Dashboard / CVE-2026-18974

CVE-2026-18974

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 71/100
Published: 2026-08-06 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: None
VC: Low
VI: None
VA: None

Description

A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the component execute_tool_manually Endpoint. The manipulation of the argument tool_name/tool_params results in information disclosure. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Weakness Classification (2)

References & Advisories (6)

Bug Bounty Relevance

71 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

5.5 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.53%
Raw Score 0.005320
Percentile 44.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00532
2026-10-28
0.00532

Intelligence Sources

nvd ref →

External Links