CVE-2026-15329

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15329", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-09T18:37:41.980Z", "datePublished": "2026-07-10T03:30:08.320Z", "dateUpdated": "2026-07-14T01:28:47.883Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-10T03:30:08.320Z"}, "title": "zhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosure", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "Information Disclosure"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "zhayujie", "product": "CowAgent", "versions": [{"version": "2.0", "status": "affected"}, {"version": "2.1.0", "status": "affected"}], "cpes": ["cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*"], "modules": ["Browser Tool"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue affects the function BrowserTool._do_navigate of the file agent/tools/browser/browser_tool.py of the component Browser Tool. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-07-09T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-09T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-09T20:43:27.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Eric-x (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/377272", "name": "VDB-377272 | zhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosure", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/377272/cti", "name": "VDB-377272 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15329", "name": "CVE-2026-15329 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/853098", "name": "Submit #853098 | zhayujie CowAgent <= 2.1.0 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/zhayujie/CowAgent/issues/2871", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/zhayujie/CowAgent/issues/2871#issuecomment-4922534422", "tags": ["issue-tracking"]}, {"url": "https://github.com/zhayujie/CowAgent/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T01:28:37.180527Z", "id": "CVE-2026-15329", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T01:28:47.883Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15329", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T01:28:37.180527Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T01:28:43.877Z"}}], "cna": {"title": "zhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosure", "credits": [{"lang": "en", "type": "reporter", "value": "Eric-x (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*"], "vendor": "zhayujie", "modules": ["Browser Tool"], "product": "CowAgent", "versions": [{"status": "affected", "version": "2.0"}, {"status": "affected", "version": "2.1.0"}]}], "timeline": [{"lang": "en", "time": "2026-07-09T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-09T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-09T20:43:27.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/377272", "name": "VDB-377272 | zhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosure", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/377272/cti", "name": "VDB-377272 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15329", "name": "CVE-2026-15329 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/853098", "name": "Submit #853098 | zhayujie CowAgent <= 2.1.0 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/zhayujie/CowAgent/issues/2871", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/zhayujie/CowAgent/issues/2871#issuecomment-4922534422", "tags": ["issue-tracking"]}, {"url": "https://github.com/zhayujie/CowAgent/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue affects the function BrowserTool._do_navigate of the file agent/tools/browser/browser_tool.py of the component Browser Tool. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Information Disclosure"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-10T03:30:08.320Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15329", "state": "PUBLISHED", "dateUpdated": "2026-07-14T01:28:47.883Z", "dateReserved": "2026-07-09T18:37:41.980Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-10T03:30:08.320Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*"], "modules": ["Browser Tool"], "product": "CowAgent", "vendor": "zhayujie", "versions": [{"status": "affected", "version": "2.0"}, {"status": "affected", "version": "2.1.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue affects the function BrowserTool._do_navigate of the file agent/tools/browser/browser_tool.py of the component Browser Tool. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en zhayujie CowAgent hasta la versi\u00f3n 2.1.0. Este problema afecta a la funci\u00f3n BrowserTool._do_navigate del archivo agent/tools/browser/browser_tool.py del componente Browser Tool. Realizar una manipulaci\u00f3n resulta en revelaci\u00f3n de informaci\u00f3n. El ataque puede iniciarse de forma remota. El exploit se ha hecho p\u00fablico y podr\u00eda ser utilizado. El proyecto fue informado del problema con antelaci\u00f3n a trav\u00e9s de un informe de incidencias, pero a\u00fan no ha respondido."}], "id": "CVE-2026-15329", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15329", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T01:28:37.180527Z", "version": "2.0.3"}}]}, "published": "2026-07-10T04:17:50.590", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/zhayujie/CowAgent/"}, {"source": "cna@vuldb.com", "url": "https://github.com/zhayujie/CowAgent/issues/2871"}, {"source": "cna@vuldb.com", "url": "https://github.com/zhayujie/CowAgent/issues/2871#issuecomment-4922534422"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-15329"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/853098"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/377272"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/377272/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "CowAgent", "source": "cna", "vendor": "zhayujie"}, "product": "cowagent", "vendor": "zhayujie"}], "created": "2026-07-10T09:55:05.748256+00:00", "updated": "2026-08-01T13:30:04.221273+00:00", "vendors": ["zhayujie", "zhayujie$PRODUCT$cowagent"]}