Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
langchain4j-aideepin through 3.32.0 contains an insecure direct object reference flaw in CharacterMessageController. Authenticated users can access other users' message references because owner checks are missing. Supplying another user's message uuid to the knowledge-embedding-ref, memory-embedding-ref, or graph-ref endpoints returns knowledge-base chunks, long-term memory text, and knowledge-graph data.
CVE-2026-123818 affects LMDeploy, a toolkit for compressing, deploying, and serving large language models, from 0.12.3 through 0.15.0. The _is_safe_url check parses remote media URLs with urlparse, but requests.Session().get handles backslashes differently when sending the request. An attacker can supply a URL whose validated hostname looks globally routable while the request resolves to an internal host, bypassing the non-global address checks and exposing data from internal HTTP services in applications that accept attacker-controlled media URLs.
The read_file MCP tool in codebase_rag/mcp/tools.py has a path traversal flaw in its paginated branch, triggered when offset or limit is supplied. The handler builds the path with Path(self.project_root) / file_path and never checks that the result stays inside the project root, so an absolute path such as /etc/passwd is read directly. The non-paginated branch is protected by @validate_project_path, but that decorator is not applied on the paginated path, which the source says is left completely unguarded.
The HTTP mode of @tsparticles/mcp-server, verified on v4.3.0 (commit 0266d469aa2d719cb66a9c6bf09aded4186ec17c) and still present in v4.3.1 and current main, reuses one stateful StreamableHTTPServerTransport for all clients. An unauthenticated client whose initialize request arrives first claims that shared state, and later clients receive HTTP 400 "Server already initialized" until the process restarts. The first session stays functional while new clients are denied service.
Create a transport per session or maintain a bounded session-id-to-transport map. Do not reuse one stateful transport instance for all HTTP clients.
The HTTP mode of @tsparticles/mcp-server parses POST /mcp request bodies with JSON.parse() outside any request-local error handling. A single malformed JSON request makes the async handler throw and terminates the Node.js process, which the author verified on v4.3.0 at commit 0266d469aa2d719cb66a9c6bf09aded4186ec17c. An unauthenticated remote attacker can take the MCP service offline until an external supervisor restarts it.
Fix: Version 4.3.1 appears to fix this by returning HTTP 400 for invalid JSON. The source recommends wrapping request parsing in a local try/catch and returning a bounded HTTP 400 response such as {"error":"Invalid JSON"}, with the process remaining alive after malformed requests.
The HTTP mode of @tsparticles/mcp-server buffers every incoming request body chunk in an in-memory Buffer[] array with no size limit before calling JSON.parse, in the POST /mcp handler at src/index.ts lines 399-407. An unauthenticated remote attacker can stream an arbitrarily large body and exhaust Node.js process memory, causing a Denial of Service. The official Docker image runs HTTP mode on 0.0.0.0 port 3000 by default.
Fix: A suggested patch tracks cumulative received bytes against a maxRequestBodyBytes threshold of 1 MB (1024 * 1024) and destroys the request when it is exceeded. The source does not state a released fixed version.
A security flaw in huggingface finetrainers versions 0.1.0 and 0.2.0 affects the function resolve_component_cls in finetrainers/utils/model.py, part of the Model Index Handler component. Manipulating the Library argument leads to code injection, and the attack can be launched remotely. A public exploit exists, and the project was notified through an issue report but has not responded.
GPUStack contains an improper authentication vulnerability, tracked as CVE-2026-102895, that allows unauthenticated administrative access. An attacker can change users and models, create persistent administrator API keys, and disclose worker and cloud-provider secrets. The flaw also enables code execution through POST /v2/inference-backends/from-yaml.
IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a flaw that lets an authenticated flow author write attacker-controlled file content into any directory writable by the service account, bypassing the platform's local file access isolation safeguard. A crafted on-disk index can also let the attacker read arbitrary files the service process can access, including configuration files, secrets, or database files under the application's data directory.
Vikunja veans before 2.7.1 contains a prompt injection vulnerability. Project members with write access can set project titles or task content that the prime hook loads on SessionStart and PreCompact, where it is rendered verbatim inside the coding agent's authoritative instruction block. This can cause the agent to modify the developer's checkout or run commands.
