Agent Zero 0.9.7-10's get_abs_path function in python/helpers/files.py is vulnerable to path traversal, allowing authenticated remote attackers to access files outside intended directories with limited confidentiality impact. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor.
A Server-Side Request Forgery (SSRF) vulnerability exists in frdel/agent-zero version 0.9.7 within the handle_pdf_document function of python/helpers/document_query.py. This allows authenticated remote attackers to manipulate PDF document handling to perform arbitrary server-side requests, potentially accessing internal services or exfiltrating sensitive data. A public proof-of-concept exploit is available, and the vendor has not responded to early disclosure notifications, increasing the practical risk of exploitation.
A security vulnerability in A flaw (CVSS 3.9). Remediation should follow standard vulnerability management procedures.
A flaw was found in libsoup, a library used by applications to send network requests.
A security vulnerability in A flaw (CVSS 3.9). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability in A vulnerability exists in the Community Tier of Harden-Runner that (CVSS 2.7). Remediation should follow standard vulnerability management procedures.
HCL Sametime is vulnerable to broken server-side validation.
A security vulnerability in affected (CVSS 2.3). Remediation should follow standard vulnerability management procedures.
The password reset mechanism in Parse Server fails to enforce single-use guarantees on reset tokens, allowing attackers to exploit a race condition during concurrent password reset requests. An attacker who intercepts a password reset token can submit a password change request that races against the legitimate user's own reset attempt, potentially causing the attacker's new password to take effect while the user believes their own password was successfully changed. All Parse Server deployments using the password reset feature are affected, with patched versions available from the vendor (Parse Server versions 8.6.48 and later, and 9.6.0-alpha.28 and later).
CVE-2026-4202 is a security vulnerability (CVSS 2.3). Remediation should follow standard vulnerability management procedures.
A vulnerability was identified in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433.
Crash-inducing denial-of-service in the MongoDB C Driver (all versions before 2.2.3) allows a network-privileged adversary - either a compromised third-party cloud server the application trusts or a man-in-the-middle attacker on the network path - to crash the consuming application by delivering a malformed HTTP response. The vulnerability carries a CVSS 4.0 score of 2.0 due to high attack complexity, prerequisite network positioning, and impact limited strictly to low availability on the vulnerable system. No public exploit code exists and EPSS probability sits at 0.03% (8th percentile), indicating negligible observed exploitation activity at time of analysis.
CVE-2026-32766 is a security vulnerability. Remediation should follow standard vulnerability management procedures. Vendor patch is available.