These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-12203 is a MEDIUM severity vulnerability in AI-Trader. The vulnerability affects the Research Export component, specifically the file /api/research/agents.csv. An attacker can exploit this vulnerability remotely, resulting in information disclosure. The CVSS score for this vulnerability is 5.5.
A path traversal vulnerability in DeepCode's SPA catch-all route allows unauthenticated attackers to read arbitrary files by supplying percent-encoded path segments to bypass Starlette's path normalization. The vulnerability exists in new_ui/backend/main.py through commit c991dc2. Attackers can encode slashes as %2F and dots as %2E%2E to traverse outside the FRONTEND_DIST directory, exposing sensitive fil [truncated]
CVE-2026-40516 is a high-severity vulnerability in OpenHarness, a tool for continuous integration and delivery. The vulnerability allows attackers to access private and localhost HTTP services by manipulating tool parameters without proper validation of target addresses. This can be done by influencing an agent session to invoke the web_fetch and web_search tools against loopback, RFC1918, link-local, or [truncated]
CVE-2026-40515 is a high-severity vulnerability in OpenHarness that allows attackers to read sensitive files due to incomplete path normalization. The vulnerability exists in OpenHarness before commit bd4df81 and is caused by the permission checker's incomplete path normalization, allowing attackers to invoke built-in grep and glob tools with sensitive root directories. Users of OpenHarness should be awar [truncated]
CVE-2026-40503 is a path traversal vulnerability in OpenHarness prior to commit dd1d235. This CVE record was published on 2026-04-16T01:16:11.440Z and was last modified on 2026-07-14T21:16:48.147Z. The vulnerability allows remote gateway users with chat access to read arbitrary files by supplying path traversal sequences to the /memory show slash command. This could potentially lead to unauthorized access [truncated]
CVE-2026-40502 is a high-severity command injection vulnerability in OpenHarness prior to commit dd1d235. Remote gateway users with chat access can exploit this vulnerability to invoke sensitive administrative commands. The vulnerability exists due to insufficient distinction between local-only and remote-safe commands in the gateway handler. This issue allows attackers to execute administrative commands [truncated]
CVE-2026-22682 is an improper access control vulnerability in OpenHarness built-in file tools. Attackers can exploit inconsistent parameter handling in permission enforcement to read arbitrary local files outside the intended repository scope. This could allow access to sensitive files such as configuration files, credentials, and SSH material. The vulnerability exists in OpenHarness prior to commit 166fcfe.