CVE ID :CVE-2026-67548 Published : Nov. 11, 2026, 10:17 p.m. | 58 minutes ago Description :taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.25, tinyagentos (taOS) registers all system settings routes…
CVE-2026-67547 – taOS: Authenticated Non-Admin Host Code Execution via Skill Runtime
CVE ID :CVE-2026-67547 Published : Nov. 11, 2026, 10:17 p.m. | 58 minutes ago Description :taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skill_id}/call endpoint in taOS executes…
CVE-2026-67546 – Heym: Command execution via POST /api/mcp/fetch-tools stdio transport: supplied command is spawned before MCP validation
CVE ID :CVE-2026-67546 Published : Nov. 11, 2026, 10:17 p.m. | 58 minutes ago Description :Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.75, the same…
CVE-2026-67544 – Heym: Playwright Custom Code Backend RCE via `playwrightCode` Field
CVE ID :CVE-2026-67544 Published : Nov. 11, 2026, 10:17 p.m. | 58 minutes ago Description :Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.71, Heym’s workflow…
CVE-2026-67543 – Heym Unsandboxed skill code execution: skills run via a local backend subprocess without the Docker isolation that Python tools mandate
CVE ID :CVE-2026-67543 Published : Nov. 11, 2026, 10:17 p.m. | 58 minutes ago Description :Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, heym hardens…
CVE-2026-126543 – WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php
CVE ID :CVE-2026-126543 Published : Nov. 11, 2026, 12:58 a.m. | 16 minutes ago Description :WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs…
CVE-2026-126542 – WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login
CVE ID :CVE-2026-126542 Published : Nov. 11, 2026, 12:58 a.m. | 16 minutes ago Description :WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as…
CVE-2026-126541 – WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints
CVE ID :CVE-2026-126541 Published : Nov. 11, 2026, 12:58 a.m. | 16 minutes ago Description :WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers…
CVE-2026-126539 – Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface
CVE ID :CVE-2026-126539 Published : Nov. 11, 2026, 12:58 a.m. | 16 minutes ago Description :Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending…
CVE-2026-126499 – Jellyfin before 12.0 Path Traversal via Library VirtualFolders Endpoints
CVE ID :CVE-2026-126499 Published : Nov. 11, 2026, 12:58 a.m. | 16 minutes ago Description :Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows…