2
CVEs
0
Critical
0
High
0
KEV
2
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
0
LOW
2
Monthly CVE Trend
Affected Products (3)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-84427 | Denial of service in zhayujie CowAgent up to version 2.1.7 allows a low-privileged remote attacker to crash or degrade availability by manipulating input to the Bash Tool component (agent/tools/bash/bash.py). The root cause is CWE-404 (Improper Resource Shutdown or Release), suggesting the Bash Tool fails to bound, drain, or release output buffers when executing shell commands - consistent with the public PoC title 'CowAgent_Bash_Output_Buffer_DoS_Report'. A proof-of-concept exploit is publicly available on GitHub, though no patch has been released and the vendor was unresponsive to disclosure. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|
| CVE-2026-84425 | Denial of service in zhayujie CowAgent up to version 2.1.3 allows a low-privileged remote attacker to crash or hang the agent service by sending a crafted input to the BrowserTool component in `agent/tools/browser/browser_tool.py`. The underlying cause (CWE-404) is improper resource shutdown or release - likely a browser subprocess or evaluation call that hangs indefinitely rather than timing out cleanly. A public proof-of-concept exists on GitHub; the vendor was unresponsive to disclosure, and no patch has been released. | LOW | 2.1 | 0.3% | 30 |
PoC
No patch
|