Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
CVE-2026-24301 is a command injection vulnerability (a weakness where an attacker hides malicious commands in user input to trick a program into executing them) in Microsoft Copilot that allows an unauthorized attacker to access and steal information over a network. The vulnerability stems from improper neutralization of special elements used in commands. The CVSS severity score (a 0-10 rating of how dangerous a vulnerability is) has not yet been assigned by NIST.
A security vulnerability (CVE-2026-75093) was found in sonos tract software up to version 0.23.4 that incorrectly calculates buffer sizes (memory allocation amounts) in a specific function, potentially allowing remote attacks. The vulnerability has been publicly disclosed and can be exploited.
A vulnerability was found in Mistral.rs (a tool for running AI models) versions up to 0.8.22 in a function that converts tokenizers (components that break text into pieces for AI processing). An attacker could send specially crafted input that causes the program to read data from memory locations it shouldn't access, and this attack can be done remotely over the internet.
MLflow has a permission bypass vulnerability in its CreateModelVersion API. The validation functions check that a model version's source path is within a run's artifact directory, but don't verify that the caller has READ permission on that run. An authenticated user can therefore create a model version pointing to another user's private artifacts and then read those files through the model version's artifact handler, bypassing permission restrictions.
MLflow's basic-auth plugin has a vulnerability where the LogInputs endpoint (used to record dataset information for ML runs) is missing from the authorization check list, allowing any authenticated user to inject fake dataset records into another user's run. While other similar endpoints like log-metric correctly block unauthorized access with HTTP 403, LogInputs bypasses this check entirely because its protobuf class is absent from the BEFORE_REQUEST_HANDLERS dictionary.
MLflow's default Tracking Server has an unauthenticated SSRF (server-side request forgery, where an attacker tricks the server into making requests to internal systems) vulnerability in its webhook testing endpoint. The security check that validates webhook URLs can be bypassed because MLflow follows HTTP redirects without re-validating the redirect target, allowing an attacker to redirect from an allowed public server to internal/private addresses like metadata services.
Several functions in the pkcs12 package can incorrectly accept PKCS#12 files (a format for storing encrypted certificates and keys) that were encoded with the wrong password, because they fail to reject overly-short PBMAC1 keys (a cryptographic authentication code). This means an attacker could trick someone into accepting a malicious PKCS#12 file if that person decodes untrusted files and relies on password protection to verify authenticity.
A vulnerability in atomic-agents-stack allows attackers on the same network to intercept and modify catalog entries when they are fetched over unencrypted HTTP connections, enabling them to inject malicious commands that the software will execute locally without any LLM involvement. The HTTP MCP server-registry backend accepts both http and https schemes, but only https provides encryption protection, and there is no default allowlist (access control list) to restrict which commands can be executed.
MemOS, a memory system for LLMs and AI agents, has a critical authentication bypass vulnerability when authentication is enabled but an undocumented environment variable called INTERNAL_SERVICE_SECRET is not set. An attacker can exploit this by sending requests without proper authentication headers, causing the system to incorrectly treat them as trusted internal requests and grant full administrative access, allowing them to create API keys, steal data, and gain persistent control.
Hugging Face Transformers has a vulnerability where it doesn't properly check filenames in checkpoint index files (configuration files that list model components), allowing attackers to read files outside the intended model directory. An attacker can create a malicious index file with path traversal (references like '../' that escape the intended folder) or absolute paths that the software processes without validation, leading to unauthorized file access and system reconnaissance.
vLLM, a system that runs large language models, has a security vulnerability before version 0.26.0 where the MiMoV2OmniMultiModalProcessor component improperly handles image and audio inputs by bypassing security checks (allowed_media_domains and allowed_local_media_path, which are supposed to restrict what files and websites the system can access). This flaw allows an attacker to trick the server into making requests or reading files that shouldn't be accessible.
vLLM (a system for running and serving large language models) had a vulnerability in versions before 0.26.0 where certain API endpoints accepted user-supplied data that was processed before safety checks could limit resource usage. An authenticated attacker (someone with API access) could exploit this to consume excessive CPU and memory or generate oversized responses that bypass size restrictions.
sqlparse has a ReDoS (regular expression denial of service) vulnerability in how it handles dollar-quoted SQL literals. The vulnerable regex pattern uses a backreference to match closing delimiters, but when closing delimiters don't exist, it scans the entire remaining input, causing O(n²) CPU complexity (meaning time grows quadratically with input size). An attacker can exploit this by sending specially crafted SQL text to any application using sqlparse, causing the application to consume excessive CPU and become unresponsive.
