CVE-2026-109404

A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue is some unknown functionality of the file AgentController.java of the component Agentspan Agent Runtime. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible.

• CWE-918

• https://vuldb.com/cve/CVE-2026-109404
• https://vuldb.com/submit/979792
• https://vuldb.com/vuln/416946
• https://vuldb.com/vuln/416946/cti
• https://vuldb.com/submit/979792

Published

Oct 13, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-109398Gumlet php-image-resize before 3.0.1 contains a denial of se…7.5
• CVE-2026-109399SWUpdate through 2026.05.1 contains an improper certificate …8.1
• CVE-2026-1094GitLab has remediated an issue in GitLab CE/EE affecting all…4.6
• CVE-2026-10940Race in Codecs in Google Chrome on Windows prior to 149.0.78…8.3
• CVE-2026-109402A vulnerability was found in conductor-oss conductor 3.22.0.…6.3
• CVE-2026-109403A vulnerability was determined in conductor-oss conductor up…7.3
• CVE-2026-109405A security flaw has been discovered in conductor-oss conduct…7.3
• CVE-2026-109406A weakness has been identified in macrozheng mall up to 1.0.…5.4
• CVE-2026-109407A security vulnerability has been detected in macrozheng mal…3.1
• CVE-2026-109409A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. …5.3
• CVE-2026-10941Out of bounds memory access in Skia in Google Chrome prior t…8.8
• CVE-2026-109410A vulnerability has been found in macrozheng mall 1.0.3 dcaa…2.4