Intelligence category

AI Vulnerabilities & CVEs

Actionable vulnerability disclosures affecting AI frameworks, agents, model infrastructure, and developer tooling.

Non-Default Config, Internet-Reachable Consequence: F5 Ships Out-of-Band Patches for Three 9.2 NGINX Flaws — 2026-10-22
Patched on 2 October, Named on 20 October: Five MCP SDK CVEs and a Cross-Client Leak the 1.x Line Already Fixed — 2026-10-21
Signed Is Not Requested: Apache Airflow CVE-2026-86467 and the Login-CSRF Class Airflow Already Fixed Once — 2026-10-20
The Fix Was Closed by a Bot: CrewAI CVE-2026-112308 and the Selenium Tool That Skips the SSRF Check — 2026-10-20
The Callable Hiding in the Table Row: Drupal’s Critical Field UI RCE Gets a Public PoC — 2026-10-20
Fourteen CVEs, Three 9.9s, Thirteen Days After the Fix: IBM’s Langflow Bulletin — and an OAuth SSRF in ContextForge — 2026-10-20
The Gate Was Called and Threw the Answer Away: Fifteen Agent-Platform CVEs in Ten Seconds — 2026-10-20
The Missing Comma Was a 10.0: Mercury CVE-2026-111057, CVE-2026-111058 and CVE-2026-111059 — 2026-10-20
The Trace ID Is a Path: MLflow CVE-2026-53995 and the Fix That Is Still a Pull Request — 2026-10-20
The Editor Plugin Hands Out the Key: TYPO3 CVE-2026-113459 and a Fifteen-CVE Extension Batch — 2026-10-20
The Front Door Checked; Twelve Side Doors Did Not: Apache Answer’s Thirteen-CVE Batch — 2026-10-19
The Fix Landed in the Other Template: BentoML’s Third Dockerfile Injection and Four More AI-Serving Records Nobody Can Install — 2026-10-19
The Quick Start Is the Exploit: Cognition CVE-2026-109437 — 2026-10-19
One curl Kills the Server; One Model File Overflows the Heap: FastLLM and SGLang, 19 October — 2026-10-19
The Second Path Had No Gate: Two 9.3 CVEs in Google’s AgentMesh — 2026-10-19
Project-Wide Passes for Cluster-Scoped Powers: OneUptime’s Fifteen-Advisory October Batch and CVE-2026-112047 — 2026-10-19
The Default Only Fires When the Variable Is Missing: OpenTelemetry Python CVE-2026-112006 and Four Years of Optional TLS — 2026-10-19
Strangers Are Supposed to Talk to the Chatbot: Unauthenticated Object Injection in QuantumCloud Forms — 2026-10-19
The Gate Asked the Wrong Question: Unsloth and ESPnet Fix Model-Bundle Code Execution — 2026-10-19
The Authorizer Was Added to One Connector: WhoDB CVE-2026-112005 and Nineteen Advisories Without an Identifier — 2026-10-19
The Validator Knew About Slashes but Not Backslashes: Xinference CVE-2026-112051 and the Release That Does Not Exist Yet — 2026-10-19
The Fork Kept eval() After Upstream Quit It: YOLOv9 Runs ONNX Metadata as Python — 2026-10-19
The Model Was Inert, the File Beside It Was Not: Two Stable Diffusion WebUI CVEs and the 94-Issue Sweep Behind Them — 2026-10-18
The Gate Checked the Role, Never the Object: AI Engine’s Editor Media Helpers — 2026-10-18
The Password Was Public and the Check Never Looked Down: LobsterAI CVE-2026-112014 and Omnigent CVE-2026-112015 — 2026-10-18
The Archive Outlived the Patch: PEERSTITCH Hid in FortiGate Memory on Trust Stolen in 2024 — 2026-10-18
The Guard Lived in One File: Arcane’s Three CVEs and a Credential Repoint That Outlived Its Own Fix — 2026-10-17
The Support Appliance Is the Target: ARMORY CASTLE’s BeyondTrust Zero-Day (CVE-2026-102764) — 2026-10-17
The Session ID Became a Flag: CVE-2026-96620 Turns Claude Agent SDK’s resume Option Into an MCP Server — 2026-10-17
Everything After 10 August Is Invisible: Coder’s Nine Stranded Advisories and Eleven Retroactive CVEs — 2026-10-17
A Traversal That Picks Its Own Serializer — NetLicensing MCP’s ../token Redaction Bypass (CVE-2026-57496) Plus a WordPress Draft-Disclosure Twin — 2026-10-17
Twenty AI Platforms in Eighteen Seconds: VulnCheck’s 122-CVE Batch and the Decorator That Only Looked Like Auth — 2026-10-17
The Gate Was Off by Default: CVE-2026-111322 Leaves Archon’s Agent Control Plane Open on 0.0.0.0 — 2026-10-16
Thirty Dollar Signs Beat the Guard: CVE-2026-77474 Turns a Complexity Bug in dcg Into an Agent Fail-Open — 2026-10-16
The Summary Is the Persistence Layer: DeepSeek Harness Adds a Search-Path RCE and a Compaction Injection — 2026-10-16
Exploited Before It Was Published: CVE-2026-105740 and Sixteen Days of Pre-Disclosure Langflow Attacks — 2026-10-16
It Asked What the Bytes Looked Like, Not Where They Came From: runwasi’s CVE-2026-47218 — 2026-10-16
The Sandbox Was an Empty Dict: SGLang’s Dumper eval() RCE Ships in 0.5.22 After Its Fix Was Closed as Queue Spam — 2026-10-16
The Caller Names the Cache Key: SGLang’s mm_hashes Serves One Tenant’s Image to Another — 2026-10-16
The Delete Tool Did Not Ask: Wheels Ships Nine CVEs, Eleven Advisories, and an MCP Surface That Trusted Its Caller — 2026-10-16
