All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Organizations struggle to protect sensitive data when employees use AI tools because traditional security tools like CASB (cloud access security brokers, which control who can access cloud applications) and DLP (data loss prevention, which blocks sensitive information from leaving an organization) focus on whether users can access an app, not on what they actually say to the AI or what it does with that information. The real risk appears in the conversation itself, where users might accidentally share confidential details across multiple prompts in ways that don't match standard security rules.
Flowise AI versions up to 3.1.2 have a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability in the SQLite Record Manager node. An attacker can override the database file path through the `additionalConfig` input and write an SQLite database to arbitrary locations on the system, including sensitive directories, especially dangerous when Flowise runs as root in Docker containers.
Flowise has a security vulnerability in its unauthenticated prediction API endpoint where an attacker can inject arbitrary properties through an `overrideConfig` object (a set of configuration overrides) into the flow execution context without proper access checks. This allows attackers to manipulate chat sessions, steal conversation history, and inject malicious values into template variables that flow nodes use, even though a similar vulnerability was supposedly fixed in an earlier patch.
Flowise has a critical security flaw in its SSRF (server-side request forgery, a vulnerability where an attacker tricks a server into making requests to unintended targets) protection that fails to properly check IPv4-mapped IPv6 addresses (a format like ::ffff:127.0.0.1 that disguises IPv4 addresses as IPv6). Because the code compares address types without converting them to a common format, attackers who control DNS records can bypass all IP-based access restrictions and reach internal services or cloud metadata endpoints.
Flowise's CSVAgent node allows users to write Python code that gets executed, but its security filter (a denylist blocking dangerous functions) can be bypassed using `pandas.read_pickle()`, a function that deserializes pickled data and can be exploited to run arbitrary code without triggering the filter.
Flowise version 3.1.2 contains a critical remote code execution vulnerability in its CSV Agent component. An attacker can inject Python code through unsanitized base64 string interpolation, which then uses Pyodide (a tool that runs Python in the browser/JavaScript environments) to access Node.js system functions and execute arbitrary commands as the root user. This vulnerability has been verified with actual exploit code that established a reverse shell session.
Flowise contains a sandbox escape vulnerability in the executeJavaScriptCode() function that allows authenticated users to run arbitrary system commands as root. The function uses JavaScript's spread operator to merge user-provided nodeVMOptions with default security settings, letting attackers override the restricted module list and re-enable dangerous modules like child_process (which runs system commands) and fs (which accesses files).
marimo (a Python notebook tool) before version 0.23.15 has a configuration injection vulnerability (a flaw where untrusted settings override safe ones) that lets notebook creators steal API keys. An attacker can hide a malicious base_url (the server address an AI request goes to) in notebook metadata, and when an operator opens the notebook and makes an AI request, marimo sends the operator's OpenAI API key to the attacker's server instead of the legitimate one, without requiring any code to actually run.
Flowise, a low-code platform for building AI applications, contains a sandbox escape vulnerability that allows attackers to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own) through custom JavaScript execution. The vulnerability exploits a weakness in how Flowise uses the vm2 sandbox (a deprecated JavaScript isolation library) combined with a bypass of the CVE-2022-24785 patch in the moment library, which was supposed to prevent malicious file path access.
Flowise has a missing authorization bug in the `/api/v1/files` endpoint that allows any API key within an organization to list and delete files from other workspaces, even if that API key has no permission to access files. The endpoint only checks if files are enabled as a feature, but does not verify that the API key has permission to access files in that specific workspace, breaking the isolation between workspaces.
Flowise AI version 3.1.2 has a critical vulnerability where several database connection nodes (MySQL, PostgreSQL, SQLite, and Agent Memory components) allow users to set arbitrary options through an `additionalConfig` input that gets passed to TypeORM's DataSource class. Since TypeORM's DataSource options support loading local files as JavaScript code, an attacker can exploit this to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own) by crafting malicious configuration options.
Flowise has a vulnerability where the OAuth2 token refresh endpoint is publicly accessible without authentication and makes server-side HTTP requests to attacker-controlled URLs without protections (SSRF, or server-side request forgery, where an attacker tricks a server into making requests on their behalf). This allows attackers to see the full response from their target server and steal sensitive OAuth2 secrets like client IDs and refresh tokens that get sent in the request body.
Flowise has an IDOR vulnerability (insecure direct object reference, where an attacker can access resources by guessing or changing object IDs) in its payment source endpoint that allows logged-in attackers to view other customers' sensitive data like email addresses and account balances by changing the customerId parameter in the URL. The flaw exists because the server checks only that a user is logged in, not whether they own the specific customer ID they're requesting.
Zenity, an AI security company founded in 2021, has raised $125 million in funding to help organizations safely deploy AI agents (software programs that act autonomously on behalf of users) by monitoring their behavior and blocking harmful actions. The company's platform works across multiple AI systems like ChatGPT and Gemini, and its research division hunts for security vulnerabilities in agentic AI platforms, including zero-click attacks (exploits that require no user interaction to compromise a system). The new funding will support product development, expansion of security research, and growth into more global markets.
A malicious npm package called keyv@6.0.0 spread to hundreds of packages in August 2026, using a preinstall script (code that runs automatically when a package is installed) to steal credentials like passwords and API keys from developer machines and CI environments (continuous integration systems that automatically test and deploy code). The worm could also plant hidden hooks in VS Code and Claude Code editors that execute the malicious code when a developer opens the project.
A critical vulnerability in Microsoft Azure's Cosmos DB (a cloud database service) allowed attackers to escape the Gremlin sandbox (a restricted environment for running queries) and gain unauthorized access to any customer's database by obtaining a "Cosmos Master Key" (a platform-wide credential). The flaw affected not only customer databases but also Microsoft's own services like Teams and Copilot, and could have exposed databases even if they were network-isolated.
Fix: The source text provides three explicit remediation options: (1) Best option: Use `pyodide.globals.set('base64_string', base64String)` instead of string interpolation. (2) Validate base64 before interpolation by rejecting any string that does not match the pattern `/^[A-Za-z0-9+/=]*$/`. (3) Escape special characters (`"`, `\n`, `\r`, `\\`) before interpolation into the Python code.
GitHub Advisory DatabaseFix: Upgrade marimo to version 0.23.15 or later.
NVD/CVE DatabaseVaronis announced Agent Intent-Based Access Control (IBAC), a security feature that monitors AI agents (autonomous programs that perform tasks with access to company data) to prevent them from acting outside their intended purpose. Agent IBAC compares what an agent was asked to do with its actual behavior and can block, alert, or quarantine the agent if it detects dangerous deviation, such as accessing tools or data it wasn't meant to use.
Fix: Varonis Atlas Agent IBAC provides runtime guardrails that can alert, block, modify, log, or route actions to a person for approval based on configured policies. When an agent crosses policy lines, Atlas can quarantine the identity behind it and block all subsequent actions for a customer-defined time window. Teams can also write their own session policies in plain language, and sensitivity settings (lenient, balanced, and strict) can be tuned to match the appropriate response level based on potential impact.
BleepingComputerResearchers at Barracuda Networks demonstrated how attackers can exploit AI assistants built into email accounts to conduct sophisticated account hijacking attacks. In their proof of concept, attackers with a compromised lower-level email account used the AI chatbot to cover their tracks, gather intelligence about the organization, craft convincing phishing emails mimicking the compromised user's writing style, and ultimately hijack a CEO's account to authorize fraudulent wire transfers. The attack works because the resulting phishing emails come from legitimate accounts, bypass security filters, and match the expected communication patterns of trusted employees.
Fix: SafeDep advises responders to remove the malware's credential-revocation watcher before rotating exposed tokens and keys, since revocation is the watcher's trigger and rotating first can run an attacker-supplied local handler. Additionally, npm 12 blocks unapproved dependency lifecycle scripts by default, protecting users on that version going forward.
The Hacker NewsAI systems can now discover and exploit security vulnerabilities faster than human defenders can respond, creating a dangerous speed gap in cybersecurity. Wiz proposes an AI Threat Readiness Framework focused on two key capabilities: having complete visibility across all systems (cloud, on-premises, developer workstations, and SaaS applications) and being able to respond to threats as quickly as they emerge. The company is expanding its security platform to monitor new high-risk areas, including developer workstations where AI coding agents (automated AI tools that write code) can access credentials and source code at machine speed.
Fix: Wiz announced the Wiz Sensor for Developer Workstations in Private Preview for Windows and macOS, which provides "continuous visibility into every package, IDE extension, and AI tool across the developer fleet, real-time supply chain attack detection, and AI governance to see and control what's running on every machine."
Wiz Research BlogResearchers built NOVA (Network and Open-Source Vulnerability Analyzer), an AI system that automatically discovers vulnerabilities in open-source software, and found 14,090 previously unknown vulnerabilities in 3,915 projects in just two months. The discovery shows that AI is dramatically speeding up how fast vulnerabilities are found, which means attackers have less time before patches are released. The company is addressing this by partnering with open-source maintainers to responsibly disclose vulnerabilities and deploying Advanced Virtual Patching, which uses AI to deliver protections within hours rather than waiting the typical 55 days for traditional patches.
Fix: Advanced Virtual Patching is designed to operate at the speed of AI and collapse the exposure window from the industry-average 55 days it takes to deploy a traditional patch down into a near-zero window of exposure. The source also recommends organizations deploy vulnerability management, zero-trust network architecture (a security model that verifies every access request, whether from inside or outside the network), software supply chain security, and other attack surface reduction best practices.
Palo Alto Unit 42Fix: Microsoft blocked the vulnerable Gremlin attack path within 48 hours of being notified on November 20, 2025, and completed a broader architectural redesign across all Azure regions by July 2026. The company also eliminated the platform-wide "Cosmos Master Key" authentication mechanism entirely. Microsoft stated that no customer action is required.
CSO Online