atomic-agents-stack vulnerabilities

2 known vulnerabilities in atomic-agents-stack from Dep0we. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  atomic-agents-stack: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-91989Sep 15, 2026Dep0weEPSS 1.33%

  atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks

• 8.1 High severity

  atomic-agents-stack: Cleartext Transmission of Sensitive Information

  CVE-2026-91988Sep 15, 2026Dep0we

  atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spaw