agentprime: microsoft-ufoEvery new CVE for microsoft-ufo.https://agentprime.io/CVE-2026-105793: Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`https://agentprime.io/advisories/CVE-2026-105793/https://agentprime.io/advisories/CVE-2026-105793/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 06 Oct 2026 14:12:17 GMTCVEcriticalCVE-2026-105792: Microsoft UFO: Authenticated task-result request can deadlock UFO server session managerhttps://agentprime.io/advisories/CVE-2026-105792/https://agentprime.io/advisories/CVE-2026-105792/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 06 Oct 2026 14:10:52 GMTCVECVE-2026-105791: Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injectionhttps://agentprime.io/advisories/CVE-2026-105791/https://agentprime.io/advisories/CVE-2026-105791/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 06 Oct 2026 14:09:23 GMTCVECVE-2026-105790: Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirectshttps://agentprime.io/advisories/CVE-2026-105790/https://agentprime.io/advisories/CVE-2026-105790/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 06 Oct 2026 14:08:24 GMTCVECVE-2026-105789: Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` toolhttps://agentprime.io/advisories/CVE-2026-105789/https://agentprime.io/advisories/CVE-2026-105789/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 06 Oct 2026 14:07:25 GMTCVECVE-2026-105788: Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_apphttps://agentprime.io/advisories/CVE-2026-105788/https://agentprime.io/advisories/CVE-2026-105788/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 06 Oct 2026 14:05:24 GMTCVECVE-2026-62316: Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Executionhttps://agentprime.io/advisories/CVE-2026-62316/https://agentprime.io/advisories/CVE-2026-62316/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 21 Aug 2026 20:17:21 GMTCVECVE-2026-73297: Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validationhttps://agentprime.io/advisories/CVE-2026-73297/https://agentprime.io/advisories/CVE-2026-73297/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 16:31:35 GMTCVECVE-2026-73296: Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosurehttps://agentprime.io/advisories/CVE-2026-73296/https://agentprime.io/advisories/CVE-2026-73296/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 16:29:03 GMTCVEcriticalCVE-2026-55440: Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of servicehttps://agentprime.io/advisories/CVE-2026-55440/https://agentprime.io/advisories/CVE-2026-55440/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Jul 2026 15:35:51 GMTCVECVE-2026-54568: Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_infohttps://agentprime.io/advisories/CVE-2026-54568/https://agentprime.io/advisories/CVE-2026-54568/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Jul 2026 15:32:06 GMTCVECVE-2026-46538: Microsoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injectionhttps://agentprime.io/advisories/CVE-2026-46538/https://agentprime.io/advisories/CVE-2026-46538/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 May 2026 21:56:55 GMTCVECVE-2026-46416: Microsoft UFO shared WebSocket handler state causes cross-client response hijackinghttps://agentprime.io/advisories/CVE-2026-46416/https://agentprime.io/advisories/CVE-2026-46416/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 May 2026 21:56:14 GMTCVECVE-2026-46414: Microsoft UFO WebSocket role spoofing allows authenticated peer task hijackinghttps://agentprime.io/advisories/CVE-2026-46414/https://agentprime.io/advisories/CVE-2026-46414/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 May 2026 21:54:51 GMTCVECVE-2026-46402: Microsoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directoryhttps://agentprime.io/advisories/CVE-2026-46402/https://agentprime.io/advisories/CVE-2026-46402/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 May 2026 21:54:06 GMTCVECVE-2026-46544: Microsoft UFO reuses client-supplied WebSocket session IDs and replays stale task results to new authenticated requestershttps://agentprime.io/advisories/CVE-2026-46544/https://agentprime.io/advisories/CVE-2026-46544/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 May 2026 21:53:11 GMTCVECVE-2026-45322: OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSONhttps://agentprime.io/advisories/CVE-2026-45322/https://agentprime.io/advisories/CVE-2026-45322/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 May 2026 21:32:50 GMTCVE