Jovancoding Network-ai vulnerabilities

• jovancoding network-ai Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations CVE-2026-120314 6.9 MediumNovember 2, 2026
• jovancoding network-ai Network-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePath CVE-2026-120313 8.7 HighNovember 2, 2026
• jovancoding network-ai Network-AI 5.13.4 before 5.15.5 Path Traversal via AgentVCR Cassette Name CVE-2026-120312 8.7 HighNovember 2, 2026
• jovancoding network-ai Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID CVE-2026-120311 8.7 HighNovember 2, 2026
• jovancoding network-ai Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport CVE-2026-109332 2.3 LowOctober 12, 2026
• jovancoding network-ai Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget CVE-2026-109331 7.5 HighOctober 12, 2026
• jovancoding network-ai Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer CVE-2026-109330 5.3 MediumOctober 12, 2026
• jovancoding network-ai Network-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote Mismatch CVE-2026-73615 8.7 HighAugust 13, 2026
• jovancoding network-ai Network-AI ClaudeHookBridge Deny Pattern Bypass via Truncation CVE-2026-73614 8.7 HighAugust 13, 2026
• jovancoding network-ai Network-AI before 5.13.4 Cryptographic Signature Verification Bypass CVE-2026-64623 8.8 HighJuly 20, 2026
• jovancoding network-ai Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox CVE-2026-64622 9.3 CriticalJuly 20, 2026
• jovancoding network-ai EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data CVE-2026-58413 Fix available 6.1 MediumJune 19, 2026
• jovancoding network-ai Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups CVE-2026-58414 Fix available 5.5 MediumJune 19, 2026
• jovancoding network-ai Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions CVE-2026-58482 Fix available 5.9 MediumJune 19, 2026
• jovancoding network-ai Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory CVE-2026-58481 Fix available 6.5 MediumJune 19, 2026
• jovancoding network-ai Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning CVE-2026-58484 Fix available 7.1 HighJune 19, 2026
• jovancoding network-ai Network-AI has an an OS Command Injection issue CVE-2026-54051 Fix available 9.9 CriticalJune 19, 2026
• jovancoding network-ai Network-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701) CVE-2026-48814 Fix available 9.1 CriticalJune 17, 2026
• jovancoding network-ai Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret CVE-2026-46701 Fix available 7.6 HighMay 21, 2026
• jovancoding network-ai Network-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool calls CVE-2026-42856 Fix available 8.7 HighMay 5, 2026