agentprime: CWE-913

CVE-2026-121170: Google Chrome: Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a…

Tue, 03 Nov 2026 20:42:45 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution

Tue, 03 Nov 2026 16:37:44 GMT

Metalama.Framework <2025.1.18 || >=2026.0.1-preview, <2026.0.25 || >=2026.1.0-preview, <2026.1.19, fixed in 2025.1.18, 2026.0.25, 2026.1.19. CVSS 7.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-118538: a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes

Wed, 28 Oct 2026 22:00:18 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-116612: A flaw was found in GStreamer Editing Services (gst-editing-services).

Mon, 26 Oct 2026 16:48:37 GMT

CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-108948: code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes

Tue, 13 Oct 2026 01:15:20 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-108819: agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources

Mon, 12 Oct 2026 09:15:19 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-103663: Path Traversal leading to Remote Code Execution in Ollama

Thu, 08 Oct 2026 13:19:04 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

vm2 contains a sandbox escape vulnerability

Wed, 07 Oct 2026 18:05:00 GMT

vm2 <3.12.1, fixed in 3.12.1. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

vm2: Sandbox Escape (NodeVM)

Mon, 05 Oct 2026 22:47:09 GMT

vm2 <3.11.8, fixed in 3.11.8. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

Mon, 05 Oct 2026 22:45:22 GMT

vm2 >=3.11.0, <3.11.8, fixed in 3.11.8. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Mon, 05 Oct 2026 22:34:50 GMT

vm2 <3.11.7, fixed in 3.11.7. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

Mon, 05 Oct 2026 22:34:22 GMT

vm2 >=3.10.1, <3.11.7, fixed in 3.11.7. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-105180: Jeebase UserService info updateUser dynamically-determined object attributes

Mon, 05 Oct 2026 02:00:16 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

Thu, 01 Oct 2026 15:34:58 GMT

vm2 >=3.11.4, <3.11.7, fixed in 3.11.7. CVSS 9.5 (Critical). Critical: CVSS score 9.5: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector

Thu, 01 Oct 2026 15:28:07 GMT

vm2 >=3.10.2, <3.11.7, fixed in 3.11.7. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Duplicate Advisory: Sandbox Escape (NodeVM)

Thu, 17 Sep 2026 15:32:16 GMT

vm2 <=3.11.7, no fixed version yet. CVSS 10.0 (Critical). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Duplicate Advisory: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

Thu, 17 Sep 2026 15:32:16 GMT

vm2 >=3.11.0, <=3.11.7, no fixed version yet. CVSS 10.0 (Critical). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Duplicate Advisory: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Thu, 17 Sep 2026 15:32:15 GMT

vm2 <=3.11.6, no fixed version yet. CVSS 10.0 (Critical). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Duplicate Advisory: NodeVM nesting guard accepts array-shaped require and permits host RCE

Thu, 17 Sep 2026 15:32:14 GMT

vm2 >=3.11.4, <=3.11.6, no fixed version yet. CVSS 9.0 (Critical). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-90999: Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment

Wed, 16 Sep 2026 15:45:47 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-92217: a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes

Wed, 16 Sep 2026 02:00:16 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-12354: IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection

Tue, 15 Sep 2026 17:13:11 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-41870: Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)

Wed, 09 Sep 2026 10:43:04 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-65181: Apache Impala: RCE via External Data Source Class Loading

Wed, 09 Sep 2026 10:40:51 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85408: Eleveo Quality Management Conversation events dynamically-determined object attributes

Fri, 04 Sep 2026 04:15:09 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-84430: gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes

Wed, 02 Sep 2026 00:45:13 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-59283: Spring Framework Safety Guard Bypass via SpEL Expression Compilation

Thu, 27 Aug 2026 17:57:40 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-48105: Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive

Fri, 21 Aug 2026 22:47:13 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-76023: Google Chrome: Improper resource control in Linux Toolkit Theming in Google Chrome prior to…

Thu, 20 Aug 2026 20:51:20 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

Thu, 20 Aug 2026 17:26:52 GMT

asteval <1.0.9, fixed in 1.0.9. CVSS 5.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-71470: Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa

Wed, 19 Aug 2026 17:11:02 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

Mon, 17 Aug 2026 17:32:41 GMT

vm2 <3.11.6, fixed in 3.11.6. CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-73226: Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlist

Tue, 11 Aug 2026 18:44:01 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection

Mon, 29 Jun 2026 11:50:49 GMT

praisonai <4.6.34, fixed in 4.6.34. CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading

Thu, 25 Jun 2026 18:25:42 GMT

langgraph-checkpoint <4.1.1, fixed in 4.1.1. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

Tue, 16 Jun 2026 20:13:07 GMT

crawl4ai <0.8.7, fixed in 0.8.7. CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass

Fri, 29 May 2026 17:51:05 GMT

vm2 <3.11.4, fixed in 3.11.4. CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE

Fri, 29 May 2026 17:50:22 GMT

vm2 <3.11.4, fixed in 3.11.4. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

vm2 is Vulnerable to Sandbox Breakout Through Promise Species

Fri, 29 May 2026 17:40:15 GMT

vm2 <3.11.4, fixed in 3.11.4. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

vm2 has a Sandbox Escape issue

Fri, 29 May 2026 17:33:58 GMT

vm2 <3.11.4, fixed in 3.11.4. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-48700: An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0.

Fri, 22 May 2026 18:43:05 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

LiteLLM has a sandbox escape in custom-code guardrail

Mon, 11 May 2026 16:17:23 GMT

litellm >=1.81.8, <1.83.10, fixed in 1.83.10. CVSS 8.8 (High). Critical: CVSS score 8.8 (7.0 or more) and EPSS 0.17 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-7381: Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting

Wed, 29 Apr 2026 22:13:35 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-5251: z-9527 admin User Update Endpoint user.js dynamically-determined object attributes

Wed, 01 Apr 2026 02:30:14 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-5248: gougucms User Registration Login.php reg_submit dynamically-determined object attributes

Wed, 01 Apr 2026 00:45:12 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

Mon, 30 Mar 2026 17:16:24 GMT

@nocobase/plugin-workflow-javascript <2.0.28, fixed in 2.0.28. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. CVSS score 10.0 (7.0 or more) and EPSS 0.35 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names

Fri, 20 Mar 2026 15:58:14 GMT

graphiti <1.10.2, fixed in 1.10.2. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Apache Airflow Providers Http has Unsafe Pickle Deserializatio leading to RCE via HttpOperator

Mon, 09 Mar 2026 12:31:38 GMT

apache-airflow-providers-http <6.0.0, fixed in 6.0.0. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

n8n Has Expression Escape Vulnerability Leading to RCE

Wed, 04 Feb 2026 18:03:09 GMT

n8n <1.123.17 || >=2.0.0, <2.5.2, fixed in 1.123.17, 2.5.2. CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Crafter CMS has Improper Control of Dynamically-Managed Code Resources

Mon, 02 Feb 2026 18:31:33 GMT

org.craftercms:craftercms >=4.0.0, <4.5.0, fixed in 4.5.0. CVSS 4.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.