https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T00:40:35.541644+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-329572 EUVD-2026-329572 2026-10-09T00:40:35.544434+00:00 EUVD-2026-329572 https://cve.radiocsirt.org/vuln/fkie_cve-2026-7439 fkie_cve-2026-7439 2026-10-09T00:40:35.544468+00:00

AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation weakness through browser-driven or local cross-origin requests to abuse the localhost API and enable attack chains against the local control plane.

 https://cve.radiocsirt.org/vuln/ghsa-7vgq-6q52-5p23 GHSA-7vgq-6q52-5p23 2026-10-09T00:40:35.544502+00:00

AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation weakness through browser-driven or local cross-origin requests to abuse the localhost API and enable attack chains against the local control plane.