Opening the Folder Is the Exploit, Again: ZCode Connects Workspace MCP Servers Without Asking — 2026-10-16
Each Advisory’s Workaround Is the Other One’s Exploit: Better Auth’s Four-CVE Batch — 2026-10-15
The Attachment Was the Payload: Cisco’s Mail Scanner Writes Root Files for Anyone Who Can Send Email — 2026-10-15
No Bearer Token Required: Flyto2’s MCP Route Skipped the Auth Check Every REST Route Had — 2026-10-15
The Guard Read the Keywords, the Attacker Used Positionals: GitPython’s Six-CVE 3.2.0 Security Release — 2026-10-15
Empty Means Everyone: holaOS’s Messaging Gateway Defaults to Allow-All, and Usernames Are Recyclable — 2026-10-15
The Project Brings Its Own Tools: Junie CLI and the MCP Config That Came With the Repository — 2026-10-15
Hidden From the Model, Open to the Caller: MoviePilot RCE and IntentKit’s Unadvertised Wallet — 2026-10-15
The Check Ran Against the Wrong Thing: n8n’s Fourteen-CVE October Batch — 2026-10-15
The Cache Returns Shells: Next.js’s October Out-of-Band Fixes Two Unauthenticated RCEs and a Server Actions DoS — 2026-10-15
The Firewall Fetches Its Own Exploit: OPNsense’s GeoIP Importer Takes a Filename From the Feed — 2026-10-15
Admin Was Supposed to Be the Ceiling: PAN-OS CVE-2026-0322 Turns Firewall Logins Into Root — 2026-10-15
The Validator Trusted Exactly the Hosts It Should Have Feared: Portkey Gateway SSRF — 2026-10-15
Six CVEs on the Box That Watches: Ubiquiti Patches the UniFi Protect AI Key — 2026-10-15
glob.os.system: The Module Nobody Blocked, and the Sandbox Rewrite That Followed — 2026-10-14
No Login, No Shell, No Trace: The Ivanti Zero-Day Chain That Ran as Root and Cleaned Up After Itself — 2026-10-14
A Tenant Annotation Decides Where Kubeflow’s Controller Sends Its Cluster Token — 2026-10-14
Buffer Everything, Expire Nothing: Three New CVEs in the Official MCP Python and Java SDKs — 2026-10-14
1,413 CVEs in One Tuesday: Microsoft’s Record Patch Batch and the Mark-of-the-Web Zero-Day Already Being Exploited — 2026-10-14
The Cookie Jar Goes to the Tool Server: Open WebUI’s Five-CVE 0.11.4 Batch Hands Your Authority to Everyone It Talks To — 2026-10-14
One Annotation Beats Every Flag: Podman’s CVSS 10.0 Sandbox Bypass Was a 2022 Feature, Found by Claude — 2026-10-14
The Mapping Moved but the Cache Stayed: Vghost, the AI-Found vhost Flaw With a Root Exploit and a VM Escape — 2026-10-14
A Dot Is All You Need: Visual Studio Copilot Gets an 8.8 RCE via Trailing-Dot Path Bypass — 2026-10-14
The File Name Is the Argument: Eighteen Command-Injection CVEs in Nineteen Seconds, Nine With No Fix — 2026-10-14
The Socket Is the Authorisation: Xoscar’s Actor Pool Unpickles Whatever Connects, and Xinference Ships It — 2026-10-14
The Loop Runs Whatever the Model Asks: agno’s Fourth and Fifth CVEs — 2026-10-13
One Missing Role Check, Three Ways to Own the Gateway: Check Point's LiteLLM Chains — 2026-10-13
Five SSRF Records Against One Orchestrator: What conductor-oss’s MCP and A2A Code Actually Does — 2026-10-13
The Rule-Writer Splits on Semicolons, the Rule-Checker Doesn’t: Four Agent Guardrails Fail in One Batch — 2026-10-13
Wrap It in a Dict and the Gate Opens: Crawl4AI’s CVE-2026-109237 Reads the Server’s Secrets — 2026-10-13
Ten in the Regex Compiler, Instructions in the Agent: GitLab’s 19.4.2 Critical Patch — 2026-10-13
The Blocklist Named Its Own Default: MCP Context Forge’s CVE-2026-53709 Mints Platform Admins — 2026-10-13
Checked the First Field, Missed the Payload: Three New Network-AI CVEs and the Guardrail That Keeps Getting Bypassed — 2026-10-13
The Fourth Path Was the MCP Interface: nginx-ui’s Four CVEs — 2026-10-13
The Fix Shipped in August, the CVE Arrived in October: NVIDIA’s 18-CVE AI-Stack Batch — 2026-10-13
Governed, Except by Default: Three obsidian-tc CVEs Sat Fixed but Undisclosed for Three Months — 2026-10-13
Patched in June, Published in October: Two PraisonAI CVEs and the Fix That Needed a Second Fix — 2026-10-13
Five Ways to Disagree With bash: Roo Code Gets Five Approval-Bypass CVEs and No Patch Is Possible — 2026-10-13
The Advisory Says Patched in 0.45.2; the Code Says 0.58.3: SAP's CVSS-10 OAuth2 SSRF in the Cloud SDK for Python — 2026-10-13
The Budget Arrives in the Request: Five SGLang Multimodal CVEs With No Fixed Version — 2026-10-13
One Fix, One Docstring, One Untouched: Three agno CVEs Record What a 42,000-Star Agent Framework Decided to Treat as a Bug — 2026-10-12
The Fix Landed, the Reply Never Did: DeepSeek Harness Rebuilt Its Workflow Sandbox and Told No One — 2026-10-12
The Denylist Grew Twelve Characters and Still Lost: Emacs TRAMP’s Filename RCE Survives Its Own Fix — 2026-10-12
