agent-router's insecure default cryptographic seed allows session-token forgery and impersonation
The extproc and control components hardcode the MCP session encryption seed as the public string "default-insecure-seed". Because the salt travels with the ciphertext and the key is derived only from the seed, an attacker needs no extra privileges to use the known seed to decrypt, tamper with, or forge mcp-session-id tokens, bypass authentication, mix sessions across clients, and gain unauthorized access, severely damaging confidentiality and integrity.
Component
agent-router is middleware for proxy routing and session management. Its core architecture depends on MCP (Model Context Protocol) sessions and uses encrypted session identifiers for secure communication and state isolation between clients and backend services, including consistent session handling across multiple replicas.
Type
Initialization of a Resource with an Insecure Default (CWE-1188)
Do not hardcode sensitive defaults. Require users to configure a random encryption seed in production, detect an unset seed at startup and warn or refuse to serve, and rotate keys so old keys expire promptly.
CSSA Exclusive Early Warning
9.9 Critical
A CTE parsing flaw in the crewAI NL2SQL tool bypasses read-only mode and allows data deletion
An attacker abuses a flaw in the regular-expression matching logic by wrapping a write-capable common table expression (CTE) with the AS MATERIALIZED or AS NOT MATERIALIZED modifier. The defense only recognizes the standard AS ( form, so a CTE that contains data-modifying statements such as DELETE is wrongly treated as a read-only query and executed. Even in the default read-only mode a malicious user can delete or modify data, severely damaging integrity and confidentiality.
Component
crewAI is a development tool built on a multi-agent collaboration framework. Its NL2SQLTool turns natural language into structured query language. It connects to a database instance and converts natural-language instructions into executable SQL, mainly for automated data analysis, report generation, and business-logic queries, so people who are not technical can interact with the backend database.
Update the regular expression that parses CTE structure so it also recognizes PostgreSQL materialized modifiers and every CTE variant is identified and blocked. Also use a strict allowlist or deeper AST parsing to check SQL semantics and close this class of syntax bypass.
CVE Intelligence
3
CVE-2026-100109
CVSS
10.0 Critical
2026-11-05
Unauthenticated access in the WooCommerce Security plugin creates an administrator account and takes over the site
In the Security For WooCommerce WordPress plugin versions 1.0.10 through 1.0.16, the user-creation module lacks an authorization mechanism (CWE-862) and has an unauthenticated administrator-creation flaw. When creating a user through an action available to unauthenticated visitors, the plugin does not perform a capability check and lets the caller choose the new account's role. An unauthenticated attacker can create an administrator account and take over the site. Every WordPress site running an affected plugin version is affected. No authentication is required; the attacker can trigger the flaw remotely and obtain the highest privileges.
Component
Security For WooCommerce is a WordPress plugin that strengthens the security of the WooCommerce e-commerce platform.
Risks
Complete site control: The attacker can create an account with administrator privileges and fully control the WordPress admin, including changing content, installing malicious plugins, or stealing sensitive data
Unauthenticated remote attack: The attacker needs no login and no initial credentials, and can attack through a public interface
Data disclosure and tampering: With administrator privileges the attacker can access all user data, order information, and payment details, causing serious privacy loss and financial harm
Upgrade the Security For WooCommerce plugin to 1.0.17 or later immediately
Check the WordPress user list and remove any suspicious recently created administrator accounts
Enable web application firewall (WAF) rules that restrict access to the unauthenticated user-creation interface
CVE-2026-118423
CVSS
10.0 Critical
2026-11-06
Unauthenticated file upload in the WP Libre Form plugin leads to remote code execution
In WP Libre Form WordPress plugin 1.5.0.1, the form-submission module does not validate uploaded file types and has an unrestricted upload of a dangerous file type (CWE-434). An unauthenticated attacker can upload a PHP file to a web-accessible location and execute it, leading to remote code execution. Every unpatched user of WP Libre Form 1.5.0.1 is affected. No authentication is required: a crafted form-submission request is enough to trigger the flaw and fully control the server.
Component
WP Libre Form is an open-source form-builder plugin for WordPress that lets site administrators create and manage various kinds of user-submission forms.
Risks
Complete system control: The attacker can run arbitrary code on the victim server and, according to server privileges, install programs, view, change, or delete data, or create new accounts with full privileges
Unauthenticated attack: The attacker needs no login or credentials; a crafted HTTP request is enough to trigger the flaw
Remote code execution: The uploaded malicious PHP file can run directly on the server, so the server can be fully taken over
Configure the web server to forbid execution of PHP scripts in the upload directory
Deploy a web application firewall (WAF) to block abnormal form file-upload requests
CVE-2026-123551
CVSS
10.0 Critical
2026-11-08
Unauthenticated access to the OpenAM WebSocket leads to session hijacking
In OpenAM 14.0.0 through 16.1.4, the notification WebSocket module has an information-disclosure flaw (CWE-201) that lets an unauthenticated attacker read live session tokens. By using an unverified internal forward on the legacy Liberty ID-FF endpoint, the attacker can bypass the proxy-only check, collect iPlanetDirectoryPro tokens, and hijack user and administrator sessions. Every OpenAM deployment that has not been updated to 16.1.4 is affected. No authentication is required: a crafted request obtains sensitive tokens and can fully control user or administrator accounts.
Component
OpenAM is an open-source identity and access management solution providing single sign-on, multi-factor authentication, and fine-grained access control.
Risks
Full session hijacking: The attacker can obtain iPlanetDirectoryPro tokens and take over ordinary user and administrator sessions without cracking passwords
Privilege escalation: Hijacking an administrator session gives full control of the OpenAM instance, including changing policies, creating backdoor accounts, or stealing other users' credentials
Unauthenticated remote attack: No prior authentication is required, and the attacker can attack directly over the network, so the risk is extremely high
Upgrade OpenAM to 16.1.4 or later immediately to fix the flaw
Monitor WebSocket connection logs for abnormal unauthorized token reads
Restrict network access to the Liberty ID-FF endpoint and apply strict firewall rules
Package Poisoning
13
Package Poisoning
npm2026-11-07
@noinheritdoc/n@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
e1f7dab66aa6e4bcc4e7cbac3de928d2
Package Poisoning
npm2026-11-07
@sideeffects/n@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
93be96a25999c81ce85935d6e0baa185
Package Poisoning
npm2026-11-07
arc-contracts@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
cbc9d5b2aa6b9805858b47a43caefa1d
Package Poisoning
npm2026-11-07
evmos-contracts@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
66d53e97dfea17e36e9b9e04a13c8b80
Package Poisoning
npm2026-11-07
kc-kline-chart@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
dbb1f8cd6743f8d4e8389bd46c054ea7
Package Poisoning
npm2026-11-07
securedrop-app@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
452f93b432d33b3fc0c8d2f75aa4ba21
Package Poisoning
npm2026-11-07
wisdomtreetest@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
86ffdf83c062b5b58036b99e55cbcb0d
Package Poisoning
npm2026-11-07
zero2-baileys@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
7ae3cf1caa71c9e68a4216d807b52111
Package Poisoning
npm2026-11-07
monobomber@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
61d6c04afc651bd9470dcb252c841ceb
Package Poisoning
npm2026-11-07
monopw@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
d3dc720960fa71fcc7cd79c430aebfa3
Package Poisoning
PyPI2026-11-08
pyuserfox@0.0.2
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
d739d837226d42387b89bdecc6a6b49f
Package Poisoning
PyPI2026-11-08
pyuserox@0.0.2
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
dc054b30f427ed852d8f38a9332bec3f
Package Poisoning
PyPI2026-11-08
twitch-stream-py@1.1.0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
