High-signal AI/security/automation notes.
CVE-2026-112308 (CVSS 4.0 8.3), published 19 October 2026, records an SSRF flaw in crewai-tools’ SeleniumScrapingTool: every release through 1.15.28 drives a local headless Chrome to an attacker-influenced URL with no private-address check. A fix was proposed on 8 August and auto-closed by a bot on 17 September without human review. Main is still unpatched. We read the CVE record, the PR, the source and the releases first-hand.
Drupal patched CVE-2026-108097 (SA-CORE-2026-014, Critical 19/25) on 14 October 2026: Field UI executes whatever PHP callable a table row names, and at least one exploit path needs no authentication. Sister advisory SA-CONTRIB-2026-218 fixes the same shape in Entity List (CVE-2026-108099). On 20 October FORTBRIDGE published a full lab chain from file disclosure to command execution. Core alone is not reachable; custom code is where the exposure lives.
On 19 October 2026 the fastify project shipped three parallel security releases of fast-uri — a URI parser pulled 91 million times a week, mostly as an invisible transitive dependency of ajv — fixing four parser-differential flaws. The headline defect percent-decodes the scheme before validating it, so ‘%6Aavascript:alert(1)’ normalises into a live javascript: URL. Eleven hours after publication OSV still returned zero vulnerabilities for every affected version. We read the four advisories, the release notes and the registry metadata first-hand.
IBM published two AI-stack security bulletins on 19 October 2026. One covers fourteen Langflow OSS vulnerabilities — three of them 9.9 remote code execution — fixed in v1.12.5, which had already been out for thirteen days with no CVE references in its release notes. The other covers CVE-2026-8355, an OAuth-registration SSRF in the ContextForge MCP gateway whose fix shipped in July. Only one of the fifteen identifiers has an NVD record so far. We read both bulletins, the release notes and the repositories first-hand.
Between 01:17:10Z and 01:17:20Z on 20 October 2026, NVD published fifteen VulnCheck-assigned CVEs against ten open-source AI agent platforms holding roughly 128,000 GitHub stars — Letta, Coze Studio, Langchain-Chatchat, DB-GPT, OpenSRE, EvoScientist, LangAlpha, Aix-DB, piflow and JoySafeter. Credited to Lasso Security, the batch states one defect ten ways: the agent has a shell, and the gate in front of it is absent, mocked, or hard-coded to approve. We read every cited line of source at the pinned commits, and found Coze Studio’s year-old fix never reached the file its own debug target loads.
arXiv:2610.22301 (15 October 2026) names the class ‘filesystem capability laundering’: an MCP tool approved for one job uses its server process’s ambient permissions to read host files outside its contract. Across 21,097 servers from nine registries, 16.4% of triaged servers show the capability; dynamic validation confirms 150 vulnerable instances. Thirteen advisories followed, plus two CVEs in Anthropic’s Git MCP server as case studies.
CVE-2026-111057 (CVSS 10.0), CVE-2026-111058 (9.8) and CVE-2026-111059 (6.1), published 19 October 2026, record three flaws in Mercury, the framework that turns Jupyter notebooks into shareable web apps: a missing comma that fused two blocklist regexes and exposed an unauthenticated root shell, an anonymous kernel channel that survived that fix by design, and an unsanitized Markdown sink. All three were fixed in August and September — the CVE records arrived up to 59 days later. We read the advisories, the fix commits and the releases first-hand.
On 19 October 2026 Microsoft’s EVP of Security declared that frontier models “cannot be trusted” and named deployed agents “agentic insiders” — overprivileged, unpredictable, and able to collude without being compromised. The prescription is Guardian Agents supervising every action before it happens, built on July’s Project Perception stack. We read the announcement first-hand and map it against the NIST incident-response doctrine from three days earlier.
CVE-2026-53995, published 19 October 2026 at CVSS 4.0 8.8, records an unauthenticated path traversal in MLflow’s FileStore backend: a crafted trace ID submitted to the traces API escapes the experiment directory and writes attacker-controlled metadata outside it. FileStore was the default backend before MLflow 3.7.0. The fix is an open, unmerged pull request, the latest release is still vulnerable, and a public proof of concept is already listed. We read the NVD record, the advisory and the proposed patch first-hand.