Eight Months, Three Follow-Ups, Zero Replies: mac-shell-mcp’s Whitelist Bypass Outlived Its Own Fix — 2026-10-12
Buffer First, Validate Later: mcp-go Reads Every POST Body Into Memory With No Fix Available — 2026-10-12
The Branch the Validator Never Opened: WeKnora’s Viewer-Role File Read via UNION-in-Subquery — 2026-10-12
The Session ID Is the Only Credential: Three Wukong CVEs Expose AI Chats and HR Records — 2026-10-12
The Gateway Holds the Keys: One Researcher’s 11 October Batch Reads Credentials Out of Seven Agent Platforms — 2026-10-11
The Caller Chooses the Owner: Eight Agent-Platform CVEs in Three Minutes — 2026-10-11
Day Two of the HaiND Batch: 22 Agent and MCP CVEs, a 9.4 Hardcoded Credential, and an Unauthenticated DoS in the Official MCP Kotlin SDK — 2026-10-11
The Annotation Was Commented Out: 76 JeecgBoot CVEs, 22 in the AI Module, and a Fix That Only Exists in Main — 2026-10-11
One Hundred Records in Two Days: JeecgBoot’s Second Wave Turns to Enterprise Messaging Integrations — 2026-10-11
Backup Server, Attacker Server: AhsayCBS Zero-Days CVE-2026-105133 and CVE-2026-105134 Chained to SYSTEM Webshells and XMRig — 2026-10-10
The Code Node Ran as Root: Astron Agent’s CVE-2026-108263 Turns a Workflow Block Into Cross-Tenant RCE — 2026-10-10
One Researcher, Seven Agent CVEs in a Day: HaiND’s VulnCheck Batch Maps the Trust Boundaries Agents Keep Redrawing — 2026-10-10
Ten Advisories, One Release, Zero Version Numbers: nginx-ui’s 9 October Batch Points at Git Hashes — 2026-10-10
The Monitoring Port Was the Attack Surface: NVIDIA CVE-2026-47483 and 12,000 Exposed GPUs — 2026-10-10
Five Critical CVEs for a Bug They Fixed in July: Privasys Files Against Its Own RA-TLS Stack — 2026-10-10
The 9.1 the October Batch Never Mentioned: Splunk MCP Server Deserialization RCE — 2026-10-10
No Auth on the Debugger’s Front Door: x64dbg-MCP Server’s CVE-2026-107824 (9.3) and CVE-2026-107820 — 2026-10-10
The Fix Became the Affected Version: NetScaler CVE-2026-107406 and the Third Upgrade in Eleven Days — 2026-10-09
The Digest Was a Path: CVE-2026-103663 Turns Ollama’s /api/pull Into Unauthenticated Root RCE — 2026-10-09
PraisonAI: 24 Advisories in 33 Hours Point at a Fixed Version That Was Never Published to PyPI — 2026-10-09
The Flag Changed the Envelope, Not the Decoder: SGLang CVE-2026-93034 and an Affected Range That Stops Too Early — 2026-10-09
Fixed on 31 August, Disclosed on 9 October: Strawberry GraphQL’s Permission Bypass Spent Six Weeks in a Patch Note — 2026-10-09
Fixed in June, Numbered in September: DB-GPT’s Two Critical RCEs and the Advisory That Names No Fixed Version — 2026-10-08
The Cache Speaks Pickle: LMCache CVE-2026-105192 Executes Before a Handler Ever Runs — 2026-10-08
The Same Bug, Two SDKs, One CVE: MCP’s TypeScript OAuth Client Gets CVE-2026-104850 and the Python Twin Gets Nothing — 2026-10-08
Splunk Shipped Both Formats on One Day: 17 Described Bugs, 5 Buckets, and a 9.8 With No Vector — 2026-10-08
From Read to Root in One Property File: CVE-2026-21589 Exploitation Begins as watchTowr Shows the Crowd Credential Path — 2026-10-07
Six CVEs for an Unknown Number of Bugs: Cisco’s October NX-OS Hardening Release and the Frontier-Model Footnote — 2026-10-07
The Patch Was Already There, Marked Optional: Dell’s 9.6 DSU Flaw and the 65-Day Advisory Gap — 2026-10-07
A Second September: Exchange CVE-2026-96940 and the Update That Shipped Before Its Own Advisory — 2026-10-07
Your KV Cache Has a Shell: LMCache CVE-2026-107204 Turns a POST Into Root on the Inference Host — 2026-10-07
The Spec Is the Shell: Progress’s 9.6 ARCGenAI Command Injection via OpenAPI Filenames — 2026-10-07
Ten Out of Ten at the Login Portal: SonicWall CVE-2026-102255 Pre-Auth SSRF in SMA1000 — 2026-10-07
Nine Point Three for a Read: Atlassian’s CVE-2026-21589 and the Two Patch Tables That Disagree — 2026-10-06
Twenty-Five Flaws, Two No-Login RCEs — IBM’s Langflow 1.12.3 Batch and the Credential Store Behind It — 2026-10-06
The Validator Executed What It Was Checking: Langflow CVE-2026-51886 and the Decorator That Ran at Definition Time — 2026-10-06
The Same SSRF in Five MCP Servers — Google, JPMorgan and Two Governments Fixed One Researcher’s Finding — 2026-10-06
The Build Server Is the Prize: TeamCity CVE-2026-63077 Goes From KEV to Ransomware as JetBrains Ships 40 More Fixes — 2026-10-06
Nine CVEs, Three Dead Fix PRs — vLLM’s October Batch and the Bookkeeping Problem Behind AI-Found Bugs — 2026-10-06
The Certificate Proved Nothing: Bouncy Castle’s MLS Credential Was Never Bound to the Signing Key — 2026-10-05
A Bare File Path Was Enough — Grafana’s mcp-k6 Returned SSH Keys From a Prompt Argument — 2026-10-05
