HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-18973 — A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The ...

·Source: NIST NVD

Updated:

Executive Summary

A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitize_proxy_url of the file server.py of the component extension_proxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early

Analysis

A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitize_proxy_url of the file server.py of the component extension_proxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSS Score: 7.3. Published: 2026-08-06T01:16:29.410.

Indicators of Compromise (1)

CVE (1)
CVE-2026-18973
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 6, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Toolkit Hidden Inside Oracle Database Evades Endpoint Tools

Attackers used SQL injection to compile a post-exploitation toolkit inside an Oracle database

Infosecurity Magazine
MEDIUMVulnerabilityNEW

ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories

Apparently, opening the thing is now enough. A repo can run before the first prompt, a package can hide among hundreds, and a harmless-looking PDF can finish the job. This week runs on cheap leverage: exposed servers, recycled bugs, poisoned agent instructions, remote-access tools dressed as support software, and trusted defaults doing attackers a favor. Nothing here is especially mystical.

The Hacker News
CRITICALVulnerability

NVD CRITICAL: CVE-2026-53976 — OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving e...

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace boundary check in resolveReadPathFromContext. Attackers can exploit the vacuous isPath

CVE-2026-53976
NIST NVD