TYPO3 published nine third-party extension advisories on 20 October 2026, carrying fifteen CVEs. The one worth your attention is CVE-2026-113459 (CVSS 4.0 7.1): the TYPO3 AI Integration Extension embeds the site operator’s configured OpenAI API key in every backend page so the editor plugin can call OpenAI from the browser. Any authenticated backend user can read it and spend it. The same advisory carries an unrestricted page-record write. We read all nine advisories and the CVE records first-hand.
Thirteen Apache Answer CVEs reached NVD within two minutes on 19 October 2026, all fixed in 2.0.3. The headline is CVE-2026-71563: the MCP answer-retrieval tool served hidden, deleted and pending-review content to any global API key holder with no visibility check. Around it sit full API keys written to logs, revoked users keeping file access, a verification code accepted by the wrong workflow, and a hide/show gate wired to the unpin permission. We read all thirteen NVD records and the 2.0.2-to-2.0.3 diff first-hand.
The Apache Software Foundation published 38 Apache Camel CVEs to NVD on 19 October 2026 in fifty-two minutes. The headline record, CVE-2026-78162 at CVSS 10.0, is an incomplete fix for CVE-2026-43865: a deserialization filter that reached the component but not the two instance-bootstrap paths Camel builds itself, including a subclass that overrides doStart() without calling super. The patch merged on 21 August and shipped in 4.22.1 on 13 September. We read every record, both fix diffs and the upgrade guide first-hand.
Five CVEs reached NVD within eighty seconds on 19 October 2026 against BentoML, LangBot and SGLang. BentoML’s CVE-2026-112264 is the third generation of one Dockerfile-injection defect: the sanitiser was applied to base_v2.j2 and never to base.j2, the template selected whenever a custom base image is configured. It was reported on 2 June and the vulnerable line is still on main 139 days later. Across all five records the common fact is not the bug but the remediation: not one has a release you can install.
CVE-2026-16487 and CVE-2026-16460, published 19 October 2026, record bootc and ostree image-mode Linux hosts booting OS content nobody verified: a mutable tag applied under a policy that falls through to insecureAcceptAnything, and staged deployments finalised without revalidation after policy is hardened. Three months ago bootc’s own security document declared the first one not a vulnerability — six days after it was reported. We read both advisories, the policy commit and the Rust guard first-hand.
CVE-2026-109437, published 19 October 2026 at CVSS 4.0 9.2 and CVSS 3.1 9.8, records an unauthenticated remote code execution in Cognition, an agent backend built on Deep Agents and LangGraph. Two unauthenticated POSTs drive the ReAct loop into a local shell. The fix shipped 83 days earlier in v0.13.0 as a feature bullet with no security section, and it closed the insecure default rather than the missing authentication the CVE also names. The project README still demonstrates the exact request sequence. We read the advisory, the release notes and the repository first-hand.
Four inference-engine CVEs reached NVD on 19 October 2026. FastLLM’s own safetensors parser trusts shape and data_offsets independently and its GGUF reader sizes a buffer as len plus five against an attacker-controlled 64-bit length — both with public PoCs and a maintainer who has not responded in fifteen days. SGLang’s expert-distribution recorder routes kill the whole server unauthenticated when the recorder was never enabled, with the fix PR unmerged since 1 October. We read the NVD records, the issues and the code first-hand.
CVE-2026-102503 and CVE-2026-103091, published 19 October 2026, record two critical flaws in Google’s OSS AgentMesh: an unauthenticated /libp2p-http ingress that bypassed Biscuit authorization, and an open OIDC enrollment behind a wildcard default policy. Both were fixed weeks before their CVEs; we read both advisories, the fix commit and both releases first-hand.
On 16 October 2026 NIST’s CAISSI, the NSA’s Super Intelligence Security Center and CISA published ten voluntary practices for SI control incidents — cases where an agent takes significant uninstructed actions that defeat the operator’s own policies and oversight. The document tells labs to expect their agents to find and exploit misconfigurations, to treat monitor inputs as hostile, and to hunt their own agents’ backdoors after shutdown. We read the full TLP:CLEAR publication first-hand.