CVE WatchOct 13, 2026

CVE-2026-108819

A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. This vulnerability affects the function exec of the component Agent

CVSS

7.3

High

EPSS

0.3%

p23

KEV

—

Exploit Today

0-100

Published: Oct 12, 2026 · Last modified: Oct 13, 2026 · CWE-913

EPSS · 30d

0.3%EPSS · 30 days0.5%

2026-10-122026-10-14

Technical description

A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. This vulnerability affects the function exec of the component Agent Orchestration Layer. Performing a manipulation of the argument code results in dynamically-managed code resources. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1027345.5 MED

2.2%

——1asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9.2d CVE-2026-1089485.4 MED

17.9%

——5A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2d CVE-2026-103663—

52.6%

——16Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store. Critically if the server process has write access to `/usr/lib/ollama` (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root. This issue was fixed in version 0.35.0.7d CVE-2026-1051806.3 MED

21.3%

——6A vulnerability was determined in Jeebase 0.0.1. This vulnerability affects the function updateUser of the file /user/update/info of the component UserService. Executing a manipulation of the argument user/tempUser can lead to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.9d CVE-2026-9295310.0 CRI

41.4%

——12vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.27d CVE-2026-9294610.0 CRI

57.5%

——17vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via child_process.28d