Two 9.9s, One Sink, Three Different “Fixed In” Versions — Langflow’s MCP Stdio RCE — 2026-10-05
The Cluster Closes With Two 10.0s: Open SQL in MySQL MCP and an Escaped Sandbox at IBM — 2026-10-05
Patched Twice in Eight Days: NetScaler CVE-2026-88779 Crashes the Appliances That Already Took the Fix — 2026-10-05
The Button Was the Payload: CVE-2026-10032 Turns Agent-Rendered UI Into Victim-Origin XSS — 2026-10-04
Opening the Folder Is the Exploit: GitSpawn Turns Untrusted Repos Into RCE Across Seven Coding Agents — 2026-10-04
Any Web Page Could Spend Your OpenAI Key: Cross-Site WebSocket Hijacking in Headroom (CVE-2026-71416) — 2026-10-04
The Planner Was the Shell: CVE-2026-105135 Puts exec() Behind an Unauthenticated Port on 6,900 Stars of Abandoned Code — 2026-10-04
The Approval Checked the First Word; Bash Ran the Whole Line: CVE-2026-102697 in Ollama Agent Mode — 2026-10-04
The Signing Key Is in the Repository: CVE-2026-105147 Lets Anyone Mint an R2R Admin Token — 2026-10-04
Math.random Signed the Cookies: A Mythos-Found 9.8 in Rejetto HFS, Exploited Within a Day — 2026-10-04
A CVE for an Archived Repository: Verba’s Generate Socket Hands Your OpenAI Key to a Caller-Chosen URL — 2026-10-04
Admin by Default: AWS October Bulletins Fix Loom Control-Plane Takeover (CVE-2026-103956, CVSS 10.0) and SageMaker Cross-Space Execution (CVE-2026-104019) — 2026-10-03
Borrowed Trust on the Desktop — CVE-2026-100754 and the ChatGPT macOS Trust Boundary — 2026-10-03
The Argument That Did Nothing: CVE-2026-104873 Turns a LangGraph Allowlist Into a Wildcard — 2026-10-03
Three Advisories, No CVE, Zero Findings: The MCP SDKs Patched Redirects and npm audit Says You Are Fine — 2026-10-03
Four Months Open: CVE-2026-104120 Lands on MCP’s Own Reference Fetch Server — 2026-10-03
Fixed in main on 29 September, Still Shipping on npm: Agent Canvas Publishes Its Own Session Key — 2026-10-03
A Guest Writes Your Error Log, the AI Reads It, the Admin Executes It — CVE-2026-96561 in AI Engine — 2026-10-02
AWS Shipped the Fix in August and the Advisory in October — CVE-2026-97662 Turns a Git Ref Into a File Write — 2026-10-02
A Read-Only Account Reads the Root Password — Foreman’s Template Sandbox Fails Twice in One Advisory — 2026-10-02
No Login, One Request, Any File: FortiMail 9.8 Path-Traversal Zero-Day Was Already Being Exploited — 2026-10-02
A Duo User With a Flowchart Gets a Shell — GitLab’s 9.9 AI Gateway Sandbox Escape (CVE-2026-90970) — 2026-10-02
The Code Comment Named the Gap, and the Gap Shipped — CVE-2026-102437 Turns a Git Diff Into Agent RCE — 2026-10-02
One Day, 125 Advisories, Seven Release Trains Back — Kiteworks Publishes a Year of Fixes at Once — 2026-10-02
Patched in January, Still Harvesting in October — CVE-2026-0768 and Langflow’s 12-CVE Exploitation Streak — 2026-10-02
One Percent-Encoded Character Makes You Admin: Cisco’s SD-WAN Manager Bypass Was Found in a Support Case — 2026-10-01
Ten CVEs, Zero Patches: LightLLM Keeps Shipping allow_pickle on 0.0.0.0 — 2026-10-01
The RCE Behind “Not Affected”: CVE-2026-75604 Turns One Backslash Into a Windows Next.js Shell — 2026-10-01
“Patched Versions: None” — Except Obot Fixed CVE-2026-103758 Two Months Before the Advisory — 2026-10-01
One Crafted Email, Zero Credentials: How Attackers Turned Zimbra SNMP Into Domain-Wide Mailbox Access — 2026-10-01
127.0.0.1.evil.com Passes the Allowlist: CVE-2026-102878 Lets Any Website Drive Your Browser Agent — 2026-09-30
The Gateway That Aggregates Your MCP Servers Aggregates the Blast Radius Too — Two Unpatched MetaMCP CVEs — 2026-09-30
JSX In, Shell Out — CVE-2026-94545 Turns Next.js ImageResponse Into a 9.5 RCE — 2026-09-30
Two MCP Command Injections Got CVEs and a GHSA Each — and Neither Will Ever Show Up in npm audit — 2026-09-30
No Secret Configured, No Authentication Required: Tugtainer’s 9.8 Fail-Open — 2026-09-30
The “Read-Only” Tool That Runs Shell: code-ollama’s grep_search Auto-Executes Injected Commands (GHSA-456v-xq2p-r4cj) — 2026-09-29
One Unverified Email Claim Becomes a Permanent Admin — LiteLLM CVE-2026-93355 Is Still Unpatched — 2026-09-29
An Approval Token That Approves Anything: HMAC Confirmation Replay Across Resources in Zscaler’s MCP Server (CVE-2026-59563) — 2026-09-29
A 10.0 With No Patch to Install: Missing-Authentication Privilege Escalation in Azure AI Foundry — 2026-09-28
Two NetScaler RCE Zero-Days Were Exploited Before the Advisory Existed — 2026-09-28
The Login Page Was Real — and That Was the Attack: Account Takeover in the MCP Python SDK — 2026-09-28
The Box That Issues Your Tokens Can Be Taken Without Login — 2026-09-28
RouterOS Ran the Command Before Anyone Logged In — MikroTrick Is Now in KEV — 2026-09-28
