Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: dep0we Clear all filters
TI-2026-62119 CVE-2026-91989 · GHSA-p4ww-qqmg-mcg4

atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py

Priority MEDIUM 46

atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.01332 Published 2026-09-15 Fixed in 1.1.0 CWE-22
TI-2026-62118 CVE-2026-91988 · GHSA-wr36-693x-8mgc

atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP

Priority MEDIUM 42

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00318 Published 2026-09-15 Fixed in 1.1.0 CWE-319
TI-2026-62117 CVE-2026-91987 · GHSA-gpqc-jrqh-x9xp

atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model

Priority LOW 32

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero cost for unknown models not in the pricing table.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00476 Published 2026-09-15 Fixed in 1.1.0 CWE-770