Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
MLflow version 2.20.3 has a vulnerability where temporary directories used to create Python virtual environments are set with world-writable permissions (meaning any user on the system can read, write, and execute files there). An attacker with access to the `/tmp` directory can exploit a race condition (a situation where timing allows an attacker to interfere with an operation before it completes) to overwrite Python files in the virtual environment and run arbitrary code.
Fix: The issue is resolved in mlflow version 3.4.0.
NVD/CVE DatabasevLLM, a system for running and serving large language models, has a Server-Side Request Forgery vulnerability (SSRF, where an attacker tricks a server into making requests to unintended targets) in its multimodal feature before version 0.14.1. The bug exists because two different Python libraries interpret backslashes differently, allowing attackers to bypass security checks and force the vLLM server to send requests to internal network systems, potentially stealing data or causing failures.
PyTorch (a Python package for tensor computation) versions before 2.10.0 have a vulnerability in the `weights_only` unpickler that allows attackers to create malicious checkpoint files (.pth files, which store model data) triggering memory corruption and potentially arbitrary code execution (running attacker-chosen commands) when loaded with `torch.load(..., weights_only=True)`. This is a deserialization vulnerability (a weakness where loading untrusted data can be exploited).
BentoML, a Python library for serving AI models, had a vulnerability (before version 1.4.34) that allowed path traversal attacks (exploiting file path inputs to access files outside intended directories) through its configuration file. An attacker could trick a user into building a malicious configuration that would steal sensitive files like SSH keys or passwords and hide them in the compiled application, potentially exposing them when shared or deployed.
The Kalrav AI Agent plugin for WordPress (versions up to 2.3.3) has a vulnerability in its file upload feature that fails to check what type of file is being uploaded. This allows attackers without user accounts to upload malicious files to the server, potentially leading to RCE (remote code execution, where an attacker can run commands on a system they don't own).
ChatterMate, a no-code AI chatbot framework (software that lets people build chatbots without writing code), has a security flaw in versions 1.0.8 and earlier where it accepts and runs malicious HTML/JavaScript code from user chat input. An attacker could send specially crafted code (like an iframe with a javascript: link) that executes in the user's browser and steals sensitive data such as localStorage tokens and cookies, which are used to keep users logged in.
Langflow contains a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability in its disk cache service that allows authenticated attackers to execute arbitrary code by sending maliciously crafted data that the system deserializes (converts from stored format back into usable objects) without proper validation. The flaw exploits insufficient checking of user-supplied input, letting attackers run code with the permissions of the service account.
Langflow, a workflow automation tool, has a vulnerability where attackers can inject malicious Python code into Python function components and execute it on the server (RCE, or remote code execution). The severity and how it can be exploited depend on how Langflow is configured.
Langflow contains a remote code execution vulnerability (RCE, where an attacker can run commands on a system they don't own) in how it handles the exec_globals parameter at the validate endpoint, allowing unauthenticated attackers to execute arbitrary code with root-level privileges. The flaw stems from including functionality from an untrusted source without proper validation.
Langflow contains a vulnerability in its eval_custom_component_code function that allows attackers to execute arbitrary code (RCE, or remote code execution) without needing to log in. The flaw occurs because the function doesn't properly validate user input before executing it as Python code, letting attackers run any commands they want on the affected system.
Langflow has a critical vulnerability where attackers can execute arbitrary code (commands) on the server without needing to log in, by sending malicious input to the validate endpoint. The flaw occurs because the code parameter is not properly checked before being run as Python code, allowing an attacker to run commands with root-level permissions (the highest system access level).
Ollama MCP Server contains a command injection vulnerability (a flaw where an attacker can insert malicious commands into user input that gets executed) in its execAsync method that allows unauthenticated attackers to run arbitrary code on the affected system. The vulnerability exists because the server doesn't properly validate user input before passing it to system commands, letting attackers execute code with the same privileges as the service running the server.
MCP Manager for Claude Desktop has a vulnerability where attackers can inject malicious commands into MCP config objects (configuration files that tell Claude how to use external tools) that aren't properly checked before being run as system commands. By tricking a user into visiting a malicious website or opening a malicious file, an attacker can break out of the sandbox (the restricted environment that limits what Claude can access) and run arbitrary code (any commands they want) on the computer.
A vulnerability in gemini-mcp-tool's execAsync method allows attackers to run arbitrary code (RCE, or remote code execution) on systems using this tool without needing to log in. The flaw occurs because the tool doesn't properly check user input before running system commands, letting attackers inject malicious commands.
CVE-2026-24307 is a vulnerability in Microsoft 365 Copilot where improper validation of input (failure to check that data matches what the system expects) allows an attacker to access and disclose information over a network without authorization. The vulnerability has a CVSS score of 4.0 (a moderate severity rating on a 0-10 scale).
CVE-2026-21521 is a vulnerability in Microsoft Copilot where improper handling of escape sequences (special characters used to control how text is displayed or interpreted) allows an attacker to disclose information over a network without authorization. The vulnerability is classified as CWE-150 (improper neutralization of escape, meta, or control sequences) and was reported by Microsoft Corporation.
CVE-2026-21520 is a vulnerability in Microsoft Copilot Studio that allows an unauthenticated attacker to view sensitive information through a network-based attack. The vulnerability stems from improper handling of special characters in commands (command injection, where attackers manipulate input to execute unintended commands), and affects Copilot Studio's hosted service.
Langfuse versions 3.146.0 and earlier have a security flaw in the Slack integration endpoint that doesn't properly verify users before connecting their Slack workspace to a project. An attacker can exploit this to connect their own Slack workspace to any project without permission, potentially gaining access to prompt changes or replacing automation integrations (configurations that automatically perform tasks when triggered). This vulnerability affects the Prompt Management feature, which stores AI prompts that can be modified.
Fix: Update to version 0.14.1, which contains a patch for the issue.
NVD/CVE DatabaseFix: Update to PyTorch version 2.10.0 or later, which fixes the issue.
NVD/CVE DatabaseAnythingLLM is an application that lets users feed documents into an LLM so it can reference them during conversations. Versions before 1.10.0 had a security flaw where an API key (QdrantApiKey) for Qdrant, the database that stores document information, could be exposed to anyone without authentication (credentials). If exposed, attackers could read or modify all the documents and knowledge stored in the database, breaking the system's ability to search and retrieve information correctly.
Fix: Update AnythingLLM to version 1.10.0 or later. According to the source: 'Version 1.10.0 patches the issue.'
NVD/CVE DatabaseFix: Update BentoML to version 1.4.34 or later, which contains a patch for this issue.
NVD/CVE DatabaseFix: Update to version 1.0.9, where this issue has been fixed. The patch is available at https://github.com/chattermate/chattermate.chat/releases/tag/v1.0.9.
NVD/CVE DatabaseTypebot, an open-source chatbot builder, has a vulnerability in versions before 3.13.2 where malicious chatbots can execute JavaScript (code that runs in a user's browser) to steal stored credentials like OpenAI API keys and passwords. The vulnerability exists because an API endpoint returns plaintext credentials without checking if the person requesting them actually owns them.
Fix: Update to Typebot version 3.13.2, which fixes the issue.
NVD/CVE DatabaseFix: This issue has been fixed in version 3.147.0.
NVD/CVE Database