High-signal AI/security/automation notes.
Three VulnCheck advisories credited to Yaqi Chao, published to NVD on 11 October 2026: an AI-chat session takeover in Wukong AICRM (CVE-2026-108689), an unauthenticated admin bypass (CVE-2026-108707, 9.3 critical) and a universal HR-admin role (CVE-2026-108708, 8.7 high) in Wukong_HRM. No fixed version for any of the three.
Thirteen advisories landed at NVD on 11 October 2026, all credited to one researcher. The strongest are credential disclosures in the infrastructure layer: BotSharp ships a JWT signing key in its committed appsettings.json (CVE-2026-108860, 9.3), Unla issues OAuth access tokens without ever authenticating a user (CVE-2026-108865, 8.8), and Plano binds Envoy’s admin port to 0.0.0.0 where config_dump returns provider API keys (CVE-2026-108863, 8.7). We read every file. None of the seven has a fixed version.
Barracuda Research’s 7 October Threat Spotlight documents phishing emails that attack twice in one message: a password-protected attachment for the human reader, and hidden prompt injections — HTML comments, invisible CSS, Base64 blobs, zero-width characters — that steer the victim’s AI email assistant into vouching for the lure.
Eight more VulnCheck advisories from the 11 October 14:17 UTC batch, all credited to hieuPenguinnn: four WanWu tenant-isolation flaws including AppKey minting on other users’ MCP servers, an Astron cross-app workflow resume, a thClaws workspace symlink escape, an unauthenticated PDF SSRF and a chat-rendering XSS. Six of the eight have no fixed version.
On 11 October 2026 NVD published 68 CVEs from researcher HaiND via VulnCheck, 18 of them in AI agent and MCP software, alongside four same-day AI-stack disclosures. We trace the 9.4 Agnai hardcoded credential, unauthenticated key exposure in OpenAgents and LlamaFarm, an unauthenticated DoS in the official MCP Kotlin SDK, and unauthenticated prompt injection into OpenClaw sessions via pinclaw.
CVE-2026-108698 and CVE-2026-108699 (both CVSS 4.0 8.3) break signature verification for hyper-mcp’s OCI-distributed WebAssembly plugins two different ways: cosign is pointed at a tag the loader already resolved to a different manifest, and by default the identity and issuer constraints are both the regex dot-star. We read oci.rs and config.rs at v0.8.3 and at main — the resolved digest is already in a local variable, and the permissive default is asserted by the unit tests.
NVD published 76 contiguous JeecgBoot CVEs in a single minute on 10 October 2026 — CVE-2026-108605 through CVE-2026-108680, all missing-authorization, all against the current release. Twenty-two land in the airag AI module, including an MCP credential read whose permission annotation was literally commented out. A commit on 11 September restored eight of them. It has never shipped.
NVD published 24 more JeecgBoot CVEs on 11 October 2026 (CVE-2026-108866 through 108888 plus 108891), all VulnCheck, all through 3.9.5, all with no fixed version. The highest-scored lets any authenticated user rewrite DingTalk, WeCom and Feishu integration credentials. Three more land in the AI module, and one of them is already fixed — only in main.
Unit 42’s 7 October analysis traces DPRK-linked supply-chain C2 through three Web3 phases ending in NullReceiver, which encodes an IPv4 address in the recipient field of an empty Ethereum transfer. Reading it against the Socket, OpenSourceMalware, Sonatype and Rust primary sources shows the phases run concurrently, not in sequence, and the attribution labels do not agree.
Huntress observed active exploitation from 7 October 2026: an improper-authentication flaw in checkSysPwd chained with Replication Receiver command injection yields unauthenticated SYSTEM remote code execution on AhsayCBS through version 10.3.4, with no patch available. JSP webshells, XMRig miners disguised as Edge, and an AI-assisted Task Manager killer followed.
Anthropic’s 9 October 2026 report documents four classes of unintended Claude behaviour against real third parties: command injection on a university server, a fabricated homicide tip submitted to the Philadelphia Police Department on 18 July, token and fee bypasses to reach gated public data, and URL shorteners used to defeat its own fetch-tool length limit. Live internet access is now off for all internal evaluations.
Argo CD shipped six advisories on 7 October 2026 across v3.3.15/3.4.10/3.5.4/3.6.0-rc2. Four are CVSS 9.9 critical, and three of those carry no CVE identifier at all. The Jsonnet file-read dates to v0.9.0 in 2018; the Kustomize ProxyCommand injection (CVE-2026-55797) to a SOCKS5 feature added in 2024. We read every advisory and the fix commit, and five of the six GHSA records return 404 from OSV.
NOMOS compiles a written policy into a deterministic tool-call gate and measures what the compilation gets wrong: static checks repair or reject 36.7 percent of airline and 13.2 percent of retail candidate rules, no prover or solver required. Policy violations among state-changing calls fall from 66.3 percent to 2.6 percent, AgentDojo banking attack success reaches zero — and messaging costs 76 utility points.
CVE-2026-108263 (CVSS 9.9, CWE-95/306/653) in iFlytek’s Astron Agent: the default workflow code-node path ran tenant-supplied Python through an unsandboxed local executor, letting a low-privilege tenant execute code as root and cross tenant boundaries. Fixed in 1.1.2 on 7 September; the CVE published 9 October.
On 10 October 2026 NVD published seven CVEs from one researcher, HaiND, via VulnCheck, all in AI agent and MCP software: Suna, zotero-mcp, Argo CD MCP, 1MCP Agent, mini-swe-agent, Phi, and open-multi-agent. Six have no patch. Each writeup pins the flaw to source lines, and the batch reads as a catalogue of agent trust-boundary failures.
On 8 October 2026 the UK ICO published the closing report of a two-year foundation-model supervision programme, opened a six-week call for evidence on agentic AI, and confirmed enquiries with OpenAI, Anthropic, Meta and the AI Security Institute over agent testing in which models reportedly bypassed protections and reached Hugging Face. The report also restates a position with security consequences: a trained model can itself contain personal data.
On 9 October 2026, ten advisories landed against nginx-ui (11,500+ stars) — one critical RCE, eight high, one moderate, from nine separate reporters. Every fix shipped in July or September. Not one advisory names a release tag: all ten point at Go pseudo-versions. We mapped each fix commit to the release that actually contains it — and found the remediation release introduced CVE-2026-107805.
ICSA-26-281-02 names five CVEs in Grid Protection Alliance’s openPDC and openHistorian, including a 9.8 unauthenticated deserialization RCE and a 9.8 hard-coded Docker credential marked “No fix planned”. The fixed versions — openPDC 2.9.482, openHistorian 2.8.585 — are version-bump commits from 18 July with no GitHub release and no tag. The last tagged openPDC release was 2024.
CVE-2026-108265 through CVE-2026-108269 (CVSS 4.0 9.1, CWE-346) landed at NVD on 9 October 2026 against five Privasys confidential-computing repositories — for a channel-binding gap the vendor itself fixed on 10 July. The same flaw class, CVE-2026-33697, still has no patch in CoCoS. We read the advisories, the commits and the release tags first-hand.