Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by simular-ai
CVE-2026-84887 (GCVE-0-2026-84887)
Vulnerability from nvd – Published: 2026-09-02 21:00 – Updated: 2026-09-03 12:52
VLAI
EPSS
VEX
Title
simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service
Summary
A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 12:51 UTC
CWE
- CWE-404 - Denial of Service
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/398136 | vdb-entry |
| https://vuldb.com/vuln/398136/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-84887 | third-party-advisory |
| https://vuldb.com/submit/886451 | third-party-advisory |
| https://github.com/outlookgp/CVE/tree/main/AgentS… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| simular-ai | Agent-S |
Affected:
0.3.0
Affected: 0.3.1 Affected: 0.3.2 cpe:2.3:a:simular-ai:agent-s:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84887",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T12:51:51.898838Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T12:52:04.451Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:simular-ai:agent-s:*:*:*:*:*:*:*:*"
],
"modules": [
"Model-generated GUI Action Execution Workflow"
],
"product": "Agent-S",
"vendor": "simular-ai",
"versions": [
{
"status": "affected",
"version": "0.3.0"
},
{
"status": "affected",
"version": "0.3.1"
},
{
"status": "affected",
"version": "0.3.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "outlookgp (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T21:00:08.337Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-398136 | simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/398136"
},
{
"name": "VDB-398136 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/398136/cti"
},
{
"name": "CVE-2026-84887 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-84887"
},
{
"name": "Submit #886451 | Simular AI Agent-S 0.3.2 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/886451"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/outlookgp/CVE/tree/main/AgentS_Action_Parameter_Budget_DoS_Report"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-02T16:21:23.000Z",
"value": "VulDB entry last update"
}
],
"title": "simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-84887",
"datePublished": "2026-09-02T21:00:08.337Z",
"dateReserved": "2026-09-02T14:16:09.268Z",
"dateUpdated": "2026-09-03T12:52:04.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84886 (GCVE-0-2026-84886)
Vulnerability from nvd – Published: 2026-09-02 20:45 – Updated: 2026-09-02 20:45
VLAI
EPSS
VEX
Title
simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption
Summary
A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_server.py of the component OCR HTTP API. Executing a manipulation of the argument img_bytes can lead to resource consumption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/398135 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/398135/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-84886 | third-party-advisory |
| https://vuldb.com/submit/886443 | third-party-advisory |
| https://github.com/hackerguopeng/cve/tree/main/Ag… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| simular-ai | Agent-S |
Affected:
0.3.0
Affected: 0.3.1 Affected: 0.3.2 cpe:2.3:a:simular-ai:agent-s:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:simular-ai:agent-s:*:*:*:*:*:*:*:*"
],
"modules": [
"OCR HTTP API"
],
"product": "Agent-S",
"vendor": "simular-ai",
"versions": [
{
"status": "affected",
"version": "0.3.0"
},
{
"status": "affected",
"version": "0.3.1"
},
{
"status": "affected",
"version": "0.3.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hackerguopeng (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_server.py of the component OCR HTTP API. Executing a manipulation of the argument img_bytes can lead to resource consumption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T20:45:08.525Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-398135 | simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/398135"
},
{
"name": "VDB-398135 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/398135/cti"
},
{
"name": "CVE-2026-84886 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-84886"
},
{
"name": "Submit #886443 | Simular AI Agent-S 0.3.2 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/886443"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/hackerguopeng/cve/tree/main/AgentS_OCR_HTTP_Body_Image_DoS_Report"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-02T16:21:19.000Z",
"value": "VulDB entry last update"
}
],
"title": "simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-84886",
"datePublished": "2026-09-02T20:45:08.525Z",
"dateReserved": "2026-09-02T14:16:05.643Z",
"dateUpdated": "2026-09-02T20:45:08.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84885 (GCVE-0-2026-84885)
Vulnerability from nvd – Published: 2026-09-02 20:30 – Updated: 2026-09-03 13:34