Fix: Fixed in 2.7.1
NVD/CVE DatabaseCVE-2026-118046 affects the JS Help Desk AI-Powered Support & Ticketing System plugin for WordPress in all versions up to and including 5.0.2. Insufficient input sanitization and output escaping of the 'jsticket_message' parameter allow stored DOM-based cross-site scripting, which an authenticated attacker with subscriber-level access or above can exploit. The payload runs when an administrator or agent opens the affected ticket, because VenoBox passes the browser-decoded data-title attribute to jQuery .html().
fast-agent versions prior to 0.7.21 run `fast-agent serve` with HTTP transport bound to 0.0.0.0 on port 8000 and no authentication, so any network client that can reach the /mcp endpoint can invoke the agent tool. When the server runs with --shell, that client can run operating-system commands as the server user through the local execute tool; without --shell, it can still use the operator's model and configured MCP tools.
Fix: Fixed in 0.7.21.
CVE-2026-58490 affects Tracecat from version 0.37.0 up to 1.0.0-beta.49 in Docker Compose deployments with SAML enabled. The Docker Compose setup can render SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES as empty values, disabling both signature requirements. An unauthenticated attacker who can reach the SAML assertion consumer endpoint can submit a forged unsigned response for an existing user's email and obtain that user's session, including superadmin takeover. Exploitation does not create users when SAML user creation is disabled, and default Fargate or Helm deployments are not affected.
mistral.rs before 0.9.5 contains a delimiter injection flaw in mistralrs-core that lets attackers inject tool calls. An attacker who controls documents, web pages or tool outputs can embed tags such as </tool_call> so that the qwen-xml, gemma4 or reasoning parsers return extra calls to declared tools with attacker-chosen arguments.
Fix: Fixed in 0.9.5.
NVD/CVE DatabaseA predictable extraction directory in /tmp in all versions of PyTorch's TorchServe lets a local user swap the model handler. The attacker can then run code as the TorchServe service account, which is a local privilege escalation.
GROBID, machine learning software for extracting information from scholarly documents, has a command injection flaw in its Linux non-server PDF conversion path before version 0.9.1. The PDF filename is interpolated into a bash -c command string in DocumentSource.pdfalto, so a single quote in the filename can break out of the quoting and run arbitrary commands with GROBID process privileges. The bundled REST server path is not affected.
Fix: Fixed in 0.9.1.
GROBID, machine learning software for extracting information from scholarly documents, is affected prior to version 0.9.1. The unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, which creates a new fixed thread pool per request and never shuts it down. Repeated requests permanently retain JVM worker threads, which can exhaust thread capacity and degrade or stop request processing.
Fix: Fixed in version 0.9.1.
CVE-2026-123851 affects the JetBrains Junie GitHub Action before version 1.6.4. Its prompt injection protection could be bypassed using HTML-encoded characters.
Fix: Fixed in 1.6.4.
NVD/CVE DatabaseA flaw in the training-operator's PyTorchJob ValidateUpdate webhook comes from an incorrect object casting that lets users bypass an immutability check. Exploitation could detach a queued job from its quota management system or take over a running job's controller ownership. The primary impact is a Denial of Service condition.
Kubeflow Pipelines versions prior to 2.16.1 let the multi-user API server skip authorization for modification and deletion of shared or global pipelines, which use an empty namespace. An authenticated user without the required Kubernetes RBAC permissions can change or delete shared pipeline definitions and versions, harming their integrity and availability. The separate shared-pipeline multipart upload authorization path is outside this advisory and is not fixed by 2.16.1.
Fixed in version 2.16.1.
Fix: Fixed in version 0.15.0.
Fix: Apply mitigations in accordance with vendor instructions, following CISA's BOD 26-04 guidance and its Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure and adhere to BOD 26-04 patching guidelines. Due date: 2026-11-12.
CISA Known Exploited VulnerabilitiesFix: Version 1.0.0-beta.49 removes the insecure deployment pass-through and requires signed assertions and responses.