Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
CVE-2026-91989
  • github.com/dep0we/atomic-agents-stack
 atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py 15 Sep
  • Fix available
  • Severity - 8.7 (High)
CVE-2026-91988
  • github.com/dep0we/atomic-agents-stack
 atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP 15 Sep
  • Fix available
  • Severity - 9.2 (Critical)
CVE-2026-91987
  • github.com/dep0we/atomic-agents-stack
 atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model 15 Sep
  • Fix available
  • Severity - 7.1 (High)
GHSA-j659-8xh6-5pq5
  • PyPI/atomic-agents-stack
 atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard 17 Aug
  • Fix available
  • Severity - 8.7 (High)
GHSA-xhcr-cqfr-m3hv
  • PyPI/atomic-agents-stack
 atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE) 17 Aug
  • Fix available
  • Severity - 8.7 (High)
GHSA-rm43-82j9-r4mj
  • PyPI/atomic-agents-stack
 atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read 13 Aug
  • Fix available
  • Severity - 8.2 (High)