A SharePoint Spoofing Bug Was RCE All Along — and the Federal Patch Deadline Is Today — 2026-09-28
UTCP Patched the Same SSRF Four Times — and the Redirect Hop Was Still Open — 2026-09-28
Comment2XSS: A Comment Becomes Stored XSS, Then an Admin-Session RCE Chain — 2026-09-28
WordPress Backported a Fix to 4.7. Attackers Needed 11 Hours. — 2026-09-28
Eight Heym CVEs Landed at Once — and the Oldest Was Patched Three Months Ago — 2026-09-27
Five Obot CVEs in One Batch — a Quickstart That Ships Owner/Admin and an MCP Gateway That Skips Authorization — 2026-09-27
The Patch Shipped in June. The Exploit Wave Came in September — Pre-Auth RCE in Orkes Conductor — 2026-09-27
Penpot Patched the MCP Bridge It Missed in May — and the REPL Still Has No Password — 2026-09-27
Ten SiYuan CVEs Landed in One Batch — and the Release Notes Called Them “Some security vulnerabilities” — 2026-09-27
Every SolarWinds ARM Install Shipped the Same Key — and the Port Is Open by Instruction — 2026-09-27
Microsoft’s Debugger for AI Agents Shipped a Drive-By RCE — and the Fix Never Got a Version Number — 2026-09-26
A New PoC for Grafana’s MCP Server Tells Defenders the Wrong Version Is Safe — 2026-09-26
A WordPress MCP Plugin Shipped Three Auth Failures — Including One-Click Admin Creation — 2026-09-26
72 OpenClaw CVEs Landed in One Day — for Bugs Patched Back in July — 2026-09-26
DBHub’s Read-Only Mode Was Dead Code — and Three Advisories Landed at Once — 2026-09-25
DeepSeek Published Its Agents’ Escape Playbook — and Its Shipped Harness Fell to One Shell Command — 2026-09-25
GitLab’s CI Regex Parser Hid Two 9.9 RCEs — and Its AI Features Needed Four More Fixes — 2026-09-25
IBM’s Payment Platform Needed Nearly Fifty Patches — Including One for Poisoned AI Runbooks — 2026-09-25
Kiro’s Eighth CVE of 2026 Is the Same Bug Class as Its Third — 2026-09-25
MaxKB Shipped a Shell Tool Nobody Asked For — and Forgot to Ask Before Running It — 2026-09-25
mcp-atlassian Let an Unauthenticated Caller Upload /etc/passwd to Their Own Server — 2026-09-25
Five mcp-remote CVEs Say “Arbitrary Code Execution.” The Research They Cite Does Not. — 2026-09-25
ServiceNow Patched Five AI Platform Flaws — Four Need No Login at All — 2026-09-25
Five Months After the Patch, WSO2’s JWT Bypass Hit CISA’s KEV — With a Three-Day Fix Deadline — 2026-09-25
Bifrost’s Off-by-Default Admin Auth Turned an AI Gateway Into Two Unauthenticated RCE Paths — 2026-09-24
LiteLLM’s MCP Auth Bypass Became the First MCP Flaw in CISA’s KEV Catalog — 2026-09-24
A Content-Type Confusion Turned OpenCode’s Upgrade Endpoint Into Drive-By RCE — 2026-09-24
GitLab MCP Flaws Turned a Personal Access Token Into an Unauthenticated Control Plane — 2026-09-17
Two AI Agent Control Servers Exposed Unauthenticated Command Execution — 2026-09-16
Four Flowise CVEs Reach From MCP Configuration to RCE, Cross-Workspace Tools, and Key Theft — 2026-09-16
PraisonAI’s 27-CVE Batch Breaks Agent Approval, MCP, Sandbox, and Authentication Boundaries — 2026-09-16
Dynatrace MCP Advisories Expose an Unauthenticated Path From HTTP to Production Telemetry — 2026-08-02
MCP Ruby SDK 0.23.0 Fixes Five Transport Flaws—but Session Ownership Still Needs Application Logic — 2026-07-30
GitHub MCP Server Panic Gets CVSS 7.5—but Remote Authentication Narrows the Exposure — 2026-07-29
HashiCorp Terraform MCP Server Flaws Cross Tenant and Token Boundaries — 2026-07-29
Ruflo’s Default Docker Stack Exposed an Unauthenticated MCP Shell — CVE-2026-59726 — 2026-07-29
n8n’s 16-Advisory Security Batch Reaches the Expression Sandbox, Credentials, and MCP — 2026-07-28
A Malicious Repository Could Drive Claude Code Out of Its Sandbox — CVE-2026-55607 — 2026-07-26
SiYuan’s MCP Route Turned Anonymous Readers Into Workspace Administrators — CVE-2026-66012 — 2026-07-26
Open WebUI 0.10.0 Closes 18 Newly Disclosed CVEs Across Sessions, Tools, and Files — 2026-07-25
AWS API MCP Server Could Run Without Its Configured Policy Gate — CVE-2026-16584 — 2026-07-24
Bedrock AgentCore Package Arguments Could Become Sandbox Commands — CVE-2026-16796 — 2026-07-24
Google Says Pre-July Agent Studio Web Apps Need Regeneration After SSRF Fix — 2026-07-24
ZenML Stack Endpoint Exposed Cross-Tenant Deployment Metadata — CVE-2026-11876 — 2026-07-23
MCP Python SDK WebSocket Servers Need an Explicit Origin Gate Even After CVE-2026-59950 Patch — 2026-07-21
Malicious VS Code Workspaces Could Redirect Copilot Tokens — CVE-2026-47282 — 2026-07-21
ToolHive Auth Discovery Escaped MCP Container Isolation via Host-Side SSRF — CVE-2026-58196 — 2026-07-20
AWS HealthLake MCP Pagination SSRF Could Exfiltrate Temporary Credentials — CVE-2026-15643 — 2026-07-16
