AAstrBotDevs

Products

Exploited and recent CVEs

• CVE-2026-17530 Medium 6.3 AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization 0.4%
• CVE-2026-17529 Medium 6.3 AstrBotDevs AstrBot astr_main_agent.py authorization 0.4%
• CVE-2026-16077 Medium 5.3 AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _normalize_rw_path link following 0.2%
• CVE-2026-16076 Medium 6.3 AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing 0.5%
• CVE-2026-16075 Medium 4.3 AstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization 0.4%
• CVE-2026-16074 Medium 6.3 AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery 0.3%
• CVE-2026-16073 Low 3.5 AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting 0.3%
• CVE-2026-15501 Medium 6.3 AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.test_mcp_connection server-side request forgery 0.3%
• CVE-2026-15500 Medium 6.3 AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery 0.4%
• CVE-2026-15499 Medium 6.3 AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization 0.3%
• CVE-2026-10213 Medium 5.4 AstrBotDevs AstrBot API Endpoint delete path traversal 0.4%
• CVE-2026-10212 Medium 6.3 AstrBotDevs AstrBot astr_main_agent.py astr_main_agent authorization 0.2%
• CVE-2026-10211 Medium 6.3 AstrBotDevs AstrBot fs.py _normalize_rw_path authorization 0.2%
• CVE-2026-10210 Medium 6.3 AstrBotDevs AstrBot skill_manager.py _sanitize_prompt_description injection 0.2%
• CVE-2026-8754 Medium 6.3 AstrBotDevs AstrBot File Upload chat.py post_file path traversal 0.4%
• CVE-2026-7579 High 7.3 AstrBotDevs AstrBot Dashboard auth.py hard-coded credentials 0.3%
• CVE-2026-6984 Medium 4.7 AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engine 0.3%
• CVE-2026-6119 Medium 6.3 AstrBotDevs AstrBot API Endpoint post_data.get server-side request forgery 0.3%
• CVE-2026-6118 Medium 6.3 AstrBotDevs AstrBot MCP Endpoint tools.py add_mcp_server command injection 2.5%
• CVE-2026-6117 Medium 6.3 AstrBotDevs AstrBot install-upload Endpoint plugin.py install_plugin_upload sandbox 0.2%
• CVE-2025-48957 High 7.5 AstrBot Has Path Traversal Vulnerability in /api/chat/get_file 0.8%