CVE-2026-64859 is a vulnerability in New API, an LLM gateway (a system that manages requests to language models) and AI asset management system, where versions before 1.0.0-rc.7 accidentally expose the root user's access token (a credential used to authenticate API requests) through admin APIs. An authenticated administrator could exploit this to gain unauthorized access to root-only system configuration APIs by obtaining the root user's bearer token (a type of access credential).
UpTrain, an open-source platform for evaluating and improving generative AI applications, has a remote code execution vulnerability (RCE, where an attacker can run commands on a system they don't own) in version 0.7.1 and earlier in its `/new_run` endpoint through the `checks` and `metadata` parameters. Any authenticated user with access to UpTrain can exploit this to execute arbitrary code on the host system, typically a Docker container (a lightweight virtual environment).
UpTrain, an open-source platform for evaluating AI applications, has a critical vulnerability in version 0.7.1 and earlier where the `/add_prompts` endpoint allows remote code execution (RCE, where an attacker can run commands on a system they don't own) through the `checks` and `metadata` parameters. Any authenticated user with access to UpTrain can exploit this to run arbitrary code on the host machine, typically within a Docker container (a lightweight isolated computing environment).
UpTrain, an open-source tool for testing and improving AI applications, has a vulnerability in version 0.7.1 and earlier where the `/create_project` endpoint allows remote code execution (the ability to run commands on a system from a remote location) through the `checks` and `metadata` parameters. Any authenticated user with access to UpTrain could potentially execute arbitrary code on the computer or container (a sandboxed environment) running UpTrain.
UpTrain (a platform for testing and improving AI systems) in version 0.7.1 and earlier has a security flaw where it creates a default user with a predictable API key (a credential for accessing the system) and allows requests from any website due to an open CORS policy (cross-origin resource sharing, which controls whether websites can make requests to other domains). This means attackers could use any website to make authenticated requests to UpTrain and perform unauthorized actions as the default user.
Fix: Apply patch 66b10bda8895f4bfaf8c205361f0125cdf51f99b to resolve the issue.
NVD/CVE DatabaseFix: Upgrade to version 0.8.23, which resolves this issue. The patch is identified as cd5297e2ea5cb27c790bdcf2f3c2f1064a81d55e.
NVD/CVE DatabaseApple macOS has a security flaw that allows attackers on the same network to access Screen Sharing (a remote desktop feature) without needing a valid password. This vulnerability is currently being exploited by attackers in real-world attacks.
Fix: Apply mitigations according to Apple's vendor instructions and follow CISA's BOD 26-04 guidance for security update prioritization. If mitigations are unavailable, discontinue use of the affected product. See Apple support pages at https://support.apple.com/en-us/148170, https://support.apple.com/en-us/148171, and https://support.apple.com/en-us/148172 for specific patching instructions.
CISA Known Exploited VulnerabilitiesMicrosoft SharePoint has a weak authentication vulnerability that allows attackers to bypass security features over a network without proper credentials. This flaw is currently being exploited by real attackers. Organizations must apply patches according to Microsoft's instructions and follow CISA's BOD 26-04 guidance (a federal directive for prioritizing security updates), or stop using the product if no fix is available.
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 guidance. For cloud services, follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. See Microsoft Security Response Center (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040) for specific patches. Due date for patching: 2026-08-21.
CISA Known Exploited VulnerabilitiesFix: The source explicitly recommends: 'require `https` by default and gate `http://` behind a loud explicit opt-in. Defense-in-depth: allowlist the resolved command basename (or require confirmation) before any registry-sourced subprocess spawn.' The source also notes that https is currently secure because `httpx` defaults to `verify=True` (validating the server's certificate) and `follow_redirects=False`.
GitHub Advisory DatabaseFix: Update vLLM to version 0.26.0 or later, which fixes this vulnerability.
NVD/CVE DatabaseFix: Update vLLM to version 0.26.0 or later, where this issue is fixed.
NVD/CVE DatabaseFix: This issue is fixed in version 1.0.0-rc.7. Users should upgrade to version 1.0.0-rc.7 or later.
NVD/CVE Database