Aggregator

Submit #797682 / VDB-359603

Submit #797681 / VDB-205147

A vulnerability marked as critical has been reported in ByteDance coze-studio up to 0.5.1. Affected by this vulnerability is the function ExecuteSQL of the file backend/domain/memory/database/service/database_impl.go of the component databaseTool. Performing a manipulation results in sql injection. This vulnerability is identified as CVE-2026-7023. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

Она меньше атома, но весит как астероид…

Name: HACKTHEON SEJONG 2026 Qualifier (an HACKTHEON SEJONG event.)
Date: April 25, 2026, 1 a.m. — 25 April 2026, 08:00 UTC  [add to calendar]
Format: Jeopardy
On-line
Location: Sejong
Offical URL: https://hacktheon.org/
Rating weight: 0
Event organizers: Sejong City Hall

A vulnerability labeled as critical has been found in SmythOS sre up to 0.0.15. Affected is the function AgentRuntime of the file packages/core/src/subsystems/AgentManager/AgentRuntime.class.ts of the component HTTP Header Handler. Such manipulation of the argument X-DEBUG-RUN/X-DEBUG-INJ leads to improper authentication. This vulnerability is referenced as CVE-2026-7022. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability identified as problematic has been detected in SmythOS sre up to 0.0.15. This impacts an unknown function of the file packages/sdk/src/LLM/utils.ts of the component Connector Service. This manipulation of the argument baseURL causes information disclosure. The identification of this vulnerability is CVE-2026-7021. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #797644 / VDB-359602

Submit #797643 / VDB-359601