CVE-2026-112380

Publié : 20 octobre 2026

Modifié : 20 octobre 2026

Score CVSS

9.9

CRITICAL

Description détaillée

Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To remediate this issue, users should upgrade to version 0.7.2.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Références et Patchs

https://aws.amazon.com/security/security-bulletins/2026-140-aws/https://github.com/kirodotdev/KiroCrew/releases/tag/v0.7.2 https://github.com/kirodotdev/KiroCrew/security/advisories/GHSA-x4jf-p42g-q3hc

Dernières Vulnérabilités

CVE-2026-9825

IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.

VOIR DÉTAILS

CVE-2026-94402

IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.

VOIR DÉTAILS

CVE-2026-93888

IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.

VOIR DÉTAILS