tinyhumansai vulnerabilities

Newest CVEs

• CVE-2026-49407

  OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth

  tinyhumansai · openhuman

  High7.7
• CVE-2026-54142

  OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approval

  tinyhumansai · openhuman

  High8.7
• CVE-2026-54146

  OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)

  tinyhumansai · openhuman

  High8.8
• CVE-2026-54143

  OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution

  tinyhumansai · openhuman

  Critical9.8
• CVE-2026-54141

  OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`

  tinyhumansai · openhuman

  Critical9.0
• CVE-2026-49393

  OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer token

  tinyhumansai · openhuman

  High8.4
• CVE-2026-54145

  OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)

  tinyhumansai · openhuman

  High8.8
• CVE-2026-49405

  OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data

  tinyhumansai · openhuman

  Medium6.2
• CVE-2026-54144

  OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture

  tinyhumansai · openhuman

  Medium6.1
• CVE-2026-54140

  OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitization

  tinyhumansai · openhuman

  High8.3