CVE-2026-15629

MediumCVSS 6.3/10Last modified Oct 24, 2026

Description

A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published: Jul 14, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-15634.8Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface compon CVE-2026-156309.9A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exp CVE-2026-1563110.0Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against CVE-2026-156346.5IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTT CVE-2026-156377.5Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authent CVE-2026-156389.1An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cr CVE-2026-156399.3An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the at CVE-2026-15644.8Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high p CVE-2026-156409.5Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.CVE-2026-156417.1Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileg CVE-2026-156423.3Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.CVE-2026-156437.3AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS