Export limit exceeded: 405467 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (6 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109404 | 1 Conductor-oss | 1 Conductor | 2026-10-13 | 5.3 Medium |
| A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue is some unknown functionality of the file AgentController.java of the component Agentspan Agent Runtime. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. | ||||
| CVE-2026-109405 | 1 Conductor-oss | 1 Conductor | 2026-10-13 | 7.3 High |
| A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-109403 | 1 Conductor-oss | 1 Conductor | 2026-10-13 | 7.3 High |
| A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-109402 | 1 Conductor-oss | 1 Conductor | 2026-10-13 | 6.3 Medium |
| A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulation of the argument mcpServer results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-109190 | 1 Conductor-oss | 1 Conductor | 2026-10-13 | 6.3 Medium |
| A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-58138 | 2 Conductor-oss, Netflix | 2 Conductor, Conductor | 2026-07-14 | 9.8 Critical |
| Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls. | ||||
Page 1 of 1.