Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Omnigent, an open-source framework for running AI coding agents, had a vulnerability in versions before 0.3.0 where authenticated users could upload malicious agent bundles with specially crafted file paths that bypass security checks. This allowed attackers to access files and secrets outside the intended workspace using tools that read, write, and execute code. The vulnerability was fixed in version 0.3.0.
Fix: Update to version 0.3.0 or later.
NVD/CVE DatabaseOmnigent is an open-source framework for running AI agents that write code. Before version 0.3.0, its command parser had a bug that failed to recognize certain shell command patterns (like combined flags, command substitutions, and background operators), which allowed security policies meant to restrict where agents could push code or work to be bypassed. An attacker using a compromised or manipulated AI agent could push code to unauthorized repositories or escape the intended workspace boundaries.
Omnigent is an open-source framework for managing AI agents that write code. Before version 0.3.0, it had a security flaw where authenticated users could upload agent bundles (packages of code and configuration) that contained malicious Python commands, which the system would then execute with full permissions of the process running Omnigent, potentially exposing sensitive files, passwords, and internal data.
Omnigent, an open-source framework for managing AI agents that write code, has a permission bypass vulnerability in versions before 0.3.0. An authenticated user with edit access to a session can replace a shared agent (an agent template used across multiple sessions) and inject a malicious command that executes with the same permissions as the Omnigent process, potentially exposing sensitive data like files, credentials, and internal services.
ONNX (a machine learning model format) versions before 1.21.0 have a vulnerability in the 'save_external_data' function where it unsafely opens files for writing without proper protections. A local attacker with write access to the same directory can create a symlink (a shortcut to another file) that tricks the function into writing to sensitive files like SSH authorization keys or system configuration files instead of the intended target.
A security flaw in LangChain's SitemapLoader allows attackers to bypass the restrict_to_same_domain control (a setting meant to prevent the tool from fetching content from other websites). The bug happens because nested sitemaps are fetched without checking the domain restriction, so an attacker controlling a sitemap can point it to internal addresses and leak the content back to the caller.
CVE-2026-69855 is a server-side request forgery vulnerability (SSRF, a flaw that lets attackers trick a server into making requests to internal systems) in Microsoft Copilot running on Azure. An authorized attacker can exploit this to leak sensitive information across a network.
A NoSQL injection vulnerability (a type of attack where an attacker can manipulate database queries by injecting special operators) exists in two MongoDB libraries for LangChain: langgraph-checkpoint-mongodb and langgraph-store-mongodb. The vulnerable methods (MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search()) don't properly block MongoDB query operators (special commands prefixed with $) from user input, allowing an authenticated attacker to read data belonging to other users or tenants in a multi-tenant system.
OpenTelemetry-Go's OpenTracing bridge has a race condition (concurrent access to a shared resource by multiple execution paths without protection) in its baggage map. When one goroutine (lightweight thread) writes baggage items while another reads them simultaneously, Go crashes the process with a fatal error. This is low severity because it requires specific configuration of the OpenTracing bridge and concurrent access to the same span.
Hugging Face PyTorch Image Models has a vulnerability where attackers can run arbitrary code on a system by tricking users into visiting a malicious page or opening a malicious file. The problem occurs because the software doesn't properly validate (check) checkpoint files before deserializing them (converting saved data back into usable objects), allowing attackers to inject malicious code that executes when the file is processed.
Neo.mjs has a command injection vulnerability (a security flaw where attackers can run unauthorized operating system commands) in its FileSystemService.mjs component. The vulnerability exists in the checkSyntax() and runPlaywrightTest() functions, which unsafely insert user-provided file paths directly into shell commands, allowing an AI agent to execute arbitrary commands if tricked into using these tools.
The AI Agent by SiteGround plugin for WordPress has an authorization bypass vulnerability (a security flaw where access controls fail to properly check user permissions) in all versions up to 1.2.7 that allows unauthenticated attackers to upload images to the WordPress media library. The plugin fails to verify that users have the upload_files capability (a permission level normally restricted to certain user roles), and because the security token called sg_ai_studio_gutenberg_nonce is given to any user with block editor access, even Contributors can exploit this to upload files they shouldn't be able to.
Agno's PythonTools has a path traversal vulnerability (a flaw where attackers use sequences like '../../' to access files outside the intended directory) in its file handling functions. Attackers can exploit this by injecting directory-traversal sequences through direct tool use or prompt injection (tricking an AI by hiding instructions in its input) to read, write, or run arbitrary files on the system.
