CWE-526
CWE-526 · 4 records · 4 with a public proof-of-concept
Records the NVD classes under CWE-526, highest CVSS first.
- HIGH 8.8CVE-2026-54146public PoC
OpenHuman is an open-source agent harness available as a desktop application and Rust library. From 0.53.15 before 0.57.5 on macOS, core_process.rs in the Tauri desktop process publishes the per-launch OPENHUMAN_CORE_TOKEN bearer credential in its process envi…
- MEDIUM 6.5CVE-2026-116246public PoC
To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing remove…
pgadmin 4
- MEDIUM 6.5CVE-2026-77938public PoC
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to…
- MEDIUM 5.3CVE-2026-108592public PoC
mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt injection in processed task content can make …