{"items":[{"id":"CVE-2026-17530","published":"2026-07-27T15:45:10.355Z","updated":"2026-07-27T18:19:50.134Z","title":"AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00374,"kevAdded":null,"exploit":true},{"id":"CVE-2026-17529","published":"2026-07-27T15:15:11.108Z","updated":"2026-07-27T16:21:50.548Z","title":"AstrBotDevs AstrBot astr_main_agent.py authorization","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00374,"kevAdded":null,"exploit":true},{"id":"CVE-2026-16077","published":"2026-07-18T06:45:07.835Z","updated":"2026-07-20T15:17:34.665Z","title":"AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _normalize_rw_path link following","severity":"MEDIUM","score":4.8,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.0021,"kevAdded":null,"exploit":true},{"id":"CVE-2026-16076","published":"2026-07-18T05:30:08.451Z","updated":"2026-07-20T19:10:52.910Z","title":"AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00506,"kevAdded":null,"exploit":true},{"id":"CVE-2026-16075","published":"2026-07-18T04:00:08.494Z","updated":"2026-07-21T02:27:02.076Z","title":"AstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00374,"kevAdded":null,"exploit":true},{"id":"CVE-2026-16074","published":"2026-07-17T20:15:09.598Z","updated":"2026-07-20T17:57:32.069Z","title":"AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00347,"kevAdded":null,"exploit":true},{"id":"CVE-2026-16073","published":"2026-07-17T18:15:07.652Z","updated":"2026-07-22T15:38:08.117Z","title":"AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting","severity":"MEDIUM","score":5.1,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00331,"kevAdded":null,"exploit":true},{"id":"CVE-2026-15501","published":"2026-07-12T12:30:07.184Z","updated":"2026-07-15T16:05:35.347Z","title":"AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.test_mcp_connection server-side request forgery","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00347,"kevAdded":null,"exploit":true},{"id":"CVE-2026-15500","published":"2026-07-12T12:00:07.716Z","updated":"2026-07-13T15:41:38.976Z","title":"AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00366,"kevAdded":null,"exploit":true},{"id":"CVE-2026-15499","published":"2026-07-12T11:45:08.034Z","updated":"2026-07-13T15:18:55.453Z","title":"AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00347,"kevAdded":null,"exploit":true},{"id":"CVE-2026-10213","published":"2026-06-01T01:45:07.294Z","updated":"2026-06-01T11:48:08.449Z","title":"AstrBotDevs AstrBot API Endpoint delete path traversal","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00372,"kevAdded":null,"exploit":true},{"id":"CVE-2026-10212","published":"2026-06-01T01:30:10.133Z","updated":"2026-06-01T15:23:51.271Z","title":"AstrBotDevs AstrBot astr_main_agent.py astr_main_agent authorization","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00211,"kevAdded":null,"exploit":true},{"id":"CVE-2026-10211","published":"2026-06-01T01:15:09.789Z","updated":"2026-06-01T14:58:16.952Z","title":"AstrBotDevs AstrBot fs.py _normalize_rw_path authorization","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00201,"kevAdded":null,"exploit":true},{"id":"CVE-2026-10210","published":"2026-06-01T01:00:14.234Z","updated":"2026-06-01T13:26:33.963Z","title":"AstrBotDevs AstrBot skill_manager.py _sanitize_prompt_description injection","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00228,"kevAdded":null,"exploit":true},{"id":"CVE-2026-8754","published":"2026-05-17T12:15:09.708Z","updated":"2026-05-18T20:05:27.494Z","title":"AstrBotDevs AstrBot File Upload chat.py post_file path traversal","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00358,"kevAdded":null,"exploit":true},{"id":"CVE-2026-7579","published":"2026-05-01T11:30:15.357Z","updated":"2026-05-04T13:29:13.320Z","title":"AstrBotDevs AstrBot Dashboard auth.py hard-coded credentials","severity":"MEDIUM","score":6.9,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00288,"kevAdded":null,"exploit":true},{"id":"CVE-2026-6984","published":"2026-04-25T15:30:24.742Z","updated":"2026-04-27T17:32:51.922Z","title":"AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engine","severity":"MEDIUM","score":5.1,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00299,"kevAdded":null,"exploit":true},{"id":"CVE-2026-6119","published":"2026-04-12T05:00:20.093Z","updated":"2026-04-14T16:33:26.198Z","title":"AstrBotDevs AstrBot API Endpoint post_data.get server-side request forgery","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00257,"kevAdded":null,"exploit":true},{"id":"CVE-2026-6118","published":"2026-04-12T04:45:09.857Z","updated":"2026-04-14T13:56:56.956Z","title":"AstrBotDevs AstrBot MCP Endpoint tools.py add_mcp_server command injection","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.02533,"kevAdded":null,"exploit":true},{"id":"CVE-2026-6117","published":"2026-04-12T04:30:12.395Z","updated":"2026-04-15T15:18:45.908Z","title":"AstrBotDevs AstrBot install-upload Endpoint plugin.py install_plugin_upload sandbox","severity":"MEDIUM","score":5.3,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00224,"kevAdded":null,"exploit":true},{"id":"CVE-2025-48957","published":"2025-06-02T11:16:14.370Z","updated":"2025-06-23T18:03:57.703Z","title":"AstrBot Has Path Traversal Vulnerability in /api/chat/get_file","severity":"HIGH","score":7.5,"vendor":"AstrBotDevs","product":"AstrBot","kev":false,"epss":0.00771,"kevAdded":null,"exploit":true}]}