MCP Documentation Server Exposed Its Knowledge Base Without Authentication — CVE-2026-54504 — 2026-07-16
Strands Agents Memory Tool Let Prompts Redirect an Elasticsearch API Key — CVE-2026-15746 — 2026-07-16
n8n-MCP Cross-Tenant Backup Flaws Expose Workflow Secrets — CVE-2026-54052 and CVE-2026-55608 — 2026-07-15
json_repair Circular Schema Reference Can Pin AI Service Workers — GHSA-xf7x-x43h-rpqh — 2026-07-14
MCP Atlassian 0.22 Closes a 37-Advisory Security Audit — 2026-07-14
Unit 42 — Pickle in the Middle: Cross-Tenant RCE in Google Vertex AI — 2026-07-10
CVE-2026-59707 — LocalAI Unauthenticated SSRF in Model Apply Endpoint — 2026-07-08
Langroid CVE-2026-55615 — Prompt-to-Cypher Injection Enables RCE via Neo4j — 2026-07-08
vLLM Patches Two New DoS CVEs in v0.24.0 — Audio Memory Exhaustion and Regex ReDoS — 2026-07-08
vLLM CVE-2026-55646 — Audio Upload Memory Exhaustion DoS (CVSS 6.5) — 2026-07-08
LiteLLM Three-CVE RCE Chain — Default User to Full AI Gateway Compromise in Two Seconds — 2026-07-04
Trend Micro — CVE-2026-33017 Langflow RCE Weaponized for Monero Mining on AI Servers — 2026-07-03
Anthropic — Buffa Rust Library 0-Day: 22x Heap Amplification via Protobuf Unknown Fields — 2026-07-02
CVE-2026-50143 — Apify MCP Server Token Leak via Path Authority Injection — 2026-07-02
Sysdig — First Exploitation of Langflow CVE-2026-55255 IDOR Chained with RCE — 2026-07-01
Cursor CVE-2026-26268 — Sandbox Escape Lets Attackers Achieve RCE via Prompt Injection in AI Coding Agent — 2026-06-30
CVE-2026-33017 — Langflow RCE Exploited for Monero Mining on AI Servers — 2026-06-29
CVE-2026-40933 — Flowise MCP stdio RCE: 1-Click Server Takeover via Malicious Workflow — 2026-06-29
CVE-2026-53923 — vLLM GGUF Dequantization Bug Leaks GPU Memory Between Tenants — 2026-06-25
LangGraph SQL Injection to RCE — Checkpointer Chain Exposes Agent State — 2026-06-25
x41 Security — CVE-2026-48746 vLLM Authentication Bypass Affects Versions 0.3.0–0.22.0 — 2026-06-23
CVE-2026-5027 — 7,000 Langflow Instances Under Active Attack via Path Traversal to RCE — 2026-06-23
vLLM — CVE-2026-54236 Exposes Sensitive Data via Incomplete Log Sanitization Fix — 2026-06-23
vLLM — Two New CVEs Expose AI Inference Servers to Code Injection and NaN Exploits — 2026-06-23
LiteLLM CVE-2026-42271 — Unauthenticated RCE via Starlette bypass — 2026-06-12
AWS — CVE-2026-11393 AgentCore CLI Triple-Quote Code Injection — 2026-06-11
Pluto Security — CVE-2026-4372 Hugging Face Transformers Config Injection RCE — 2026-06-11
Microsoft Patch Tuesday June 2026 — Copilot CVEs + AI Component Flaws — 2026-06-10
Cymulate — InversePrompt Bypasses Claude Code Path Restrictions & Command Injection (CVE-2025-54794, CVE-2025-54795) — 2026-06-09
CVE-2026-6942 — radare2-mcp Command Injection — 2026-06-09
White House AI Executive Order — Cybersecurity Clearinghouse & AI Defenses — 2026-06-09
CVE-2026-45555 — Roslyn CodeLens MCP Server RCE — 2026-06-08
CVE-2026-47250 — MCP Server Kubernetes Bearer Token Exfiltration — 2026-06-08
Horizon3 — CVE-2026-42271 Chained with BadHost for Unauthenticated LiteLLM RCE — 2026-06-08
CVE-2026-45497 — Microsoft 365 Copilot Critical Command Injection RCE — 2026-06-05
CVE-2026-27735 — MCP Reference Servers git_add Path Traversal — 2026-06-04
DesktopCommanderMCP SSRF (CVE-2026-10690) — MCP File Tool Exposes IMDS — 2026-06-04
IBM Langflow CVE-2026-7524 — Unauthenticated RCE via Symlink Archive Abuse — 2026-06-03
NousResearch hermes-agent CVE-2026-10548 — Improper Auth in Credential Pool Sync — 2026-06-03
Microsoft — CVE-2026-35435 Azure AI Foundry Agent Privilege Escalation — 2026-06-02
Google MCP Toolbox CVE-2026-9739 — DNS Rebinding to Enterprise Databases — 2026-06-01
NousResearch Hermes-Agent CVE-2026-10221 — Context Compression Injection — 2026-06-01
STAR Labs — Four Full-Chain LiteLLM Exploits Across Versions — 2026-06-01
Palo Alto Networks — CVE-2026-0257 GlobalProtect Auth Bypass, CISA KEV — 2026-05-31
PraisonAI CVE-2026-47408 — Unauthenticated A2A eval() RCE — 2026-05-31
PraisonAI CVE-2026-47409/47414 — Workspace Takeover and Cross-Workspace IDOR — 2026-05-31
vLLM CVE-2026-22778/34756 — Heap Leak and DoS in Multimodal Serving — 2026-05-31
Langroid CVE-2026-25879 — Prompt-to-SQL Injection Leads to RCE — 2026-05-29
vLLM CVE-2026-4944 — Hardcoded trust_remote_code Bypass Enables RCE — 2026-05-29
Ars Technica — BadHost CVE-2026-48710: Starlette Host-Header Auth Bypass Hits AI Tooling — 2026-05-27
arXiv: Viper-MCP Finds 106 0-Day Vulnerabilities in MCP Servers — 2026-05-26
Network-AI CVE-2026-46701 — Unauthenticated Cross-Origin MCP Tool Invocation — 2026-05-26
Microsoft Semantic Kernel CVE-2026-26030/25592 — Prompt Injection to RCE — 2026-05-25
