Vulnerabilities
Summary — last 7 days
New vulnerabilities3,440▼ 1,366 vs. last week
Critical / high1,315▼ 1,446 vs. last week
New active exploitation (KEV)13▲ 6 vs. last week
Unscored (no CVSS)692▲ 632 vs. last week
More filters
2 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Awaiting Analysis | Critical (9.3) | 0.50% | — | Google Agent MeshAI | 10/19/2026 | 10/19/2026 | Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through… | |
| Awaiting Analysis | Critical (9.3) | 0.35% | — | Google OSS Agent MeshAI | 10/19/2026 | 10/19/2026 | Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability… |