3
CVEs
0
Critical
0
High
0
KEV
3
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
1
LOW
2
Monthly CVE Trend
Affected Products (1)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-84886 | Uncontrolled resource consumption in simular-ai Agent-S up to version 0.3.2 allows remote unauthenticated attackers to exhaust server resources via the OCR HTTP API's ImageData function. By supplying crafted img_bytes input to the exposed endpoint in gui_agents/s1/utils/ocr_server.py, an attacker can trigger a denial-of-service condition against the OCR processing service. Publicly available exploit code exists on GitHub; the vendor did not respond to responsible disclosure, leaving no official patch. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-84887 | Denial of service in simular-ai Agent-S up to version 0.3.2 allows low-privileged remote attackers to disrupt the GUI action execution workflow by manipulating action parameters in grounding.py. The attack targets the model-generated action budget processing logic, causing improper resource handling (CWE-404) that results in agent availability loss. A public proof-of-concept titled 'AgentS_Action_Parameter_Budget_DoS_Report' is available on GitHub; the vendor did not respond to coordinated disclosure, leaving no official patch in place. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|
| CVE-2026-84885 | Denial of service in simular-ai Agent-S 0.3.1/0.3.2 allows authenticated remote attackers to crash or exhaust the CodeAgent service by sending crafted input to code_agent.py. The root cause is CWE-404 (Improper Resource Shutdown or Release), meaning a resource - likely a subprocess, file handle, or socket - is not properly released on certain code paths, enabling resource exhaustion. A public proof-of-concept is available on GitHub; no vendor patch exists as the vendor did not respond to disclosure. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|