HOL LogoGuard

Explore HOL

  • HOL home
  • AI agent registry
  • AI plugins
  • Open standards
  • HOL members
  • Sponsor HOL
  • Advertise with HOL

Guard product

  • Guard overviewLocal security and control for AI agents and the tools they use.
  • FeaturesRuntime protection, policy routing, review, and evidence.
  • CIGARPoint your coding agent at the right lines and cut its token bill by about a third.

Explore Guard

  • Product previewWalk through Guard surfaces in read-only demo mode.
  • ComparisonCompare Guard with native controls and AI security vendors.

AI tools

  • All AI toolsEvery supported AI tool and how Guard applies policy to it.
  • Codex
  • Claude Code
  • Cursor
  • Antigravity CLI
  • OpenCode
  • Hermes
  • OpenClaw
  • GitHub Copilot CLI
  • Antigravity
  • Kimi
  • Grok
  • Pi / Oh My Pi
  • Zcode

Extensions

  • All extensionsBrowse command and MCP coverage with owners and stated limits.
  • Command coverageShell command protection across clouds, databases, backups, and packages.
  • MCP server coverageSee how Guard maps risk state across MCP tools and servers.
  • Core safetyThe safety floor listings that ship with Guard.
  • Data and resilienceBackup and storage command protection.
  • Cloud and infrastructureAWS, Azure, GCP, Kubernetes, and more.

Security

  • AI security hubSecurity research, advisories, and agent safety coverage.
  • AI tool securitySecurity profiles for each supported coding agent.
  • Safe labsHands-on attack simulations with safe boundaries.
  • Redacted warningsReal blocked actions with sensitive details removed.
  • AdvisoriesCoordinated disclosure reports for AI tooling.
  • Active CVEsSearch active CVEs affecting AI tooling.

Learn

  • Security guidesPractical guides for securing AI agent workflows.
  • DocsInstall, configure, and operate Guard with confidence.
  • ResearchPublished security research, benchmarks, and methodology.
  • Gauntlet benchmarkGuard tested with real coding agents: safe work runs, risky actions stop.

Community

  • ReleasesVersion history, shipped changes and upgrade notes.
  • ContributorsThe people and contributions behind HOL Guard.
  • AffiliatesShare Guard with your audience and earn from referrals.
  • SponsorFund agreed research, implementation and shared testing through the HOL Partner Program.
  • AdvertiseCompare README logo placements, previews and monthly prices, or promote a plugin or extension.
PricingEnterpriseOpen AppInstall Guard
  1. Guard
  2. Security
  3. CVEs
HOL Guard

Public security guidance for teams protecting AI harnesses, MCP servers, skills, prompts, and local tool execution.

Install Guard

AI Security

  • Prompt injection
  • MCP security
  • OWASP MCP mapping
  • Supply chain

Resources

  • Trust packet
  • Harness setup
  • Redacted warnings
  • Safe labs

Product

  • Install Guard
  • Pricing
  • Open dashboard

Get HOL Guard for your computer

HOL Guard is a free desktop app that watches what coding agents such as Claude Code, Codex and Cursor run, read and install, and asks you before anything risky happens.

  • Download for macOS
  • Windows download
  • Linux download

Free. macOS 13+ on Apple silicon, Windows x64, Linux AppImage. Other ways to install

Runs on
macOS 13 or later on Apple silicon, Windows x64 and Linux x86_64.
Price
Free. Paid plans add Guard Cloud for teams. See pricing
Where your data stays
On your computer. Guard Cloud is optional.
Token savings
33% to 38% lower spend across three coding agents in our CIGAR benchmark.

HOL

HOL builds open infrastructure for AI agents: HOL Guard, a directory of AI plugins and MCP servers, an AI agent registry and the open HCS standards.

  • GitHub (opens in a new tab)
  • X (Twitter) (opens in a new tab)
  • YouTube (opens in a new tab)
  • Telegram (opens in a new tab)

HOL Guard

  • What is HOL Guard
  • Features
  • Cut coding agent token costs (CIGAR)
  • Install Guard
  • Download the desktop app
  • Pricing
  • Guard for teams
  • Compare Guard
  • Release notes

Guard for your AI tool

  • Guard for Claude Code
  • Guard for Codex
  • Guard for Cursor
  • Guard for GitHub Copilot CLI
  • Guard for OpenCode
  • Guard for Pi and Oh My Pi
  • Guard for Hermes
  • Guard for OpenClaw
  • All supported AI tools

