CVE Vulnerability Catalog

TransformerOptimus SuperAGI v0.0.14 is vulnerable to incorrect access control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a caller-supplied tool_id and fail to verify organization ownership through the associated toolkit. A remote authenticated attacker from one organization can read or modify another organization's tool metadata through /tools/get/{tool_id} and /tools/update/{tool_id}.

TransformerOptimus SuperAGI v0.0.14 is vulnerable to incorrect access control in the agent template controller. In affected source snapshots, save_agent_as_template and publish_template in superagi/controllers/agent_template.py accept caller-supplied agent_id or agent_execution_id values and do not verify that the referenced agent or execution belongs to the authenticated user's organization.

Vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.

In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter.

In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the project_id parameter.

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id and fail to verify that the referenced agent belongs to the authenticated user's organization. A remote authenticated attacker from one organization can create or start execution records for agents owned by another organization through /agentexecutions/add or /agentexecutions/add_run.

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoint accepts an agent_id parameter but does not verify that the agent belongs to the authenticated user's organization.

In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different organization's project. The endpoints accept a project_id parameter but do not verify that the project belongs to the authenticated user's organization.

sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.

MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes, the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction. Preconditions: an authenticated MISP user with at least read access to an event owned by another organization, and the user issues a query for deleted attributes. Impact: Confidentiality: soft-deleted threat intelligence attributes from other organizations are disclosed to unauthorized users. Affected versions: MISP versions prior to v2.5.48.

MISP before version 2.5.48 has an authorization flaw in correlation handling during attribute searches. An authenticated user can access attributes and events they no longer have permission to view when an event has been restricted after correlation creation.

MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller's access rights against each related event. The correlation table stores a snapshot of the event's distribution level and sharing group at the time the correlation was created, and does not carry the published flag. As a result, events that the caller is not permitted to open—because they are unpublished, or because their distribution or sharing group has changed since the correlation was recorded—were still returned with their metadata. Preconditions: an authenticated user with access to at least one event in MISP, and the existence of correlation entries linking that event to other events the user should not be able to view. Impact: unauthorized disclosure of event metadata and potential reconnaissance of threat-intelligence event names and timelines across sharing groups. Affected: MISP versions prior to the fix commit (2ffa97f05).

MISP before version 2.5.48 has an improper input validation vulnerability in the decaying model import functionality. A user with perm_decaying permissions can overwrite existing models of other organizations, change their ownership, or create a default model, affecting scoring behavior.

MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript string context, meaning a malicious linked server could supply a tag ID containing characters (such as a single quote) that break out of the JavaScript string literal and inject arbitrary script. Preconditions: a linked/remote MISP server is configured and connected to the local instance, the linked server supplies a crafted tag ID in an event, and an authenticated user views the event preview and interacts with the affected tag element. Impact: arbitrary JavaScript execution in the context of the viewing user's browser session, potentially allowing session hijacking, data exfiltration, or unauthorized actions on behalf of the user. Affected versions: MISP prior to the fix commit (v2.5.48 or later, exact boundary unconfirmed).

MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session. Preconditions: the victim must be an authenticated MISP user with access to the TAXII object viewer, and the victim must open or view the crafted TAXII object. Impact: execution of arbitrary JavaScript in the victim's browser within the MISP application context, potential theft of session tokens, API keys, or other sensitive data, and potential for performing actions on behalf of the authenticated user. Affected versions: <2.5.48.

MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding. A malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks. Preconditions: the victim must be an authenticated user of the host MISP instance, a linked server must be configured on the host instance, and the victim must navigate to the ID Translator page for a given event. Affected versions: <2.5.48.

MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked (remote) MISP server could craft an event identifier containing HTML or JavaScript markup. When a user on the local MISP instance views the remote event preview index, the unescaped value is rendered directly in the browser, allowing arbitrary script execution in the victim's session. Preconditions: a linked/remote MISP server is configured and connected to the local instance, the attacker has sufficient access on the linked server to create or modify an event with a crafted identifier, and a victim user on the local instance views the remote event preview index page. Impact: execution of arbitrary JavaScript in the context of the MISP web application, potential session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user. Affected versions: <2.5.48.

prosemirror-view before version 1.42.3 has a vulnerability in paste handling that does not validate clipboard context attributes. An attacker can supply malicious HTML that executes JavaScript in the victim's browser when pasted.

Seroval from 0.12.0 until 1.6.2 has a vulnerability in fromJSON deserialization of a fulfilled Promise control node that can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.

Seroval before version 1.6.3 has a vulnerability in TypedArray deserialization that allows an attacker to provide a small JSON object with a large length value, causing excessive memory allocation and CPU or memory exhaustion.