LMDeploy CVE-2026-46517 — hardcoded trust_remote_code bypasses HF default-secure — 2026-05-24
CISA Adds Langflow Origin Validation Flaw to KEV — Active Exploitation Confirmed — 2026-05-23
Splunk AI Toolkit — CVE-2026-20238 Improper Access Control — 2026-05-23
Trump Scraps AI Executive Order on Frontier Model Oversight — 2026-05-23
Nebula Security — Vega AI Discovers nginx-poolslip Zero-Day RCE in Patched nginx 1.31.0 — 2026-05-22
SGLang Three Unauthenticated RCEs (CVE-2026-7301/7302/7304) — 2026-05-22
Anthropic Silently Patches Claude Code Sandbox Bypass — 2026-05-21
ChromaDB CVE-2026-45829 — Unpatched RCE in Vector Database — 2026-05-21
NVIDIA Triton — CVE-2026-24207 Critical Auth Bypass in Inference Server — 2026-05-21
n8n — Five Critical CVEs Including Prototype Pollution RCE in AI Workflow Platform — 2026-05-19
Cyera — Four Chainable OpenClaw CVEs Expose 180K+ AI Agent Servers — 2026-05-16
mlflow — CVE-2026-2652 Authentication Bypass Exposes ML Experiment Jobs — 2026-05-16
Azure AI Foundry CVE-2026-35435 — Privilege Escalation in M365 Published Agents — 2026-05-15
NGINX Rift — LLM-Powered Researcher Finds 18-Year-Old RCE (CVSS 9.2) in 1/3 of All Websites — 2026-05-15
Open WebUI — Path Traversal Arbitrary File Write/Delete (CVE-2026-44565, CVE-2026-44566) — 2026-05-14
vm2 — Dozen Critical Sandbox Escape CVEs in Node.js Code Execution Library — 2026-05-14
Cline Kanban — Cross-Origin WebSocket Hijack → RCE (CVE-2026-44211) — 2026-05-13
DeepChat — CVE-2026-43899 RCE via Electron Pop-up Bypass & CVE-2026-43900 XSS — 2026-05-13
PraisonAI — CVE-2026-44338 Auth Bypass Exploited in Under 4 Hours — 2026-05-13
CISA KEV — LiteLLM CVE-2026-42208 SQL Injection Under Active Exploitation — 2026-05-12
OpenClaw — CVE-2026-44995 MCP Stdio Server Environment Variable RCE — 2026-05-12
banks CVE-2026-44209 — Jinja2 SSTI in Prompt Template Library Leads to RCE — 2026-05-10
CVE-2026-44843 — LangChain Unsafe Deserialization via Overly Broad load() Allowlists — 2026-05-10
FastGPT CVE-2026-42302 — Agent Sandbox RCE via Disabled Authentication — 2026-05-10
CVE-2026-34070 — LangChain Path Traversal in Legacy Prompt Template Loading — 2026-05-10
FastGPT — SSRF Cluster in AI Agent Platform — 2026-05-09
vm2 — CVE-2026-26956 Sandbox Escape with Published PoC — 2026-05-07
NVIDIA NemoClaw — Sandbox Environment-Variable Exfiltration and SSRF via Blueprint Config (CVE-2026-24222 / CVE-2026-24231) — 2026-05-04
Hugging Face LeRobot — CVE-2026-25874 Unauthenticated RCE via Pickle Deserialization — 2026-05-03
LiteLLM — CVE-2026-42208 SQL Injection Exploited Within 36 Hours — 2026-05-03
Sunwood-ai-labs MCP Server — CVE-2026-7593 OS Command Injection — 2026-05-03
Anthropic SDK — CVE-2026-41686 Insecure File Permissions — 2026-05-01
IBM Langflow Desktop — CVE-2026-6543 Command Injection (CVSS 8.8) — 2026-05-01
Novee — Cursor IDE CVE-2026-26268: Git Hooks Enable RCE via AI Coding Agent — 2026-04-30
Wiz — GitHub CVE-2026-3854 RCE via Single Git Push — 2026-04-29
LiteLLM Pre-Auth SQL Injection Exploited Within 36 Hours — 2026-04-28
OpenClaw — Six CVEs Cover Agentic Consent Bypass, RCE, SSRF, and Authorization Gaps — 2026-04-24
Anthropic MCP Design Flaw Enables RCE Across the AI Ecosystem — 2026-04-22
Apache ActiveMQ CVE-2026-34197 — Claude Discovers 13-Year-Old RCE in 10 Minutes — 2026-04-22
MCPwn: Actively Exploited nginx-ui Auth Bypass (CVE-2026-33032) — 2026-04-22
CERT — CVE-2026-5752 Terrarium Sandbox Escape via Pyodide Prototype Chain Traversal — 2026-04-22
LMDeploy CVE-2026-33626 — SSRF in LLM Serving Toolkit Vision Module — 2026-04-21
SGLang CVE-2026-5760 — RCE via Malicious GGUF Model Files — 2026-04-20
vLLM Patches protobuf.js Remote Code Execution — 2026-04-19
FastGPT NoSQL Injection Auth Bypass (CVE-2026-40351/40352) — 2026-04-18
mcp-neo4j-cypher Read-Only Mode Bypass via Stored Procedures (CVE-2026-35402) — 2026-04-18
OpenClaw — CVE-2026-33579 Privilege Escalation via Missing Scope Validation in Device Pairing — 2026-04-16
GitHub Advisories — MCP Security Vulnerabilities Cluster (CVE-2026-40159, CVE-2026-39885) — 2026-04-12 12:30
LiteLLM — Critical bytecode rewriting RCE (CVE-2026-40217) — 2026-04-11
lollms — Critical stored XSS in social features (CVE-2026-1115) — 2026-04-11
badlogic — pi-mono code injection CVE-2026-5556 exposes AI coding agents — 2026-04-01
griptape — Path traversal CVE-2026-5595 affects AI agent file operations — 2026-04-01
OpenClaw — Critical privilege escalation vulnerability CVE-2026-33579 — 2026-04-01
TheHackerWire — MLflow RCE via model artifact command injection (CVE-2025-15379) — 2026-03-31
BSI Advisory — vLLM Hardcoded trust_remote_code Bypasses User Security (CVE-2026-27893) — 2026-03-30
