{"vulnerability": "CVE-2026-5186", "sightings": [{"uuid": "901fb798-67f0-4fd9-8ba7-52bf163a63c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5186", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3midxggnifh2n", "content": "", "creation_timestamp": "2026-03-31T10:22:40.158981Z"}, {"uuid": "75097cad-64dd-4ecb-8fb8-2e4c9eafd44a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51861", "type": "seen", "source": "https://gist.github.com/Ro1ME/a03814bf661b36823c3ef5e32af93298", "content": "# CVE-2026-51861\n\n**Type:** Code Injection\n**Product:** bisheng\n**Affected versions:** 2.3.0\u20132.4.0-beta1\n**Affected component:** `src/backend/bisheng/api/v1/validate.py:post_validate_code`\n**Reference:** https://github.com/dataelement/bisheng/issues/1995\n\n## Description\n\nbisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:31.000000Z"}, {"uuid": "6caf12e5-3c44-406f-b6af-761cb4bb64ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51860", "type": "seen", "source": "https://gist.github.com/Ro1ME/e4129afdd9af2ff1bdcecf27ec5098cf", "content": "# CVE-2026-51860\n\n**Type:** Directory Traversal\n**Product:** bisheng\n**Affected versions:** 2.3.0\u20132.4.0-beta1\n**Affected component:** `src/backend/bisheng/linsight/domain/task_exec.py:LinsightWorkflowTask._download_file`\n**Reference:** https://github.com/dataelement/bisheng/issues/1994\n\n## Description\n\nbisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:27.000000Z"}, {"uuid": "ea8763c3-9593-4dd2-9326-fc0abea2d369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51869", "type": "seen", "source": "https://gist.github.com/Ro1ME/884fbbd589998b81fa05c20ac205569f", "content": "# CVE-2026-51869\n\n**Type:** Incorrect Access Control\n**Product:** DB-GPT\n**Affected versions:** 0.8.0\n**Affected component:** `packages/dbgpt-sandbox/src/dbgpt_sandbox/sandbox/execution_layer/runtime_factory.py:RuntimeFactory.create`\n**Reference:** https://github.com/eosphoros-ai/DB-GPT/issues/3082\n\n## Description\n\nDB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:03:21.000000Z"}, {"uuid": "78e50eca-8e9d-4ca6-a645-3fd371904faa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51867", "type": "seen", "source": "https://gist.github.com/Ro1ME/62547f81c244f273b66755dad63a8673", "content": "# CVE-2026-51867\n\n**Type:** Incorrect Access Control\n**Product:** AgentGPT\n**Affected versions:** v1.0.0\n**Affected component:** `next/src/server/api/routers/agentRouter.ts`\n**Reference:** http://agentgpt.com\n\n## Description\n\nagentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:51.000000Z"}, {"uuid": "b7d960d9-b317-4082-bd82-802c58eae2a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51866", "type": "seen", "source": "https://gist.github.com/Ro1ME/f8f5b730a4000684d3a92a67f82ee03c", "content": "# CVE-2026-51866\n\n**Type:** Code Execution\n**Product:** DB-GPT\n**Affected versions:** 0.7.5, 0.8.0\n**Affected component:** `packages/dbgpt-core/src/dbgpt/agent/skill/manage.py:SkillManager.execute_skill_script_file`\n**Reference:** https://github.com/eosphoros-ai/DB-GPT/issues/3047\n\n## Description\n\nIn DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:47.000000Z"}, {"uuid": "505668f9-0dec-4687-b37b-96dd5121d251", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51864", "type": "seen", "source": "https://gist.github.com/Ro1ME/164a2aff1229df650a5bcc2a039900c5", "content": "# CVE-2026-51864\n\n**Type:** Directory Traversal\n**Product:** DB-GPT\n**Affected versions:** 0.7.5, 0.8.0\n**Affected component:** `packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:python_file_upload`\n**Reference:** https://github.com/eosphoros-ai/DB-GPT/issues/3027\n\n## Description\n\nDB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:43.000000Z"}, {"uuid": "6558fd1a-1580-4b06-b502-7ef496b6a63a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51863", "type": "seen", "source": "https://gist.github.com/Ro1ME/8be4e1bad6c9d7a777ec7638b1192dee", "content": "# CVE-2026-51863\n\n**Type:** Directory Traversal\n**Product:** DB-GPT\n**Affected versions:** 0.7.5, 0.8.0\n**Affected component:** `packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:use_example_file`\n**Reference:** https://github.com/eosphoros-ai/DB-GPT/issues/3028\n\n## Description\n\nDB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:39.000000Z"}, {"uuid": "376a80cb-a563-4ada-a7c0-5d14d61118bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51862", "type": "seen", "source": "https://gist.github.com/Ro1ME/c09e6aca2e9c7280ca4fabb1f44dcd2a", "content": "# CVE-2026-51862\n\n**Type:** Directory Traversal\n**Product:** DB-GPT\n**Affected versions:** 0.8.0\n**Affected component:** `packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:skill_upload`\n**Reference:** https://github.com/eosphoros-ai/DB-GPT/issues/3026\n\n## Description\n\nDB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:02:35.000000Z"}]}