Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-18996 — cosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCom…

A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts …

| Authorization
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
0.0 NA
CVE-2026-18995 — netease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText informatio…

A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler…

| Information Disclosure
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
5.6 MEDIUM
CVE-2026-18909 — ELAN Microelectronics Smart-Pad Stack-Based Buffer Overflow

A stack-based buffer overflow vulnerability exists in ELAN Microelectronics Corp. ELAN Smart-Pad on Windows (ETD.sys and ETDSMBus.sys). During Intel SMBus recovery, ETDSMBus.sys does not enforce an u…

| Memory Corruption
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
0.0 NA
CVE-2026-18993 — NousResearch hermes-agent Memory Toolset model_tools.py access control

A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/model_tools.py of the component Memory Toolset. T…

hermes-agent | Authorization
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
0.0 NA
CVE-2026-18992 — zhayujie CowAgent Self-Evolution Review Agent executor.py _select_tools authorization

A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function _select_tools of the file agent/evolution/executor.py of the component Self-Evolution Review Age…

cowagent | Authorization
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
0.0 NA
CVE-2026-18325 — Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Uploa…

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up …

| Cross-Site Scripting
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
0.0 NA
CVE-2026-15991 — File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary F…

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possibl…

| Path Traversal
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
0.0 NA
CVE-2026-16636 — FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display …

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name…

| Cross-Site Scripting
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
7.5 HIGH
CVE-2026-18991 — nanocoai NanoClaw send_file core.ts path traversal

A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runner/src/mcp-tools/core.ts of the component send_file. Such ma…

nanoclaw | Remote | Path Traversal
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
7.5 HIGH
CVE-2026-18990 — letta-ai LettaBot API Status Route server.ts missing authentication

A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation results in missing authentic…

Remote | Authentication
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
6.5 MEDIUM
CVE-2026-18980 — nearai ironclaw shell.rs classify_command_risk command injection

A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classify_command_risk of the file src/tools/builtin/shell.rs. Such manipulation leads to command injection. Th…

ironclaw | Remote | Injection
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
6.5 MEDIUM
CVE-2026-18976 — NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges…

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function get_tool_definitions of the file agent/agent_init.py of the component disabled_toolsets Handler. Th…

hermes-agent | Remote | Authorization
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
5.5 MEDIUM
CVE-2026-18974 — heshengtao super-agent-party execute_tool_manually Endpoint server.py get_file_content in…

A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the component execute_tool_manually Endpoint. The manipulati…

Remote | Information Disclosure
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
7.5 HIGH
CVE-2026-18973 — heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-si…

A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitize_proxy_url of the file server.py of the component extension_proxy Route. The m…

Remote | Server-Side Request Forgery
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
0.0 NA
CVE-2026-67873 — lib60870-C Heap-Based Buffer Overflow

A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegment_encode() validates only the standalone segment length v…

| Memory Corruption
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
0.0 NA
CVE-2026-67872 — Systerel S2OPC Denial of Service Vulnerability

An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling

| Denial of Service
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
0.0 NA
CVE-2026-67871 — Systerel S2OPC Buffer Overflow

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, address_space_bs.c, sopc_node_mgt_helper_internal.c, and toolkit_test_ser…

| Memory Corruption
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
0.0 NA
CVE-2026-67870 — open62541 Null Pointer Dereference Vulnerability

In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesReques…

| Misconfiguration
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
7.5 HIGH
CVE-2026-67869 — open62541 Buffer Overflow Vulnerability

Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service_Call validates input arguments against runtime-resolved InputArguments metadata

Remote | Memory Corruption
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
9.3 CRITICAL
CVE-2026-67531 — FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), …

frontmcp | Remote | Misconfiguration
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
Showing 20 of 9804 Results