Vulnerabilities

TI-2026-34711 CVE-2026-47119 · GHSA-9pw8-7895-6wxc

Agent Zero < 1.15 Stored XSS via image_get API Endpoint

LOW 24

Agent Zero before version 1.15 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript in the application origin by serving SVG files through the image_get API endpoint…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00236 Published 2026-05-27 Fixed in 1.15 CWE-79

TI-2026-03751 CVE-2026-4308 · GHSA-8g9j-3hrr-2hvm

frdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery

MEDIUM 57

A weakness has been identified in frdel/agent0ai agent-zero 0.9.7.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00214 Published 2026-03-17 No fix listed CWE-918

TI-2026-03750 CVE-2026-4307 · GHSA-fcq3-632g-qpmv

frdel/agent0ai agent-zero files.py get_abs_path path traversal

MEDIUM 57

A security flaw has been discovered in frdel/agent0ai agent-zero 0.9.7-10.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0038 Published 2026-03-17 No fix listed CWE-22

Vulnerabilities

Filters

Agent Zero < 1.15 Stored XSS via image_get API Endpoint

frdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery

frdel/agent0ai agent-zero files.py get_abs_path path traversal