Research and security

  • Gauntlet: Guard tested with real agents
  • CIGAR token benchmark
  • Research
  • AI security hub
  • Security advisories
  • Active CVEs in AI tools
  • AI agent security guides
  • Extensions and coverage

Plugins and MCP servers

  • Browse AI plugins
  • New plugin launches
  • Best Claude Plugins
  • Best Codex Plugins
  • Best Grok Plugins
  • Best Kimi Plugins
  • Best DeepSeek Plugins
  • Best Antigravity Plugins
  • Best MCP Servers
  • Best Cursor Plugins
  • Best OpenCode Plugins

AI agent registry

  • Best AI agents
  • Best ERC-8004 agents
  • Best Virtuals agents
  • Best A2A agents
  • Best x402 payable agents
  • Submit an ERC-8004 contract
  • Feature your agent

Developers

  • Guard docs
  • Documentation index
  • Developer hub
  • Registry API reference
  • OpenAPI spec
  • Registry OpenAPI spec
  • Run in Postman (opens in a new tab)
  • HCS standards

Company

  • About HOL
  • Blog
  • Contribute to HOL
  • Guard contributors
  • Sponsor
  • Advertise
  • Affiliate program
  • Contact

Copyright © 2026 HOL DAO LLC. All rights reserved.

  • Privacy
  • Terms of Service

Active CVEs

Search active, non-withdrawn CVEs in the HOL Guard feed, then open the matching HOL analysis.

Feed liveLast checked Nov 8, 2026, 8:06 AM 52,076 active 372 known exploited

Catalog summary

52,076

Active CVEs

27,238

Critical + high

372

Known exploited

21

Ecosystems

Search and filter active CVEs

Filters & sort
Severity

Showing 801–850 of 52,076 active CVEs

Sorted by Published (newest)

