https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 16:33:08 +0000 https://cve.radiocsirt.org/vuln/cve-2026-25807 <p><strong>Affected:</strong> TaklaXBR zai-shell</p> <p>ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to 9.0.3, the P2P terminal sharing feature (share start) opens a TCP socket on port 5757 without any authentication mechanism. Any remote attacker can connect to this port using a simple socket script. An attacker who connects to a ZAI-Shell P2P session running in --no-ai mode can send arbitrary system commands. If the host user approves the command without reviewing its contents, the command executes directly with the user&#39;s privileges, bypassing all Sentinel safety checks. This vulnerability is fixed in 9.0.3.</p> <p><strong>Affected:</strong> TaklaXBR zai-shell</p> <p>ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to 9.0.3, the P2P terminal sharing feature (share start) opens a TCP socket on port 5757 without any authentication mechanism. Any remote attacker can connect to this port using a simple socket script. An attacker who connects to a ZAI-Shell P2P session running in --no-ai mode can send arbitrary system commands. If the host user approves the command without reviewing its contents, the command executes directly with the user&#39;s privileges, bypassing all Sentinel safety checks. This vulnerability is fixed in 9.0.3.</p> https://cve.radiocsirt.org/vuln/cve-2026-25807