All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
CVE-2026-47478 is a vulnerability in NVIDIA Triton Inference Server for Linux where an attacker can exploit the use of an expired file descriptor (a reference to an open file that is no longer valid), potentially causing a denial of service (making the service unavailable to legitimate users). The vulnerability has a CVSS 4.0 severity rating, though the exact scoring details have not yet been provided.
CVE-2026-47477 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows an attacker to cause a stack-based buffer overflow (a situation where data written to memory exceeds its allocated space, potentially crashing the system). A successful attack could result in denial of service (making the service unavailable to legitimate users).
CVE-2026-47476 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows attackers to cause uncontrolled resource consumption (using up computing resources like memory or CPU without limit), potentially leading to denial of service (making the system unavailable to legitimate users). The vulnerability is classified as CWE-400 (uncontrolled resource consumption), though a CVSS severity score has not yet been assigned by NIST.
AWS HealthLake MCP Server (a tool that lets AI assistants access AWS health data) before version 0.0.14 has a security flaw where it doesn't check that pagination URLs (links used to load more results) point to the legitimate server. An authenticated attacker can exploit this by sending a crafted next_token parameter (a special value that tells the server what data to load next) to redirect requests to their own server and steal temporary AWS credentials (temporary access keys that grant permissions).
A vulnerability in Umbraco.AI could allow users with high-level permissions to expose sensitive configuration values, like passwords and credentials, under certain setups. The vulnerability requires access to the AI section of the admin panel and a specific custom AI provider, which limits how many systems are at risk.
TsDProxy, an HTTP reverse proxy (a server that forwards requests to backend services), fails to strip the X-Forwarded-For and X-Real-IP headers (HTTP headers that indicate a client's original IP address) from incoming requests before forwarding them to backend services. This allows an authenticated Tailscale user (someone with legitimate access to the network) to inject fake IP addresses that backend services trust for access control, potentially bypassing admin restrictions or manipulating audit logs.
The yutu MCP tool `caption-download` has a vulnerability where it writes downloaded files to any path specified by an attacker, bypassing the `YUTU_ROOT` directory boundary that should confine all file operations. Unlike other caption methods that properly use `pkg.Root.Open()` to restrict file access, `Caption.Download()` directly calls `os.Create()` on the attacker-supplied file path, allowing arbitrary file writes anywhere the yutu process has permission to write (CVSS 7.7, high severity).
In n8n-MCP (a tool for connecting AI models to workflows), multi-tenant HTTP deployments (where one server serves multiple separate user groups) did not properly isolate workflow version backups. This meant an authenticated user from one tenant could read, delete, or destroy backup snapshots belonging to other tenants, potentially exposing sensitive information like credentials and authorization headers stored in those backups.
CVE-2026-58617 is a vulnerability in Microsoft 365 Copilot for iOS that allows an unauthorized attacker to gain elevated privileges (higher access permissions) over a network due to improper access control (failing to properly verify who is allowed to do what in the system). The vulnerability has a CVSS score of 4.0, which indicates a moderate severity level.
CVE-2026-55145 is a command injection vulnerability (a type of attack where an attacker inserts malicious commands into user input) in Outlook Copilot that allows an authorized user to tamper with the system over a network. The vulnerability stems from improper handling of special characters in commands. The CVSS severity score (a 0-10 rating of how dangerous the vulnerability is) has not yet been assigned by NIST.
CVE-2026-50510 is a vulnerability in GitHub Copilot where improper file naming restrictions allow an unauthorized attacker to execute code on a user's local machine. The vulnerability is classified as CWE-641 (improper restriction of names for files and other resources), and details are being tracked by Microsoft and NIST.
A vulnerability in Symfony Mailer's Address class allowed attackers to inject email headers and SMTP commands (the protocol used to send emails) by embedding line break characters in email addresses. The constructor was supposed to validate addresses but failed to catch addresses with hidden `\r\n` bytes in the local-part (the text before the `@` symbol), which could be exploited to add unauthorized recipients or headers when the email was sent.
Major book publishers including Hachette, Cengage, and Elsevier have sued Google in federal court, claiming the company illegally used millions of copyrighted books to train its Gemini AI model (a large language model trained on text data) without permission. The publishers describe this as one of the largest copyright infringements in history.
Apple is in talks with PrismML, a startup that compresses large AI models (mathematical systems with billions of parameters that process information) so they can run directly on iPhones instead of requiring cloud servers. PrismML shrunk Alibaba's 54 GB Qwen model down to under 4 GB by drastically simplifying how the model stores information, allowing the compressed version to run on iPhone 15 and newer devices while using significantly less memory and energy, though with some loss in accuracy.
