JJovancoding

Products

Exploited and recent CVEs

• CVE-2026-120314 High 7.3 Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations 0.4%
• CVE-2026-120313 High 7.5 Network-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePath 0.5%
• CVE-2026-120312 High 8.8 Network-AI 5.13.4 before 5.15.5 Path Traversal via AgentVCR Cassette Name 0.4%
• CVE-2026-120311 High 8.8 Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID 0.4%
• CVE-2026-109332 Low 3.1 Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport 0.1%
• CVE-2026-109331 High 7.4 Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget 0.1%
• CVE-2026-109330 Medium 4.3 Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer 0.2%
• CVE-2026-73615 High 8.8 Network-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote Mismatch 0.7%
• CVE-2026-73614 High 8.8 Network-AI ClaudeHookBridge Deny Pattern Bypass via Truncation 0.7%
• CVE-2026-58484 High 7.1 Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning 0.2%
• CVE-2026-58482 Medium 5.9 Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions 0.2%
• CVE-2026-46701 High 7.6 Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret 0.2%
• CVE-2026-58481 Medium 6.5 Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory 0.2%
• CVE-2026-58414 Medium 5.5 Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups 0.2%
• CVE-2026-58413 Medium 6.1 EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data 0.2%
• CVE-2026-54051 Critical 9.9 Network-AI has an an OS Command Injection issue 0.5%
• CVE-2026-64623 High 8.6 Network-AI before 5.13.4 Cryptographic Signature Verification Bypass 0.3%
• CVE-2026-64622 High 7.5 Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox 0.5%
• CVE-2026-48814 Critical 9.1 Network-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701) 0.4%
• CVE-2026-42856 High 8.7 Network-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool calls 0.5%