Aggregator

A vulnerability classified as problematic was found in cosmicstack-labs mercury-agent up to 1.2.0. This affects the function PermissionManager.checkShellCommand of the file mercury-agent/src/capabilities/permissions.ts of the component Shell Permission Manifest. Executing a manipulation can lead to information disclosure. This vulnerability is tracked as CVE-2026-90811. The attack is restricted to local execution. Moreover, an exploit is present. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability classified as critical has been found in cosmicstack-labs mercury-agent up to 1.1.13. The impacted element is the function PermissionManager.checkShellCommand of the file mercury-agent/src/capabilities/permissions.ts of the component Shell Command Permission Check. Performing a manipulation results in improper authorization. This vulnerability is identified as CVE-2026-90810. The attack can be initiated remotely. Additionally, an exploit exists. The project was informed of the problem early through an issue report but has not responded yet.

Submit #922626 / VDB-403318

Submit #922609 / VDB-403317

Submit #922880 / VDB-403316

Submit #922879 / VDB-403315

Submit #922878 / VDB-403314

Submit #922877 / VDB-403313

Submit #922876 / VDB-403312

A vulnerability described as critical has been identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. This vulnerability is referenced as CVE-2026-90809. It is possible to launch the attack remotely. No exploit is available. It is best practice to apply a patch to resolve this issue.

A vulnerability marked as critical has been reported in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. The identification of this vulnerability is CVE-2026-90808. It is possible to initiate the attack remotely. There is no exploit available. Applying a patch is the recommended action to fix this issue.

Submit #922850 / VDB-403311

Submit #922849 / VDB-403310

A vulnerability labeled as critical has been found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/agent-to-agent/agent-route.ts of the component Attachment Handler. The manipulation results in link following. This vulnerability was named CVE-2026-90807. The attack may be performed from remote. In addition, an exploit is available. It is advisable to implement a patch to correct this issue.

Submit #922841 / VDB-403309

A vulnerability identified as critical has been detected in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulk_views.py of the component Bulk Case Update. The manipulation leads to missing authorization. This vulnerability is uniquely identified as CVE-2026-90806. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Submit #921799 / VDB-402181

Submit #921765 / VDB-402176

Submit #920489 / VDB-403308

A vulnerability categorized as critical has been discovered in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument doc_mail/doc_pswd can lead to sql injection. This vulnerability is handled as CVE-2026-90805. The attack can be executed remotely. Additionally, an exploit exists. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.