All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
This item appears to be a navigation menu or promotional content from GitHub showing various AI development tools and features, including GitHub Copilot (an AI coding assistant), GitHub Spark (for building AI apps), and other GitHub services. The reference to 'langchain-core==1.2.11' suggests a specific version of LangChain (a framework for building applications with language models), but no technical issue, vulnerability, or problem is described in the provided content.
FastGPT (an AI platform for building AI agents) versions 4.14.0 to 4.14.5 have a vulnerability where attackers can access the plugin system without authentication by directly calling certain API endpoints, potentially crashing the plugin system and causing users to lose their plugin installation data, though not exposing sensitive keys. This vulnerability has a CVSS score (a 0-10 rating of how severe a vulnerability is) of 6.9, which is considered medium severity.
CVE-2026-21523 is a time-of-check time-of-use (TOCTOU) race condition (a vulnerability where an attacker exploits the gap between when a system checks permissions and when it uses a resource) in GitHub Copilot and Visual Studio that allows an authorized attacker to execute code over a network. The vulnerability has not yet received a CVSS severity rating from NIST.
CVE-2026-21518 is a command injection vulnerability (a flaw where attackers can insert malicious commands into user input) in GitHub Copilot and Visual Studio Code that allows an unauthorized attacker to bypass security features over a network. The vulnerability stems from improper handling of special characters in commands. No CVSS severity score (a 0-10 rating of how serious a vulnerability is) has been assigned yet by NIST.
GitHub Copilot contains a command injection vulnerability (CVE-2026-21516), which is a flaw where special characters in user input are not properly filtered, allowing an attacker to execute code remotely on a system. The vulnerability was reported by Microsoft Corporation and has a CVSS score pending assessment.
CVE-2026-21257 is a command injection vulnerability (a flaw where attackers can insert malicious commands into an application) found in GitHub Copilot and Visual Studio that allows an authorized attacker to gain elevated privileges over a network. The vulnerability stems from improper handling of special characters in commands. As of the source date, a CVSS severity score (a 0-10 rating of how severe a vulnerability is) had not yet been assigned by NIST.
CVE-2026-21256 is a command injection vulnerability (a flaw where attackers can sneak malicious commands into input that a program then executes) found in GitHub Copilot and Visual Studio that allows unauthorized attackers to run code on a network. The vulnerability stems from improper handling of special characters in commands, which means the software doesn't properly filter or neutralize dangerous input before using it.
QuitGPT is a campaign urging people to cancel their ChatGPT Plus subscriptions, citing concerns about OpenAI president Greg Brockman's donation to a political super PAC and the use of ChatGPT-4 by US Immigration and Customs Enforcement for résumé screening. The campaign, which began in late January and has garnered over 36 million Instagram views, asks supporters to either cancel their subscriptions, commit to stop using ChatGPT, or share the campaign on social media, with organizers hoping that enough canceled subscriptions will pressure OpenAI to change its practices.
LangChain released version 1.2.10, which includes a bug fix for token counting on partial message sequences (a partial message sequence is a subset of messages in a conversation), dependency updates, and code refactoring to rename internal variables.
LangChain-core version 1.2.10 includes several updates: dependency bumps across multiple directories, a new ContextOverflowError (an exception raised when a prompt exceeds token limits) for Anthropic and OpenAI integrations, additions to model profiles for tracking text inputs and outputs, improved token counting for tool schemas (structured definitions of what functions an AI can call), and documentation fixes.
This is a game review for "Romeo Is a Dead Man," the first original game in 10 years from developer Suda51, and it criticizes the game for being disappointing and confusing. The reviewer notes that while Suda51 is known for making creative, unconventional games, this title fails to deliver, instead offering an unclear story filled with confusing references that persist throughout the 20-hour gameplay.
MarkUs is a web application for submitting and grading student assignments. Before version 2.9.1, instructors could upload a zip file to create assignments, but the application didn't properly validate the file paths inside the zip, allowing a path traversal attack (an exploit where attackers use special characters like "../" to write files outside the intended directory).
Fix: This vulnerability is fixed in version 4.14.5-fix. Users should upgrade to this patched version.
NVD/CVE DatabaseMost Fortune 500 companies now use AI agents (software that can act and make decisions with minimal human input), but many lack visibility into how many agents are running and what data they access, creating security risks. The report recommends applying Zero Trust security principles (requiring strong identity verification and giving users/agents only the minimum access they need) to AI agents the same way organizations do for human employees.
This article discusses major tech companies (Alphabet, Amazon, Microsoft, and Meta) planning to invest $600 billion in AI this year, while Persian Gulf countries are developing their own AI systems to reduce dependence on the United States. The piece raises questions about whether AI development can happen independently of US tech dominance.
Generative AI has created a widespread problem where institutions like literary magazines, academic journals, and courts are overwhelmed by AI-generated submissions, forcing them to either shut down or deploy AI tools to defend against the influx. This has created an 'arms race' where both sides use AI for opposing purposes, with potential risks to institutions but also some unexpected benefits, such as AI helping non-English-speaking researchers access writing assistance that was previously expensive.
Fix: This vulnerability is fixed in version 2.9.1. Update MarkUs to version 2.9.1 or later.
NVD/CVE DatabaseMicrosoft Office Word has a vulnerability where it trusts user inputs when making security decisions, allowing an authorized attacker to gain elevated privileges (higher access level) on a local computer. This vulnerability is currently being exploited by attackers in real-world attacks.
Fix: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-03-03. See https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514 for specific vendor instructions.
CISA Known Exploited VulnerabilitiesMicrosoft MSHTML Framework (a component that helps Windows render web content) contains a flaw in its security protection mechanism that could let an attacker bypass security features over a network. This vulnerability is currently being exploited by real attackers in the wild.
Fix: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-03-03. See https://msrc.microsoft.com/update-guide/advisory/CVE-2026-21513 for details.
CISA Known Exploited VulnerabilitiesMicrosoft Windows Remote Access Connection Manager has a NULL pointer dereference (a bug where the software tries to use a memory location that doesn't exist), which allows an attacker to crash the service and prevent it from working. This vulnerability is currently being exploited by attackers in real-world attacks.
Fix: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA Known Exploited VulnerabilitiesMicrosoft Windows Remote Desktop Services (a tool that lets users connect to computers remotely) has a privilege escalation vulnerability (a bug that lets an authorized user gain higher-level access than they should have) that could let an attacker who already has some access to the system gain even more control. This vulnerability is currently being actively exploited by attackers.
Fix: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. For specific patches or updates, consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533.
CISA Known Exploited VulnerabilitiesMicrosoft Windows Shell has a vulnerability that lets attackers bypass a security feature over a network without authorization. This flaw is currently being exploited by real attackers, making it an active threat.
Fix: Apply mitigations per Microsoft's vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA Known Exploited Vulnerabilities