https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-51475.htmlhttps://patchthecve.com/cve/CVE-2025-51475.htmlWed, 17 Jun 2026 09:35:37 +0000MEDIUM 5.0: Arbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to overwrite arbitrary files via unsanitised filenames submitted to the file upload endpoint, due to improper handling of directory traversal in os.path.join() and lahttps://patchthecve.com/cve/CVE-2025-51472.htmlhttps://patchthecve.com/cve/CVE-2025-51472.htmlWed, 17 Jun 2026 09:35:37 +0000MEDIUM 6.5: Code Injection in AgentTemplate.eval_agent_config in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious values in agent template configurations such as the goal, constraints, or instruction field, which are evaluated using eval() without validathttps://patchthecve.com/cve/CVE-2024-9447.htmlhttps://patchthecve.com/cve/CVE-2024-9447.htmlWed, 17 Jun 2026 08:24:35 +0000MEDIUM 6.5: An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. The `/get/organisation/` endpoint does not verify the user's organization, allowing any authenticated user to retrieve sensitive configuration details, including API keys, of any organization. This chttps://patchthecve.com/cve/CVE-2024-9439.htmlhttps://patchthecve.com/cve/CVE-2024-9439.htmlWed, 17 Jun 2026 08:24:34 +0000HIGH 8.8: SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.https://patchthecve.com/cve/CVE-2024-9437.htmlhttps://patchthecve.com/cve/CVE-2024-9437.htmlWed, 17 Jun 2026 08:24:34 +0000HIGH 7.5: SuperAGI version v0.0.14 is vulnerable to an unauthenticated Denial of Service (DoS) attack. The vulnerability exists in the resource upload request, where appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request causes the server to continuously process each chttps://patchthecve.com/cve/CVE-2024-9431.htmlhttps://patchthecve.com/cve/CVE-2024-9431.htmlWed, 17 Jun 2026 08:24:33 +0000HIGH 8.8: In version v0.0.14 of transformeroptimus/superagi, there is an improper privilege management vulnerability. After logging into the system, users can change the passwords of other users, leading to potential account takeover.https://patchthecve.com/cve/CVE-2024-9418.htmlhttps://patchthecve.com/cve/CVE-2024-9418.htmlWed, 17 Jun 2026 08:24:32 +0000MEDIUM 6.5: In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in plaintext. This vulnerability allows an attacker to retrieve the password of another user, leading to potential account takeover.https://patchthecve.com/cve/CVE-2024-9415.htmlhttps://patchthecve.com/cve/CVE-2024-9415.htmlWed, 17 Jun 2026 08:24:31 +0000HIGH 8.8: A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. This vulnerability allows an attacker to upload an arbitrary file to the server, potentially leading to remote code execution or overwriting any file on the server.https://patchthecve.com/cve/CVE-2024-12048.htmlhttps://patchthecve.com/cve/CVE-2024-12048.htmlWed, 17 Jun 2026 06:58:57 +0000HIGH 8.8: An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affecthttps://patchthecve.com/cve/CVE-2024-10267.htmlhttps://patchthecve.com/cve/CVE-2024-10267.htmlWed, 17 Jun 2026 06:55:17 +0000HIGH 7.5: An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. An attacker can leak sensitive user information, including names, emails, and passwords, by attempting to register a new account with an email that is already in use. The server returns all informati