Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
goose is a general-purpose AI agent that runs on your machine. Before version 1.44.0, the `goose review` command had a security vulnerability where it ran Git commands without checking for malicious settings in a repository's `.git/config` file, allowing an attacker to execute arbitrary commands on your computer with your user's permissions and access to your environment secrets and API keys. This happened outside of goose's normal safety checks and permission system.
Fix: This issue is fixed in version 1.44.0. Update goose to version 1.44.0 or later.
NVD/CVE DatabaseA vulnerability in Keras (a machine learning library) versions 3.15.0 and earlier allows attackers to crash applications by creating malicious .keras model files. When the keras.models.load_model() function opens these files, it doesn't check how much memory the data needs, causing the program to run out of memory (OOM, an out-of-memory condition where the system can't allocate more space) and crash. This risk affects machine learning pipelines that load models from untrusted sources like public repositories.
A path traversal vulnerability (a type of attack where an attacker can access files outside their intended directory) was found in claude-comfyui-mcp version 1.0.0, specifically in a function that copies image files. The vulnerability can be exploited locally (meaning an attacker needs access to the computer running the software) by manipulating the image file path, and the severity is rated as low.
A path traversal vulnerability (CWE-22, a flaw where an attacker can access files outside a restricted directory) was found in PV-Bhat gemsuite-mcp version 1.0.0, specifically in a file handling component that processes file_path arguments. An attacker with local access to the system could exploit this to access unauthorized files, though the project developers have not yet responded to the initial report.
A vulnerability (CVE-2026-19334) was found in NightTrek Ollama-mcp that allows command injection (running unauthorized system commands) through manipulated arguments in the src/index.ts file, but only if an attacker has local access to the system. Since the software uses a rolling release model (continuous updates without fixed version numbers), specific affected versions cannot be identified, and the developers have not yet responded to the security report.
A vulnerability (CVE-2026-19327) was found in abracadabra50 claude-sesh version 1.0.0 where an attacker can manipulate the sessionId argument to cause path traversal (accessing files outside the intended directory). The attack requires local access to the system and has a low severity rating of 1.9.
A vulnerability (CVE-2026-19268) was found in MCPGateway, a tool related to Claude usage tracking, where an attacker can inject commands by manipulating the 'since' argument in the Claude Usage Range Endpoint function. This command injection (tricking the system into running unintended commands) can be exploited remotely, and working exploit code is already publicly available.
The AI Copilot – Content Generator plugin for WordPress (versions up to 1.5.6) has a security flaw where it doesn't properly check if users are authorized to perform actions. An attacker who is not logged in can exploit this by using a publicly visible security token (nonce, a temporary code meant to prevent unauthorized actions) to create a new admin account and take over the entire website, as long as the plugin's form or chatbot is visible on the site's public pages.
NLTK (Natural Language Toolkit, a library for processing human language) versions 3.9.4 and earlier have a vulnerability in their downloader tool that allows one software package to corrupt or replace another package's trusted resources. The problem occurs because the downloader extracts files into shared folders and only checks if files are legitimate after they've already been written, enabling attackers to inject malicious code that persists even after restarting the program.
Flowise versions up to 3.1.4 have a vulnerability where authenticated attackers can access credentials and data from other workspaces because the system doesn't verify workspace ownership (insecure direct object reference, a flaw where users can access resources by guessing or knowing their identifiers). Attackers can exploit this to view assistant information, access files, and upload malicious files into other users' workspaces.
LangGraph's Postgres and SQLite stores had a bug where namespace scoping (a feature that separates data between users or tenants) didn't properly respect boundaries because it used a string-matching function called LIKE that doesn't understand the dot separator used in namespace paths. This meant a request for data from namespace "alice" could accidentally return data from "alice2" or "alice_user" without any special attack needed. The bug only affects applications where namespace labels could share prefixes, like "1" and "12", or contain underscore characters.
Strands Agents, an open-source SDK for building AI agents, has a vulnerability in its memory tools (mongodb_memory, elasticsearch_memory, and mem0_memory) where the namespace field (the key that separates data between different users) is exposed as a parameter that the LLM can control. An attacker could craft a prompt injection (tricking the AI by hiding instructions in its input) to forge a namespace and read, modify, or delete memories belonging to other users, or inject false memories into another user's data.
