PULSE
ES
FEED
ransompanzer reclama a Valode & Pistre · FR · Professional Servicesransompanzer reclama a Zenidoc · Professional Servicesransomn0n reclama a MarieBelle New York · US · Retail & E-Commerceransomn0n reclama a PG Group (Pure Options) · Financial Servicesransomemperador reclama a CMC AUDITORES SRL · AR · Professional Servicesransombyod reclama a Decorolala · Retail & E-Commerceransomaurora reclama a The Buckner Company, Inc. · US · Otherransomplay reclama a The Innovation Group · US · Otherransomplay reclama a DFK Group · DE · Professional Servicesransomplay reclama a Saddlers Court MFG · GB · Manufacturingransomplay reclama a Culinary Specialties · US · Agriculture and Food Productionransomplay reclama a Advanced Imaging Solutions · MN · Technologyransomorova reclama a The Park Lane Hong Kong · HK · Hospitalityransomorova reclama a Libre Wireless Technologies · IN · Technologyransompanzer reclama a Valode & Pistre · FR · Professional Servicesransompanzer reclama a Zenidoc · Professional Servicesransomn0n reclama a MarieBelle New York · US · Retail & E-Commerceransomn0n reclama a PG Group (Pure Options) · Financial Servicesransomemperador reclama a CMC AUDITORES SRL · AR · Professional Servicesransombyod reclama a Decorolala · Retail & E-Commerceransomaurora reclama a The Buckner Company, Inc. · US · Otherransomplay reclama a The Innovation Group · US · Otherransomplay reclama a DFK Group · DE · Professional Servicesransomplay reclama a Saddlers Court MFG · GB · Manufacturingransomplay reclama a Culinary Specialties · US · Agriculture and Food Productionransomplay reclama a Advanced Imaging Solutions · MN · Technologyransomorova reclama a The Park Lane Hong Kong · HK · Hospitalityransomorova reclama a Libre Wireless Technologies · IN · Technology
← All CVEs
CVE WatchOct 12, 2026

CVE-2026-108816

A vulnerability was found in agno-agi agno up to 3.0.6. Affected by this vulnerability is the function run_python_code of the file python.py

CVSS

6.3

Medium

EPSS

0.3%

p21

KEV

—

Exploit Today

6

0-100

Published: Oct 12, 2026 · Last modified: Oct 12, 2026 · CWE-74 · CWE-94

EPSS · 30d

Not enough EPSS history yet.

Technical description

A vulnerability was found in agno-agi agno up to 3.0.6. Affected by this vulnerability is the function run_python_code of the file python.py of the component PythonTools. The manipulation of the argument code results in code injection. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1088344.3 MED
—
——0A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file ww_page.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.1dCVE-2026-1088294.7 MED
—
——0A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 08f572654edee1db8f9db091c9949825c6c69339. It is advisable to implement a patch to correct this issue.1dCVE-2026-1088284.1 MED
—
——0A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is publicly available and might be used. The vendor explains: "`set_function`/`use_function` are not editable through any normal admin UI (only at plugin-install time via SQL, or via direct database access)".1dCVE-2026-1088274.1 MED
—
——0A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zen_call_function of the file admin/includes/functions/general.php of the component Administrative Module Management. Executing a manipulation of the argument use_function can lead to code injection. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor explains: "We don't consider this an independently exploitable vulnerability. The only path to controlling `use_function`/`configuration_value` in the `configuration` table is the SQL Patch tool (raw arbitrary SQL execution) or a pre-existing SQL injection elsewhere".1dCVE-2026-1088267.3 HIG
—
——0A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zen_db_perform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txn_id results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named 557154f4fa025f51553094f47b06aa024220c48f. It is suggested to install a patch to address this issue.1dCVE-2026-1088246.3 MED
—
——0A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This manipulation of the argument calculated field causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Patch name: 8509e218e6c1f0080eee9e379f269b2104785ef7. It is recommended to apply a patch to fix this issue.1d