Browse All

LMDeploy versions 0.9.2 through 0.15.x have a remote code execution vulnerability in their DistServe feature, which uses pickle deserialization (a Python method that can accidentally run malicious code while unpacking data) on messages from untrusted ZeroMQ sockets. An attacker who can send requests to the `/distserve/p2p_connect` endpoint can trick the server into connecting to a malicious endpoint and executing arbitrary code with the privileges of the LMDeploy process, especially if API-key authentication is not enabled.

Microsoft released patches for a maximum-severity flaw in Azure AI Foundry (an enterprise platform for building and managing generative AI applications) that could let attackers gain unauthorized elevated privileges without authentication, along with several other critical vulnerabilities in Microsoft 365 and Azure services. The company stated that cloud-based vulnerabilities have already been automatically mitigated and require no action from users, while Windows vulnerabilities were addressed through cumulative updates for Windows 11 version 26H1.

M365 Copilot has a command injection vulnerability (a flaw where special characters in user input can trick the system into running unintended commands), which allows an authorized attacker to gain higher privileges over a network. The vulnerability affects users who already have some level of access to the system.

SQLBot is a system that converts natural language questions into SQL database queries using AI and RAG (retrieval-augmented generation, where the system pulls in external data to help answer questions). Before version 1.9.0, authenticated users could exploit a second-order SQL injection (a type of attack where malicious code is stored first, then executed later) by crafting a fake table name in an Excel configuration file, which would then run as dangerous commands when the datasource was deleted.

SQLBot, a system that converts natural language questions into database queries using AI and RAG (retrieval-augmented generation, where the AI pulls in external data), had a vulnerability before version 1.9.0 where attackers could upload files with misleading names that tricked the system into saving malicious Python code to a special folder. When SQLBot restarted or updated its database structure, it would accidentally run the attacker's code.

Grav (a CMS platform) has a vulnerability in how it validates dynamic function calls in blueprints (configuration templates). The validation uses a denylist (a list of forbidden functions) for bare PHP functions, but `error_log` is missing from that list. An attacker with page-editing permissions can exploit this to write arbitrary PHP code to a file using `error_log`, then execute it for remote code execution (RCE, where an attacker runs commands on a system they don't own).

Grav's XSS (cross-site scripting, where malicious code runs in a visitor's browser) detection has a gap: when an unpaired quote appears inside an unquoted HTML attribute value, the detector's regex cannot advance past it to find event handlers like `onerror=`. This allows payloads like `<img src=x" onerror=alert(1)>` to pass through uncaught and execute in browsers. Non-super editors can save this malicious code to pages, where it runs for all visitors.

LMDeploy versions 0.9.1 through 0.10.1 contain a remote code execution vulnerability (RCE, where an attacker can run commands on a system they don't own) in its RPC server (a service that handles requests from other computers). The vulnerability exists because the server uses pickle.loads() (a Python function that converts serialized data back into code) directly on incoming messages without checking if they're safe, allowing attackers to execute malicious code.

A vulnerability called bucket squatting (exploiting unprotected cloud storage locations) in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions before 1.166.1 lets attackers run arbitrary code on systems (RCE, remote code execution) and steal authentication tokens belonging to tenant projects (shared computing environments).

IBM Langflow OSS versions 1.0.0 through 1.10.0 have a critical vulnerability where attackers can run arbitrary Python code (code that does whatever the attacker wants) with root privileges (the highest access level) by uploading components that import socket or urllib libraries. This allows attackers to steal AWS credentials, steal files from the server, or attack other services like PostgreSQL and Redis running on the same network, while a faulty security check incorrectly marks these malicious components as safe.

PraisonAI, a system that coordinates multiple AI agents working together, had a vulnerability in versions before 4.6.59 where an attacker could send commands to an unprotected API endpoint and trick the system into running arbitrary operating system commands without needing a password or approval. The vulnerability existed because the approve field could mark commands as safe before proper security checks happened.

A security vulnerability in Mistral Vibe allows attackers to run unauthorized code by sneaking environment variable assignments (settings that control how programs behave) before allowlisted commands, which bypasses the permission checks that normally prevent this. The vulnerability works because these environment variable assignments are not inspected for safety before the command runs.

Mistral Vibe contains a vulnerability where attackers can bypass security checks that normally prevent unauthorized commands from running by using ANSI-C quoted arguments (a special text formatting method). This allows someone to modify an approved command so it secretly runs malicious code on a user's computer without permission.

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.11.5 has a vulnerability that allows an attacker to run arbitrary code (any commands they want) on a system by injecting malicious code during graph construction (the process of building the visual workflow/logic structure in Langflow).

IBM Langflow OSS versions 1.0.0 through 1.11.5 have a vulnerability that lets remote attackers run arbitrary OS commands (unauthorized instructions on the underlying operating system) because the software doesn't properly filter dangerous characters in user input before using it in system commands.

IBM Langflow OSS versions 1.0.0 through 1.11.5 has a vulnerability that lets unauthenticated attackers (those without login credentials) run arbitrary code (any commands they want) and access or change chat sessions through publicly shared project endpoints, because the software doesn't properly restrict access to public flows (shared AI workflows) or isolate sessions (separate user conversations) from each other.

OmniRoute, an open-source AI gateway (a tool that connects to multiple AI model providers through one interface), has a critical security flaw in version 3.8.49 and earlier. An attacker can send specially crafted requests to the /api/acp/agents endpoint that bypass security checks and execute arbitrary code (run any commands they want) on the server, especially when login is disabled or during initial setup. The vulnerability exists because the system uses weak filters to block dangerous shell commands and fails to properly authenticate or restrict access to sensitive endpoints.

LiteLLM is an open-source AI gateway that manages connections to multiple LLM providers, and researchers found that nearly 1 in 10 publicly accessible instances had no authentication or used a default master key, allowing attackers to gain access. Beyond the expected risk of API abuse (LLMjacking, where attackers run up costs using your account), the researchers discovered multiple critical vulnerabilities including authentication bypass via the MCP endpoint (CVE-2026-59822), remote code execution (RCE, where attackers can run commands on the server) through custom code guardrails (CVE-2026-59821), and credential theft via pass-through endpoints, potentially compromising the entire cloud environment.

Predis, a PHP Redis client library, has a flaw in how it handles pipelined commands (batched Redis operations) on aggregate connections like clusters and replication setups. An attacker who can control any argument (a value or key) can inject CRLF characters (line breaks) to smuggle arbitrary Redis commands into the connection. On cluster connections this enables remote command injection attacks like wiping data or stealing keys, while on replication connections it causes a denial of service (crash) when any value contains line breaks.

A vulnerability in MLflow (a platform for managing machine learning workflows) versions 0.0.1 and newer allows attackers to run arbitrary code (unrestricted commands) on a user's computer by creating a malicious model artifact (a saved machine learning model file) that executes when someone loads it into their project.