VLAI
EPSS
VEX
Title
simular-ai Agent-S CodeAgent code_agent.py denial of service
Summary
A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code_agent.py of the component CodeAgent. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 13:27 UTC
CWE
- CWE-404 - Denial of Service
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/398133 | vdb-entry |
| https://vuldb.com/vuln/398133/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-84885 | third-party-advisory |
| https://vuldb.com/submit/886431 | third-party-advisory |
| https://github.com/outlookgp/CVE/tree/main/AgentS… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| simular-ai | Agent-S |
Affected:
0.3.1
Affected: 0.3.2 cpe:2.3:a:simular-ai:agent-s:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84885",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T13:27:38.981270Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T13:34:41.362Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:simular-ai:agent-s:*:*:*:*:*:*:*:*"
],
"modules": [
"CodeAgent"
],
"product": "Agent-S",
"vendor": "simular-ai",
"versions": [
{
"status": "affected",
"version": "0.3.1"
},
{
"status": "affected",
"version": "0.3.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "outlookgp (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code_agent.py of the component CodeAgent. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T20:30:07.409Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-398133 | simular-ai Agent-S CodeAgent code_agent.py denial of service",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/398133"
},
{
"name": "VDB-398133 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/398133/cti"
},
{
"name": "CVE-2026-84885 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-84885"
},
{
"name": "Submit #886431 | Simular AI Agent-S 0.3.2 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/886431"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/outlookgp/CVE/tree/main/AgentS_CodeAgent_Tool_Output_DoS_Report"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-02T16:21:15.000Z",
"value": "VulDB entry last update"
}
],
"title": "simular-ai Agent-S CodeAgent code_agent.py denial of service",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-84885",
"datePublished": "2026-09-02T20:30:07.409Z",
"dateReserved": "2026-09-02T14:16:00.952Z",
"dateUpdated": "2026-09-03T13:34:41.362Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84887 (GCVE-0-2026-84887)
Vulnerability from cvelistv5 – Published: 2026-09-02 21:00 – Updated: 2026-09-03 12:52
VLAI
EPSS
VEX
Title
simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service
Summary
A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 12:51 UTC
CWE
- CWE-404 - Denial of Service
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/398136 | vdb-entry |
| https://vuldb.com/vuln/398136/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-84887 | third-party-advisory |
| https://vuldb.com/submit/886451 | third-party-advisory |
| https://github.com/outlookgp/CVE/tree/main/AgentS… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| simular-ai | Agent-S |
Affected:
0.3.0
Affected: 0.3.1 Affected: 0.3.2 cpe:2.3:a:simular-ai:agent-s:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84887",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T12:51:51.898838Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T12:52:04.451Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:simular-ai:agent-s:*:*:*:*:*:*:*:*"
],
"modules": [
"Model-generated GUI Action Execution Workflow"
],
"product": "Agent-S",
"vendor": "simular-ai",
"versions": [
{
"status": "affected",
"version": "0.3.0"
},
{
"status": "affected",
"version": "0.3.1"
},
{
"status": "affected",
"version": "0.3.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "outlookgp (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T21:00:08.337Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-398136 | simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/398136"
},
{
"name": "VDB-398136 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/398136/cti"
},
{
"name": "CVE-2026-84887 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-84887"
},
{
"name": "Submit #886451 | Simular AI Agent-S 0.3.2 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/886451"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/outlookgp/CVE/tree/main/AgentS_Action_Parameter_Budget_DoS_Report"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-02T16:21:23.000Z",
"value": "VulDB entry last update"
}
],
"title": "simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-84887",
"datePublished": "2026-09-02T21:00:08.337Z",
"dateReserved": "2026-09-02T14:16:09.268Z",
"dateUpdated": "2026-09-03T12:52:04.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84886 (GCVE-0-2026-84886)