Active CVE results

Select a result for the HOL analysis
IdentityRiskAffected softwarePublished
  1. CVE-2026-53980High
    Charmbracelet Wish 2.0.5 Path Traversal via git Middleware
    CVSS 8.6
    charmbracelet/wishgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  2. CVE-2026-119170High
    Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10
    CVSS 8.2
    Python Software Foundation/CPythongeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 7, 2026 Fix availableView HOL analysis
  3. CVE-2026-123665Low
    kubescape Output printresults.go GetWriter permission
    CVSS 2.4
    n/a/kubescapegeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  4. CVE-2026-123339Low
    Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request
    CVSS 2.3
    sensiolabs/symfony/http-kernelgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  5. CVE-2026-87045High
    NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame
    CVSS 7.5
    zephyrproject/zephyrgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  6. CVE-2026-123664Medium
    nasa-gcn gcn.nasa.gov Email Notification email improper authorization
    CVSS 5.3
    nasa-gcn/gcn.nasa.govgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  7. CVE-2026-113618Medium
    Improper Server Certificate Validation in ZSIRep Client Library
    CVSS 5.3
    KAMSOFT/ZSIRep Client Librarygeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  8. CVE-2026-118514Medium
    Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls
    CVSS 6.3
    symfony/symfony/http-foundationgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  9. CVE-2026-59105Critical
    Universal sysadmin credential vulnerability in Jumis
    CVSS 9.3
    Jumis Pro SIA/Jumisgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  10. CVE-2026-21850Medium
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 6.5
    HCL Software/HCL AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  11. CVE-2026-5345Low
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 3.7
    HCL Software/HCL AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  12. CVE-2026-21849Low
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 3.7
    HCL Software/HCL AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  13. CVE-2026-35107Medium
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 4.7
    HCL Software/HCL AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  14. CVE-2026-35106Medium
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 4.7
    HCL Software/HCL AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  15. CVE-2026-35105Medium
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 4.7
    HCL Software/HCL AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  16. CVE-2026-35104Medium
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 4.7
    HCL Software/HCL AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  17. CVE-2026-35103Medium
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 4.7
    HCL Software/HCL AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  18. CVE-2026-35102Medium
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 4.7
    HCL Software/HCL AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  19. CVE-2026-35109Low
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 3.7
    HCL Software/HCL AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  20. CVE-2026-123653Medium
    esengine DeepSeek-Reasonix doc.go discoverDocs llm prompting input
    CVSS 5.3
    esengine/DeepSeek-Reasonixgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  21. CVE-2026-35110Medium
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 5.4
    HCL Software/HCL AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  22. CVE-2026-35112Medium
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 4.2
    HCL Software/HCL AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  23. CVE-2026-35113Medium
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 4.8
    HCL Software/HCL AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  24. CVE-2026-35111Medium
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 4.8
    HCL Software/HCL AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  25. CVE-2026-35114Low
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 3.7
    HCL Software/HCL AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  26. CVE-2026-35115Low
    HCL AION is affected by multiple security vulnerabilities.
    CVSS 3.7
    HCL Software/AIONgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  27. CVE-2026-92080Medium
    Path Traversal Leading to Arbitrary Mount in TÜBİTAK BİLGEM's pardus-boot-repair
    CVSS 4.3
    TÜBİTAK BİLGEM Software Technologies Research Institute/pardus-boot-repairgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  28. CVE-2026-115431High
    WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability
    CVSS 7.1
    WP Swings/upsell-order-bump-offer-for-woocommercegeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  29. CVE-2026-115952Medium
    WordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability
    CVSS 6.5
    WPMU DEV/forminatorgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  30. CVE-2026-105422Medium
    Path Traversal in TÜBİTAK BİLGEM's pardus-boot-repair
    CVSS 6.6
    TÜBİTAK BİLGEM Software Technologies Research Institute/pardus-boot-repairgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  31. CVE-2026-123746Low
    Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers
    CVSS 2.3
    sensiolabs/symfony/security-httpgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  32. CVE-2026-109883High
    WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability
    CVSS 7.1
    Elementor/elementorgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  33. CVE-2026-109884High
    WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability
    CVSS 7.1
    Elementor/elementorgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  34. CVE-2026-85111High
    Apache James: Denial of service upon MIME parsing
    CVSS 8.7
    Apache Software Foundation/Apache James, Apache Software Foundation/org.apache.james:james-servergeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  35. CVE-2026-85108Unknown severity
    Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling
    Not scoredSource severity not reported
    Apache Software Foundation/Apache James Mime4J Dom, Apache Software Foundation/org.apache.james:apache-mime4j-coregeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  36. CVE-2026-123655High
    Moodle: missing access checks on h5p content files
    CVSS 7.5
    moodlegeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  37. CVE-2026-76168Unknown severity
    Apache James: ManageSieve file implementation cross-user path traversal
    Not scoredSource severity not reported
    Apache Software Foundation/Apache Jamesgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  38. CVE-2026-74756Unknown severity
    Apache James: WebAdmin exposed without authentication on official Docker default
    Not scoredSource severity not reported
    Apache Software Foundation/Apache Jamesgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  39. CVE-2026-76171Unknown severity
    Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client
    Not scoredSource severity not reported
    Apache Software Foundation/Apache Jamesgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  40. CVE-2026-49939Unknown severity
    Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
    Not scoredSource severity not reported
    Apache Software Foundation/Apache Jamesgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  41. CVE-2025-66621Unknown severity
    Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
    Not scoredSource severity not reported
    Apache Software Foundation/Apache Jamesgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026 Fix availableView HOL analysis
  42. CVE-2026-103908Medium
    AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info
    CVSS 5.4
    mohammed_kaludi/AMP for WP – Accelerated Mobile Pagesgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  43. CVE-2026-120035Medium
    RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title
    CVSS 5.4
    themeisle/RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregatorgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  44. CVE-2026-107658Medium
    BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion
    CVSS 5.4
    themekraft/BuddyFormsgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  45. CVE-2026-119178Medium
    Smart Cookie Kit <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Bundled Simple HTML DOM Noise Restoration
    CVSS 5.4
    shark986/Smart Cookie Kitgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  46. CVE-2026-92895High
    Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter
    CVSS 8.1
    jiangweifang/Live2DWebCanvasgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  47. CVE-2026-116624High
    Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form
    CVSS 8.8
    danbilabs/Advanced Members for ACFgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  48. CVE-2026-116545Medium
    All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field
    CVSS 6.4
    plugins360/All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videosgeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  49. CVE-2026-119211Medium
    AAA Autoload Optimizer <= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' Hook
    CVSS 4.9
    progressplanner/AAA Autoload Optimizergeneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
  50. CVE-2026-116551Medium
    WP Customer Area <= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
    CVSS 6.4
    aguilatechnologies/WP Customer Areageneric
    PublishedNov 6, 2026First seen at HOL Nov 6, 2026Updated Nov 6, 2026View HOL analysis
Page 17 of 1,042
Previous1516171819Next
How this catalog works

Active means a non-withdrawn CVE List record with a validated alias, English description, publication date, and source reference. Published is the CVE Program date; First seen at HOL is when this feed first indexed the record; Modified and Source checked describe later feed activity. Severity uses the reported source value when present, otherwise a valid CVSS score supplies the displayed band. Unmapped records do not imply package coverage.

Put Guard beside your supply-chain workflow.

Explore HOL Guard