What’s Vulnerable › Products
Jovancoding Network-AI vulnerabilities
16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.
Check whether your Jovancoding Network-AI version is affected
Latest Jovancoding Network-AI vulnerabilities
- CVE-2026-109332 — Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport (CVSS 3.1)
- CVE-2026-109331 — Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget (CVSS 7.4)
- CVE-2026-109330 — Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer (CVSS 4.3)
- CVE-2026-73615 — Network-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote Mismatch (CVSS 8.8)
- CVE-2026-73614 — Network-AI ClaudeHookBridge Deny Pattern Bypass via Truncation (CVSS 8.8)
- CVE-2026-58484 — Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning (CVSS 7.1)
- CVE-2026-58482 — Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions (CVSS 5.9)
- CVE-2026-58481 — Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory (CVSS 6.5)
- CVE-2026-58414 — Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups (CVSS 5.5)
- CVE-2026-58413 — EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data (CVSS 6.1)
- CVE-2026-54051 — Network-AI has an an OS Command Injection issue (CVSS 9.9)
- CVE-2026-46701 — Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret (CVSS 7.6)
- CVE-2026-64623 — Network-AI before 5.13.4 Cryptographic Signature Verification Bypass (CVSS 8.6)
- CVE-2026-64622 — Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox (CVSS 7.5)
- CVE-2026-48814 — Network-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701) (CVSS 9.1)
- CVE-2026-42856 — Network-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool calls (CVSS 8.7)