2
CVEs
0
Critical
0
High
0
KEV
2
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
0
LOW
2
Monthly CVE Trend
Affected Products (1)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-90810 | Improper authorization in cosmicstack-labs mercury-agent's PermissionManager.checkShellCommand function (versions 1.1.0 through 1.1.13) allows authenticated remote attackers to bypass the shell command permission gate enforced in mercury-agent/src/capabilities/permissions.ts. A public exploit was released via GitHub issue #101, and the vendor has not responded to the coordinated disclosure. The CVSS 4.0 base score is 2.1 (low), reflecting constrained impact due to authentication prerequisites and limited C/I/A blast radius, with no CISA KEV listing confirmed at time of analysis. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|
| CVE-2026-90814 | Server-side request forgery in cosmicstack-labs Mercury Agent (versions 1.1.0 through 1.1.13) lets an attacker who can influence the `path` argument of the GitHub API handler force the agent to issue requests to arbitrary hosts, including internal services reachable from the agent's network position. The flaw is in the githubRequest function of src/utils/github.ts (CWE-918), and publicly available exploit code exists — the reporter's tracking issue (#81) on the project repository is public. The maintainer was informed early through an issue report but has not responded, so no vendor-released fix is confirmed at time of analysis. | LOW | 2.1 | 0.2% | 30 |
PoC
No patch
|