What changed in AI security, Jun 23 to Jun 29, 2025
Jun 23 to Jun 29, 2025 (ISO week 2025-W26). Weeks run Monday to Sunday in UTC.
13 records published, +8 on the previous week: 11 vulnerabilities (+10), 0 incidents (no change), 0 research items (-1), 2 news items (+1), 0 policy items (-2).
Critical and high advisories
Vulnerability records rated critical or high, newest first.- High
CVE-2025-53098: Roo Code arbitrary command execution via MCP configuration file writes
CVE-2025-53098NVD/CVE Database - High
CVE-2025-53002: LLaMA-Factory remote code execution through Checkpoint path in WebUI
CVE-2025-53002NVD/CVE Database - High
CVE-2025-52882: Claude Code IDE extensions allow unauthorized websocket connections
CVE-2025-52882NVD/CVE Database - High
CVE-2025-6206: Aiomatic WordPress plugin arbitrary file upload via image editor AJAX submit
CVE-2025-6206NVD/CVE Database - Critical
CVE-2025-2828: langchain-community RequestsToolkit SSRF allows access to local addresses
CVE-2025-2828NVD/CVE Database
Exploitation signals
Vulnerabilities published in the week that are listed in the CISA Known Exploited Vulnerabilities catalog or have an EPSS score of 10% or more.| Advisory | Exploitation | EPSS | Published |
|---|---|---|---|
| CVE-2025-2828: langchain-community RequestsToolkit SSRF allows access to local addresses CVE-2025-2828NVD/CVE Database | Not listed | 21.0% |
Packages that began delegating to a language model
Exposure Registry packages whose first release declaring an LLM SDK, agent framework or MCP dependency was published in the week.| Package | Ecosystem | LLM SDKs | Release | Released |
|---|---|---|---|---|
| @llamaindex/workflow-core | npm | LlamaIndex | 0.4.5 |
Topics that moved
Largest increases over the mean of the 4 previous weeks, for topics with at least 3 records in the week.| Topic | Records | Weekly mean, previous 4 | Difference |
|---|---|---|---|
| Model Context Protocol | 3 | 0.5 | +2.5 |
| AI agents | 3 | 0.8 | +2.3 |
Research
Peer-reviewed first, then newest.No research papers or reports were published in this week.
Policy and regulation
Newest first.No regulatory or policy records were published in this week.
Generated from the AI Sec Watch database at . Every item links to its record.