Azure Data Explorer MCP Server — KQL injection allows arbitrary query execution (CVE-2026-33980) — 2026-03-29
GitHub Advisory — Langflow public flow build RCE (CVE-2026-33017) — 2026-03-21
GitHub Advisory — MCP Go SDK Cross-Site Tool Execution (CVE-2026-33252) — 2026-03-21
Spring AI — FilterExpressionConverter Injection Flaws (CVE-2026-22729, CVE-2026-22730) — 2026-03-20
AWS — API MCP File Access Restriction Bypass (CVE-2026-4270) — 2026-03-19
Miggo Security — LangSmith Account Takeover (CVE-2026-25750) — 2026-03-18
ONNX — Zero-interaction model supply-chain attack (CVE-2026-28500) — 2026-03-18
Orca Security — Pickle RCE in SGLang LLM Framework (CVE-2026-3059/3060) — 2026-03-18
Microsoft — Azure MCP Server SSRF enables managed identity token theft (CVE-2026-26118) — 2026-03-14
Microsoft — Excel XSS weaponizes Copilot Agent for zero-click data exfil (CVE-2026-26144) — 2026-03-14
GitHub Advisory — LangChainJS serialization injection (CVE-2025-68665) — 2026-03-11
OffSec — MLflow LFI via URI fragment (CVE-2024-2928) — 2026-03-11
vLLM — Speculative decoding cache poisoning (CVE-2026-3108) — 2026-03-11
vLLM — SSRF protection bypass via parser differential (CVE-2026-25960) — 2026-03-09
GitHub Advisory — Copilot CLI shell expansion RCE (CVE-2026-29783) — 2026-03-07
GitLab Advisory — mcp-memory-service info disclosure (CVE-2026-29787) — 2026-03-07
GitHub Advisory — Agentgateway MCP→OpenAPI parameter injection (CVE-2026-29791) — 2026-03-06
Arctic Wolf — mcp-atlassian unauth RCE/SSRF (CVE-2026-27825/27826) — 2026-03-05
GitLab Advisory — mcp-nmap-server command injection (CVE-2026-3484) — 2026-03-05
CERT/CC — MS-Agent shell tool command injection (CVE-2026-2256) — 2026-03-05
GitHub Advisory — Langflow CSV Agent RCE (CVE-2026-27966) — 2026-03-04
NVD — MCP TypeScript SDK cross-client data leak (CVE-2026-25536) — 2026-03-03
GitLab Advisory — MCPJam Inspector RCE (CVE-2026-23744) — 2026-03-03
ServiceNow — AI Platform RCE (CVE-2026-0542) — 2026-03-02
GitHub Advisory — vLLM trust_remote_code bypass RCE — 2026-03-02
GitLab Advisory — MCP Go SDK case-folding bug (CVE-2026-27896) — 2026-03-01
GitLab Advisory — mcp-server-git path traversal (CVE-2026-27735) — 2026-03-01
Endor Labs — Six OpenClaw vulnerabilities via AI SAST — 2026-02-28
GitHub Advisory — Cursor Agent MCP special-files prompt injection (CVE-2025-54135) — 2026-02-24
GitHub Advisory — fermat-mcp eqn_chart code injection (CVE-2026-2008) — 2026-02-24
GitHub Advisory — GitHub Kanban MCP Server command injection (CVE-2025-53818) — 2026-02-24
GitHub Advisory — sf-mcp-server command injection RCE (CVE-2026-26029) — 2026-02-24
GitLab Advisory — ebay-mcp env var injection (CVE-2026-27203) — 2026-02-21
ZDI Advisory — gemini-mcp-tool command injection (CVE-2026-0755) — 2026-02-18
GitHub Advisory — vLLM trust_remote_code bypass RCE — 2026-02-17
GitHub Advisory — vLLM Completions API RCE (CVE-2025-62164) — 2026-02-16
NVD — Cloudflare Agents SDK OAuth callback XSS (CVE-2026-1721) — 2026-02-15
GitHub Advisory — godot-mcp command injection RCE (CVE-2026-25546) — 2026-02-08
n8n — CVE-2026-25049: New Sandbox Escape Bypass Enables Full Server Takeover — 2026-02-06
Zafran — ChainLeak: Chainlit AI Framework Bugs Enable Cloud Takeover — 2026-02-05
GitHub Advisory — vLLM RCE in Video Processing (CVE-2026-22778) — 2026-02-04
ZDI — Unpatched RCE in Gemini MCP Tool via command injection (CVE-2026-0755) — 2026-02-03
OX Security — Critical vLLM RCE via malicious video URL (CVE-2026-22778) — 2026-02-03
AISLE — AI Discovers 12 OpenSSL Zero-Days Including a 27-Year-Old Bug — 2026-02-01
INCIBE-CERT — github-kanban-mcp-server command injection (CVE-2026-0756) — 2026-01-31
Microsoft Security Blog — LangChain Core serialization injection (CVE-2025-68664) — 2026-01-31
Obsidian Security — Langflow account takeover + RCE chain (CVE-2025-34291) — 2026-01-31
GitHub Advisory — vLLM DoS via 1×1 image (CVE-2026-22773) — 2026-01-31
GitHub Advisory — vLLM multimodal SSRF (CVE-2026-24779) — 2026-01-31
Cyata — Prompt-injection reachable CVEs in Anthropic’s official Git MCP server — 2026-01-30
Fortinet — FortiCloud SSO auth bypass exploited in the wild (CVE-2026-24858) — 2026-01-30
Kyverno (CVE-2026-22039) — Namespaced Policy apiCall can cross namespace boundaries — 2026-01-30
NVD — MCP TypeScript SDK UriTemplate ReDoS (CVE-2026-0621) — 2026-01-30
Microsoft — CVE-2026-21509 (Office) emergency out-of-band fix — 2026-01-30
GitHub Advisory — Orval MCP generation code injection risk (CVE-2026-22785) — 2026-01-30
GitHub Advisory — vLLM model-load RCE risk via auto_map (CVE-2026-22807) — 2026-01-30
GitHub/NVD: vm2 sandbox escape (CVE-2026-22709) enables host code execution — 2026-01-30
AI-related CVEs: a practical tracker and triage workflow — 2026-01-29