AI Sec Watch

CVE-2026-47477 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows an attacker to cause a stack-based buffer overflow (a situation where data written to memory exceeds its allocated space, potentially crashing the system). A successful attack could result in denial of service (making the service unavailable to legitimate users).

CVE-2026-47476 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows attackers to cause uncontrolled resource consumption (using up computing resources like memory or CPU without limit), potentially leading to denial of service (making the system unavailable to legitimate users). The vulnerability is classified as CWE-400 (uncontrolled resource consumption), though a CVSS severity score has not yet been assigned by NIST.

The Bank of England governor called for international cooperation to address AI threats, warning that the US cannot secure itself against cyber dangers without global coordination. He emphasized that no country can isolate itself from the cross-border nature of modern systems, and stressed the need for stronger coordinated testing to ensure frontier AI (advanced AI models at the cutting edge of capability) models are safe before wider use.

AWS HealthLake MCP Server (a tool that lets AI assistants access AWS health data) before version 0.0.14 has a security flaw where it doesn't check that pagination URLs (links used to load more results) point to the legitimate server. An authenticated attacker can exploit this by sending a crafted next_token parameter (a special value that tells the server what data to load next) to redirect requests to their own server and steal temporary AWS credentials (temporary access keys that grant permissions).

A vulnerability in Umbraco.AI could allow users with high-level permissions to expose sensitive configuration values, like passwords and credentials, under certain setups. The vulnerability requires access to the AI section of the admin panel and a specific custom AI provider, which limits how many systems are at risk.

The yutu MCP tool `caption-download` has a vulnerability where it writes downloaded files to any path specified by an attacker, bypassing the `YUTU_ROOT` directory boundary that should confine all file operations. Unlike other caption methods that properly use `pkg.Root.Open()` to restrict file access, `Caption.Download()` directly calls `os.Create()` on the attacker-supplied file path, allowing arbitrary file writes anywhere the yutu process has permission to write (CVSS 7.7, high severity).

SpaceXAI's Grok Build AI coding tool was uploading users' entire codebases (the complete collection of source code files for a project) to Google Cloud storage without proper controls, including files users wanted to exclude and sensitive credentials (secret authentication data). The company disabled this upload feature after security researchers discovered and reported the issue.

In n8n-MCP (a tool for connecting AI models to workflows), multi-tenant HTTP deployments (where one server serves multiple separate user groups) did not properly isolate workflow version backups. This meant an authenticated user from one tenant could read, delete, or destroy backup snapshots belonging to other tenants, potentially exposing sensitive information like credentials and authorization headers stored in those backups.

CVE-2026-58617 is a vulnerability in Microsoft 365 Copilot for iOS that allows an unauthorized attacker to gain elevated privileges (higher access permissions) over a network due to improper access control (failing to properly verify who is allowed to do what in the system). The vulnerability has a CVSS score of 4.0, which indicates a moderate severity level.