Vulnerability from cvelistv5 – Published: 2026-09-02 20:45 – Updated: 2026-09-02 20:45
VLAI
EPSS
VEX
Title
simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption
Summary
A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_server.py of the component OCR HTTP API. Executing a manipulation of the argument img_bytes can lead to resource consumption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/398135 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/398135/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-84886 | third-party-advisory |
| https://vuldb.com/submit/886443 | third-party-advisory |
| https://github.com/hackerguopeng/cve/tree/main/Ag… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| simular-ai | Agent-S |
Affected:
0.3.0
Affected: 0.3.1 Affected: 0.3.2 cpe:2.3:a:simular-ai:agent-s:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:simular-ai:agent-s:*:*:*:*:*:*:*:*"
],
"modules": [
"OCR HTTP API"
],
"product": "Agent-S",
"vendor": "simular-ai",
"versions": [
{
"status": "affected",
"version": "0.3.0"
},
{
"status": "affected",
"version": "0.3.1"
},
{
"status": "affected",
"version": "0.3.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hackerguopeng (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_server.py of the component OCR HTTP API. Executing a manipulation of the argument img_bytes can lead to resource consumption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T20:45:08.525Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-398135 | simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/398135"
},
{
"name": "VDB-398135 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/398135/cti"
},
{
"name": "CVE-2026-84886 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-84886"
},
{
"name": "Submit #886443 | Simular AI Agent-S 0.3.2 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/886443"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/hackerguopeng/cve/tree/main/AgentS_OCR_HTTP_Body_Image_DoS_Report"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-02T16:21:19.000Z",
"value": "VulDB entry last update"
}
],
"title": "simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-84886",
"datePublished": "2026-09-02T20:45:08.525Z",
"dateReserved": "2026-09-02T14:16:05.643Z",
"dateUpdated": "2026-09-02T20:45:08.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84885 (GCVE-0-2026-84885)
Vulnerability from cvelistv5 – Published: 2026-09-02 20:30 – Updated: 2026-09-03 13:34
VLAI
EPSS
VEX
Title
simular-ai Agent-S CodeAgent code_agent.py denial of service
Summary
A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code_agent.py of the component CodeAgent. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 13:27 UTC
CWE
- CWE-404 - Denial of Service
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/398133 | vdb-entry |
| https://vuldb.com/vuln/398133/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-84885 | third-party-advisory |
| https://vuldb.com/submit/886431 | third-party-advisory |
| https://github.com/outlookgp/CVE/tree/main/AgentS… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| simular-ai | Agent-S |
Affected:
0.3.1
Affected: 0.3.2 cpe:2.3:a:simular-ai:agent-s:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84885",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T13:27:38.981270Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T13:34:41.362Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:simular-ai:agent-s:*:*:*:*:*:*:*:*"
],
"modules": [
"CodeAgent"
],
"product": "Agent-S",
"vendor": "simular-ai",
"versions": [
{
"status": "affected",
"version": "0.3.1"
},
{
"status": "affected",
"version": "0.3.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "outlookgp (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code_agent.py of the component CodeAgent. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T20:30:07.409Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-398133 | simular-ai Agent-S CodeAgent code_agent.py denial of service",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/398133"
},
{
"name": "VDB-398133 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/398133/cti"
},
{
"name": "CVE-2026-84885 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-84885"
},
{
"name": "Submit #886431 | Simular AI Agent-S 0.3.2 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/886431"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/outlookgp/CVE/tree/main/AgentS_CodeAgent_Tool_Output_DoS_Report"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-02T16:21:15.000Z",
"value": "VulDB entry last update"
}
],
"title": "simular-ai Agent-S CodeAgent code_agent.py denial of service",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-84885",
"datePublished": "2026-09-02T20:30:07.409Z",
"dateReserved": "2026-09-02T14:16:00.952Z",
"dateUpdated": "2026-09-03T13:34:41.362Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}