPT v0.7.5 en v0.8.0 bevat directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). Een externe aanvaller kan het gevalideerde exploitatiepad gebruiken om bestanden buiten de beoogde werkruimte of…
- CVE-2026-51862 CRITICAL · 9.1 DB-GPT 0.8.0 bevat directory-traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). Een externe aanvaller kan het gevalideerde exploitatiepad gebruiken om bestanden buiten de beoogde werkruimte of opslaggrens te schrijven.
- CVE-2026-51861 CRITICAL · 9.8 bisheng 2.3.0, 2.4.0 en 2.4.0-beta1 is kwetsbaar voor code-injectie in src/backend/bisheng/api/v1/validate.py.
- CVE-2026-51860 HIGH · 7.5 bisheng 2.3.0, 2.4.0 en 2.4.0-beta1 is kwetsbaar voor Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.
- CVE-2026-51859 CRITICAL · 9.1 bisheng 2.3.0, 2.4.0 en 2.4.0-beta1 is kwetsbaar voor directorytraversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).
- CVE-2026-51858 CRITICAL · 9.8 In camel-ai camel 0.2.91a1, v0.2.91a2 en v0.2.91a3 maakt TerminalToolkit.shell_exec promptgestuurde shell-opdrachtuitvoering mogelijk zonder een goedkeuringsgrens.
- CVE-2026-51857 CRITICAL · 9.8 In camel-ai camel 0.2.91a1, v0.2.91a2 en v0.2.91a3 kan CodeExecutionToolkit modelgeproduceerde Python-code uitvoeren via SubprocessInterpreter zonder een goedkeuringsgrens.
- CVE-2026-51856 CRITICAL · 9.8 In agentscope 1.0.18, 1.0.19 en 1.0.19 wanneer de RealtimeAgent-sessie execute_python_code als een beschikbare tool blootstelt, kan een externe WebSocket-gebruiker de agent vragen om die tool…
- CVE-2026-51853 HIGH · 7.5 agent-zero 1.7, 1.8, 1.9 en 1.10 is kwetsbaar voor Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. De klasse FileBrowser initialiseert met de hoofdmap van de host als werkruimte,…
- CVE-2026-51852 HIGH · 7.5 agent-zero 1.7, 1.8, 1.9 en 1.10 is kwetsbaar voor Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. De save_file_b64-methode accepteert door de gebruiker gecontroleerde bestandspaden zonder normalisatie of validatie,…
- CVE-2026-51570 HIGH · 8.1 modelscope Agentscope v1.0.0-v1.0.8 is kwetsbaar voor Path Traversal in INSERT_TEXT_file.
- CVE-2026-51568 HIGH · 8.1 modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.
- CVE-2026-103000 HIGH · 7.5 pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py… Pypdf Project
- CVE-2026-102999 HIGH · 7.5 pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API… Pypdf Project
- CVE-2026-102998 HIGH · 7.5 pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to… Pypdf Project
- CVE-2026-102997 HIGH · 7.5 pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can… Pypdf Project
- CVE-2026-102996 HIGH · 7.5 pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an… Pypdf Project
- CVE-2026-102995 HIGH · 7.5 pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a… Pypdf Project
- CVE-2026-102150 HIGH · 7.2 A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set… Accellion
- CVE-2026-102149 CRITICAL · 9.4 Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate… Accellion
- CVE-2026-102147 CRITICAL · 9.3 A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the… Accellion
- CVE-2026-102146 MEDIUM · 6.5 An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection… Accellion
- CVE-2026-102145 MEDIUM · 6.6 An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through… Accellion
- CVE-2026-102144 MEDIUM · 5.3 A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial… Accellion
- CVE-2026-102143 HIGH · 7.5 An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not… Accellion
- CVE-2026-102142 HIGH · 7.2 A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated… Accellion
- CVE-2026-102141 MEDIUM · 6.7 Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could… Accellion
- CVE-2026-102140 MEDIUM · 4.9 An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header… Accellion
- CVE-2026-102139 MEDIUM · 6.5 An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party… Accellion
- CVE-2026-102138 LOW · 3.3 An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient… Accellion
- CVE-2026-102137 MEDIUM · 4.1 An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This… Accellion
- CVE-2026-102136 MEDIUM · 6.3 In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that… Accellion
- CVE-2026-102135 MEDIUM · 6.6 On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was… Accellion
- CVE-2026-102134 MEDIUM · 5.4 Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach… Accellion
- CVE-2026-102133 MEDIUM · 6.6 Een optionele, afzonderlijk gelicentieerde repository-connectorfunctie in Kiteworks Core neutraliseerde geen speciale tekens in een door de gebruiker geleverd pad voordat deze aan een externe opdracht… Accellion
- CVE-2026-102132 HIGH · 7.2 An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A… Accellion
- CVE-2026-102131 HIGH · 7.2 Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator… Accellion
- CVE-2026-102130 HIGH · 7.2 Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it.… Accellion
- CVE-2026-102129 HIGH · 7.2 A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated… Accellion
- CVE-2026-102128 HIGH · 7.5 An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not… Accellion
- CVE-2026-102127 HIGH · 7.0 An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote… Accellion
- CVE-2026-102126 HIGH · 8.1 A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content… Accellion
- CVE-2026-102125 HIGH · 8.8 The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox… Accellion
- CVE-2026-102124 MEDIUM · 6.5 A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance… Accellion