agentprime: tinyhumansai-openhumanEvery new CVE for tinyhumansai-openhuman.https://agentprime.io/CVE-2026-49407: OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growthhttps://agentprime.io/advisories/CVE-2026-49407/https://agentprime.io/advisories/CVE-2026-49407/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:46:35 GMTCVECVE-2026-54142: OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approvalhttps://agentprime.io/advisories/CVE-2026-54142/https://agentprime.io/advisories/CVE-2026-54142/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:42:19 GMTCVECVE-2026-54146: OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)https://agentprime.io/advisories/CVE-2026-54146/https://agentprime.io/advisories/CVE-2026-54146/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:41:31 GMTCVECVE-2026-54143: OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command executionhttps://agentprime.io/advisories/CVE-2026-54143/https://agentprime.io/advisories/CVE-2026-54143/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:40:23 GMTCVEcriticalCVE-2026-54141: OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`https://agentprime.io/advisories/CVE-2026-54141/https://agentprime.io/advisories/CVE-2026-54141/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:35:41 GMTCVEcriticalCVE-2026-49393: OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer tokenhttps://agentprime.io/advisories/CVE-2026-49393/https://agentprime.io/advisories/CVE-2026-49393/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:34:55 GMTCVECVE-2026-54145: OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)https://agentprime.io/advisories/CVE-2026-54145/https://agentprime.io/advisories/CVE-2026-54145/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:33:32 GMTCVECVE-2026-49405: OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event datahttps://agentprime.io/advisories/CVE-2026-49405/https://agentprime.io/advisories/CVE-2026-49405/CVSS 6.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:33:23 GMTCVECVE-2026-54144: OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesturehttps://agentprime.io/advisories/CVE-2026-54144/https://agentprime.io/advisories/CVE-2026-54144/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:14:46 GMTCVECVE-2026-54140: OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitizationhttps://agentprime.io/advisories/CVE-2026-54140/https://agentprime.io/advisories/CVE-2026-54140/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:13:31 GMTCVECVE-2026-49410: OpenHuman /auth/telegram CSRF allows attacker-controlled session implantationhttps://agentprime.io/advisories/CVE-2026-49410/https://agentprime.io/advisories/CVE-2026-49410/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 21:25:02 GMTCVECVE-2026-55743: OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command executionhttps://agentprime.io/advisories/CVE-2026-55743/https://agentprime.io/advisories/CVE-2026-55743/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 17 Jun 2026 14:08:33 GMTCVEcritical