All items
All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
12,081 items
When @sylphx/pdf-reader-mcp runs as an HTTP server (MCP_TRANSPORT=http), it reads MCP_API_KEY and logs that X-API-Key authentication is enabled, but never validates the header, so the /mcp endpoint accepts unauthenticated requests. With the default bind address of 0.0.0.0, any client that can reach the port can invoke every PDF tool and read any PDF the server process can open on the host, and URL-based sources allow limited SSRF unless --allow-private-ips is set. Only the opt-in HTTP transport is affected; the default stdio transport is not.
Fix: Fixed in @sylphx/pdf-reader-mcp@3.0.1, which enforces the X-API-Key header with a constant-time comparison (rejecting missing or mismatched keys with HTTP 401), changes the default bind host to 127.0.0.1, and emits a startup warning when binding a non-loopback host without an API key. Workarounds for deployments that cannot upgrade immediately: set MCP_HTTP_HOST=127.0.0.1; place a reverse proxy in front that enforces authentication; use the default stdio transport instead of HTTP; or restrict filesystem reach with --allow-dir / MCP_PDF_ALLOWED_DIRS.
GitHub Advisory DatabasePraisonAI's JobWorkflowExecutor._exec_inline_python() runs inline Python from YAML workflow script: steps after AST validation, but the module import allowlist (allowed_modules) includes 'os', and the AST allowlist permits ast.Import, ast.Call and ast.Attribute nodes. A script such as "import os; os.system(...)" passes validation, so arbitrary OS commands run with the privileges of the calling process when PRAISONAI_ALLOW_JOB_WORKFLOWS=true and a workflow is executed via praisonai workflow run. The source notes the risk is greatest in multi-tenant or CI environments where workflows come from untrusted sources.
An OpenCode user who reported a bypass of per-IP usage limits on the free hosted models was harassed in the project's GitHub issue tracker, including comments encouraging suicide. The reporter's proposed fix was tying limits to accounts and detecting rapid IP changes, and the source says the GitHub thread has since been deleted.
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, letting authenticated clients choose which HuggingFace model the server loads. A malicious repository with a pickle weight file can execute Python code under PyTorch below 2.6, or exhaust disk and memory.
IBM Langflow OSS versions 1.0.0 through 1.12.8 are affected by CVE-2026-110186. A remote attacker can exploit improper control of code generation to execute arbitrary code.
IBM Langflow OSS versions 1.0.0 through 1.12.4 are affected by CVE-2026-107329. A remote authenticated attacker could exploit improper control of code generation to execute arbitrary code.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain CVE-2026-107328. The flaw is improper neutralization of code in eval/exec, which could allow a remote authenticated attacker to execute arbitrary code.
IBM Langflow OSS versions 1.0.0 through 1.12.4 are affected by CVE-2026-107327. A remote authenticated attacker can execute arbitrary code because of missing authorization.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain CVE-2026-107326. A remote authenticated attacker can exploit improper neutralization of special elements used in an OS command to execute arbitrary code.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a flaw, tracked as CVE-2026-104339, caused by improper neutralization of special elements used in an OS command. A remote attacker can exploit it to execute arbitrary code.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) flaw, tracked as CVE-2026-104331. An authenticated attacker can make the system send unauthorized requests, which may enable network enumeration or other attacks.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain CVE-2026-104328. A remote authenticated attacker can exploit improper neutralization of special elements used in an OS command to execute arbitrary code.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a flaw that lets a remote authenticated attacker execute arbitrary code. The cause is deserialization of untrusted data, tracked as CVE-2026-104324.
IBM Langflow OSS versions 1.0.0 through 1.12.3 deserialize untrusted data. A remote attacker who can reach the message broker can exploit this to execute arbitrary code on the system.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a flaw tracked as CVE-2026-104316. An authenticated attacker can cancel any victim's running background workflow job with a single HTTP request, because no flow-level permission check is performed. The result is loss of in-progress compute work.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) flaw, tracked as CVE-2026-104315. An authenticated attacker can make the system send unauthorized requests, which may enable network enumeration or other attacks.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain CVE-2026-104314. An authenticated attacker holding a read or share grant on a target flow can retrieve the flow owner's stored third-party credentials in cleartext from the API response.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a flaw that lets an authenticated attacker have the server generate a ZIP archive whose entry paths traverse outside the intended extraction directory. If a victim extracts that archive with a tool that does not sanitize paths, arbitrary file write on the victim's host can result.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability, tracked as CVE-2026-104310. A remote authenticated attacker can exploit it to obtain sensitive information.
Fix: Remove 'os' from allowed_modules and allow only 'os.path' by explicitly handling it, for example by permitting 'from os.path import ...' only and blocking other os submodules. The source's recommended code replaces the set with {'datetime', 'time', 'json', 'math', 're', 'collections', 'itertools', 'pathlib'} and adds an ImportFrom check for node.module == 'os.path'. No fixed version is stated in the source.
Researchers study role spoofing, where malicious text in tool outputs, such as a webpage an agent visits, impersonates the user by exploiting LLM role confusion. They find that models track who said what using both content cues and structural cues like control tokens and formatting, and that LLMs are highly susceptible to attacks combining fake structure and content. The paper also proposes detecting role spoofing with linear probes trained to predict conversation roles, which it reports is effective across different settings.
Fix: Proposed method: detecting role spoofing using linear probes trained to predict roles in a conversation. The source also reports that adversarial training against content-based injections mitigates content-based attacks but leaves models susceptible to structure-based attacks.
Arxiv (cs.CR + cs.CL + cs.LG)