Splunk AI Toolkit versions before 6.0.0 have a vulnerability where users with the "power" role can run arbitrary code (commands the attacker chooses) on the Splunk server by uploading a specially crafted model file. The problem occurs because the toolkit deserializes (converts stored data back into usable form) untrusted data without checking for hidden malicious code in pickle format (Python's method for storing objects).
Splunk AI Toolkit versions before 6.0.0 have a security flaw where users without admin permissions can control containers and access sensitive data through the REST API (a method for software to communicate over the internet). This happens because the API doesn't properly check whether users have permission to perform these actions.
In Splunk AI Toolkit versions before 6.0.0, a race condition (a flaw where the order of simultaneous operations causes unexpected behavior) allows a user to overwrite a model that another user is uploading by sending a competing upload request with the same model name. This happens because the toolkit does not verify that the uploaded content actually belongs to the request that creates the model lookup entry (a database record linking a model name to its contents), potentially allowing an attacker to inject malicious content.
In Splunk AI Toolkit versions before 6.0.0, there is a privilege escalation vulnerability (a security flaw where a user gains higher access levels than they should have) in the Agent Run History feature. Users without admin or power roles could run searches with system-level privileges, access other users' data, and delete search jobs by exploiting how the system replaces user credentials with a system authentication token.
The mcp-searxng server has a feature in hardened mode that tries to prevent SSRF (server-side request forgery, where an attacker tricks a server into fetching URLs it shouldn't) attacks on the web_url_read function. However, three bypasses still exist: redirects from allowed URLs to internal addresses aren't re-checked, the address 0.0.0.0 isn't blocked as internal, and IPv6-mapped IPv4 addresses can bypass checks after the URL parser converts them to a different format.
SearXNG MCP Server has an SSRF vulnerability (server-side request forgery, where a server is tricked into fetching URLs chosen by an attacker) in its web_url_read tool because the internal-address guard is disabled by default. An attacker who can control the URL input (for example, through prompt injection, where hidden instructions in AI input trick the model into producing malicious content) can make the server fetch private internal services or cloud metadata and return their contents, but this only happens when the MCP_HTTP_HARDEN setting is off by default.
Fix: Update to version 0.3.0 or later, which fixes the issue.
NVD/CVE DatabaseFix: This issue is fixed in version 0.3.0.
NVD/CVE DatabaseFix: Update to version 0.3.0 or later, which fixes this vulnerability.
NVD/CVE DatabaseFix: Fixed in version 1.21.0. Users should upgrade ONNX to version 1.21.0 or later.
NVD/CVE DatabaseMicrosoft Entra ID (formerly called Azure Active Directory, which manages user identities and access) has a deserialization of untrusted data vulnerability (a flaw where the software unsafely processes data from untrusted sources, allowing attackers to run malicious code). An attacker could exploit this over a network to execute code without authorization, and this vulnerability is currently being exploited by real attackers.
Fix: Apply mitigations according to Microsoft's vendor instructions while following CISA's BOD 26-04 (Prioritizing Security Updates Based on Risk) guidance. For cloud services, follow BOD 26-04 guidance for cloud environments, or discontinue use of the product if mitigations are unavailable. Organizations must evaluate their systems' internet exposure and ensure they meet BOD 26-04 patching requirements by the due date of 2026-08-24.
CISA Known Exploited VulnerabilitiesFix: Upgrade to langgraph-checkpoint-mongodb version 0.3.0 or later, and langgraph-store-mongodb version 0.4.0 or later. If you cannot upgrade immediately, remove or escape MongoDB Query metacharacters such as "$" in your application code before passing any user-controlled input to the filter parameter.
GitHub Advisory DatabaseFix: Commit 88c77fc fixes these vulnerabilities.
NVD/CVE DatabaseFix: Upgrade Splunk AI Toolkit to version 6.0.0 or later.
NVD/CVE DatabaseFix: Upgrade to Splunk AI Toolkit version 6.0.0 or later.
NVD/CVE DatabaseFix: Upgrade to Splunk AI Toolkit version 6.0.0 or later.
NVD/CVE DatabaseFix: The source text describes the desired remediation but does not provide a concrete patch or version fix. The recommended approach stated is: 'Enable the internal-address filtering by default (fail safe): make assertUrlAllowed run unconditionally and require an explicit opt-out only for trusted environments. Strengthen the check to resolve the host and reject loopback, link-local/metadata (169.254.0.0/16), 0.0.0.0/8, and private ranges, and re-validate on every redirect hop (or pin to the validated IP).' No patched version is mentioned in the source.
GitHub Advisory Database