Apache CXF, a web services framework, has a vulnerability where it doesn't set a default limit on how many form parameters (data fields submitted in a web request) it will accept. This can allow attackers to send requests with extremely large numbers of parameters, causing a denial of service attack (making the service unavailable by overwhelming it with resource consumption).
A security flaw was found in poco-ai poco-agent versions up to 0.5.4 in the WorkspaceManager._setup_session_persistence function, which results in incomplete cleanup (not fully removing temporary files or data after a session ends). The vulnerability is difficult to exploit and requires complex remote attacks, with a low severity rating (CVSS 2.9).
FrontMCP, a TypeScript framework for the Model Context Protocol (MCP, a system for AI models to interact with external tools), has a critical vulnerability in versions before 1.5.7 where a sandboxed code execution tool leaks access to the host's Function constructor, allowing attackers to run arbitrary code on the server and steal sensitive data like API keys and database credentials. The vulnerability can be exploited by unauthenticated users on unconfigured servers, or through prompt injection (tricking an AI by hiding instructions in its input) on authenticated servers.
CVE-2026-18954 is an authorization bug in Amazon DocumentDB MCP Server (a tool that lets AI assistants access databases). The bug allows certain database operations called aggregation pipeline stages ($out and $merge, which are write operations) to bypass read-only protections, potentially letting an authenticated user make unwanted changes to the database.
A vulnerability exists in AWS Transform MCP Server (a tool that lets AI assistants run code-transformation jobs on a developer's local machine) versions 0.1.0 through 0.1.4. An attacker could exploit improper pathname validation in the get_resource tool to write files anywhere on the system outside the intended directory, potentially leading to local code execution (unauthorized commands running on the developer's computer).
Milvus versions 2.6.22 and 3.0.0 have a vulnerability that allows attackers without authentication to shut down the service by sending a specially crafted HTTP request to an unprotected endpoint on port 9091. By exploiting the /management/stop endpoint, which doesn't require login credentials, attackers can disable critical components like the proxy, datanode, or querynode, causing a denial of service (interruption where the service stops working).
IBM Langflow OSS (an open-source software tool) has a weak cryptographic key derivation vulnerability in its ensure_fernet_key() function (a function that creates encryption keys using Fernet, a symmetric encryption method). The issue involves using a cryptographically weak pseudo-random number generator (PRNG, a tool for creating unpredictable numbers needed for secure encryption), which could compromise the strength of generated encryption keys.
IBM Langflow OSS versions 1.0.0 through 1.10.3 have a security flaw in how they validate custom components when hardening mode is enabled. An authenticated attacker can exploit a cryptographic weakness (truncated SHA-256 hash, a shortened version of a security fingerprint) to create malicious code that appears to match trusted templates, allowing them to run arbitrary Python code and potentially take over the affected system.
Fix: Apply patch 786c9d74800e6d0858b65778f31beb71b3983a50 to resolve this issue. The patch is available at https://github.com/abracadabra50/claude-sesh/commit/786c9d74800e6d0858b65778f31beb71b3983a50.
NVD/CVE DatabaseFix: Upgrade to langgraph-checkpoint-postgres version 3.1.1 or langgraph-checkpoint-sqlite version 3.1.1. The fix changes how prefix scoping works to require the dot separator before any remainder, escapes special characters in namespace labels, and uses segment-aware matching for both prefix and suffix conditions. On SQLite specifically, the code switched from using LIKE to using GLOB for matching descendant namespaces.
GitHub Advisory DatabaseFix: Update strands-agents-tools to version 0.8.3 or later. The bulletin states 'Impacted versions: < 0.8.3', indicating the vulnerability is fixed in version 0.8.3 and above.
AWS Security BulletinsFix: Users are recommended to upgrade to versions 4.2.3, 4.1.8, or 3.6.12, which fix this issue by using a default limit of 500 parameters.
NVD/CVE DatabaseFix: This issue is fixed in version 1.5.7.
NVD/CVE DatabaseFix: Update to version 1.0.12 or later.
AWS Security BulletinsFix: Update awslabs.aws-transform-mcp-server to version 0.1.5 or later.
AWS Security Bulletins