https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-120313/https://vulnfeed.org/cve/CVE-2026-120313/Mon, 02 Nov 2026 03:17:29 +0000Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWith check to read, list, or write files outside the sandbox.https://vulnfeed.org/cve/CVE-2026-120314/https://vulnfeed.org/cve/CVE-2026-120314/Mon, 02 Nov 2026 03:17:29 +0000Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks.https://vulnfeed.org/cve/CVE-2026-120311/https://vulnfeed.org/cve/CVE-2026-120311/Mon, 02 Nov 2026 03:17:28 +0000Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passed to FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob() can disclose credentials and grant tokens or delete configuration files to weaken AuthGuardian authorization.https://vulnfeed.org/cve/CVE-2026-120312/https://vulnfeed.org/cve/CVE-2026-120312/Mon, 02 Nov 2026 03:17:28 +0000Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load() or save() to disclose sensitive JSON data or overwrite policy files such as AuthGuardian trust-level configuration.