Researchers found that any browser extension able to run scripts on claude.ai can trigger Claude for Chrome to access your Gmail, Google Docs, and Calendar by forging a fake click, since the extension doesn't verify that clicks are from real users rather than scripts. The flaw is rated as high or critical severity depending on whether you have the "Act without asking" automation mode enabled, and while a simple one-line fix exists, Anthropic has not yet released it in the current version 1.0.80.
CVE-2026-48561 is a command injection vulnerability (a flaw where an attacker tricks software into running unintended commands by inserting special characters into input) in Microsoft Copilot that allows an unauthorized attacker to execute code over a network. The vulnerability stems from improper handling of special elements in commands. Details about the severity and available fixes are still being assessed.
GitHub Copilot and Visual Studio Code contain a vulnerability where credentials (login information and authentication tokens) are not properly protected, allowing an attacker to access sensitive information over a network. This is tracked as CVE-2026-47282 and has a CVSS score (a 0-10 rating of how severe a vulnerability is) of 4.0, meaning it has moderate severity.
AWS WAF Bot Control now includes Web Bot Authentication (WBA), a security feature that uses cryptographic signatures (mathematical verification codes created with public and private keys) to confirm that automated bot traffic comes from legitimate sources. Traditional methods like IP-based filtering fail in multi-tenant systems (shared environments where many different services use the same IP address) where attackers can easily fake their identity, but WBA solves this by having bot operators sign their requests with cryptographic keys that AWS WAF can verify at the edge.
The Bank of England governor called for international cooperation to address AI threats, warning that the US cannot secure itself against cyber dangers without global coordination. He emphasized that no country can isolate itself from the cross-border nature of modern systems, and stressed the need for stronger coordinated testing to ensure frontier AI (advanced AI models at the cutting edge of capability) models are safe before wider use.
Fix: Update AWS HealthLake MCP Server to version 0.0.14 or later.
AWS Security BulletinsFix: Patched in version 1.14.0. The source notes that a workaround is not recommended because the patch involves breaking changes that require a full version upgrade.
GitHub Advisory DatabaseFix: Add r.Out.Header.Del("X-Forwarded-For") and r.Out.Header.Del("X-Real-IP") in the Rewrite closure in internal/proxymanager/port.go before calling r.SetXForwarded().
GitHub Advisory DatabaseFix: Change line 272 in `pkg/caption/caption.go` from `file, err := os.Create(c.File)` to `file, err := pkg.Root.OpenFile(c.File, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)` to confine file creation to the `pkg.Root` boundary, matching the approach used in other caption methods.
GitHub Advisory DatabaseSpaceXAI's Grok Build AI coding tool was uploading users' entire codebases (the complete collection of source code files for a project) to Google Cloud storage without proper controls, including files users wanted to exclude and sensitive credentials (secret authentication data). The company disabled this upload feature after security researchers discovered and reported the issue.
Fix: SpaceXAI's servers now return a "disable_codebase_upload: true" flag, and the codebase upload feature "no longer fires" (does not activate).
The Verge (AI)Fix: Upgrade to version 2.56.1, which isolates stored version history per instance so tenants can only access their own backups. The upgrade runs a one-time migration to isolate existing history and clear previously un-scoped backups. If immediate upgrade is not possible, users can disable the workflow version tool by setting `DISABLED_TOOLS=n8n_workflow_versions` in the server environment (for example, in your Docker `.env` file), or run each tenant from a separate instance with its own database instead of multi-tenant mode, or restrict network access to the HTTP endpoint to trusted operators only.
GitHub Advisory DatabaseFix: The Address constructor now rejects addresses containing line breaks. The patch is available at https://github.com/symfony/symfony/commit/dc2dbd29211eb4ddc451373fa1374fb926e94604 for branch 5.4.
NVD/CVE DatabaseFix: The quickest guard is to turn "Act without asking" off and review any extension with permission to read or change data on claude.ai. Researchers also note that "the one-line fix, the researchers say, rejects synthetic clicks at the top of the handler" but confirm this fix "has not shipped" as of July 14.
The Hacker NewsFix: AWS WAF Bot Control implements Web Bot Authentication (WBA) using asymmetric cryptography and HTTP Message Signatures (RFC 9421). The solution works through: (1) Bot registration, where bot operators publish their public keys in a signature directory that AWS WAF regularly polls; (2) Request signing, where each bot request is signed using the operator's private key following IETF standards; (3) Verification, where AWS WAF verifies signatures against known public keys and appends labels (verified, invalid, expired, or unknown_bot) to allow granular control through WAF rules. AWS WAF Bot Control respects WBA verification status by default, automatically allowing verified AI agent traffic.
AWS Security Blog