Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Ollama versions before 0.17.1 have a heap out-of-bounds read vulnerability (a bug where code reads memory outside its intended boundaries) in the GGUF model loader (the component that loads GGUF files, a machine learning model format). An attacker can upload a malicious GGUF file through the /api/create endpoint (an unprotected interface) with fake tensor size information, causing the server to read beyond the file's actual data and leak sensitive information like API keys and user conversations, which can then be stolen through the /api/push endpoint.
Fix: Update Ollama to version 0.17.1 or later.
NVD/CVE DatabaseA code injection vulnerability (CVE-2026-7700) was found in langflow-ai langflow up to version 1.8.4, specifically in the eval function of the LambdaFilterComponent. The vulnerability allows attackers to execute arbitrary code remotely if they have login access, and a working exploit has been publicly released.
A command injection vulnerability (CWE-77, a flaw where attackers can insert malicious commands into input) was found in Langflow AI's langflow software up to version 1.8.4, specifically in the CodeParser.parse_callable_details function. An attacker with login credentials can remotely execute this vulnerability, and it has already been publicly disclosed. The vendor was notified but did not respond.
A vulnerability (CVE-2026-7669) was found in SGLang, an open-source project, affecting versions up to 0.5.9. The flaw is in the get_tokenizer function and allows deserialization (converting untrusted data into executable objects), which can be exploited remotely, though it requires high complexity to execute. The vulnerability has a CVSS score (a 0-10 severity rating) of 6.3, classified as medium severity.
A vulnerability (CVE-2026-7644) was found in ChatGPTNextWeb NextChat version 2.16.1 and earlier, affecting the addMcpServer function in the app/mcp/actions.ts file. The flaw allows improper authorization (meaning the system fails to correctly verify who should have access to certain features), and it can be exploited remotely by anyone without needing special permissions. The vulnerability has been publicly disclosed, and the developers have been notified but have not yet responded.
ChatGPTNextWeb NextChat versions up to 2.16.1 contain a flaw in its Next.js API endpoint that allows attackers to manipulate a function and create a permissive cross-domain policy with untrusted domains (meaning the system accepts requests from any website, not just trusted ones). The attack can be launched remotely, an exploit has been published, but the project developers have not yet responded to the early notification.
IBM Langflow Desktop versions 1.0.0 through 1.8.4 contains a code injection vulnerability (CWE-94, a flaw where attackers can insert and execute their own code) that allows attackers to run arbitrary commands (any commands an attacker chooses) with the same permissions as the Langflow application. This could let attackers steal sensitive information like API keys and database passwords, modify files, or attack other systems on the network.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.8.4 has a vulnerability where any user can view and delete other users' data by supplying a flow_id (a reference number for a workflow). This happens because the system doesn't properly check who should be allowed to access certain information, allowing unauthorized access to transaction logs and build data.
IBM Langflow Desktop version 1.8.4 and earlier has a path traversal vulnerability (CWE-22, a flaw that lets attackers access files outside intended directories) that allows remote attackers to view arbitrary files on a system by sending specially crafted URLs containing "dot dot" sequences (/../), which trick the system into navigating to restricted folders.
IBM Langflow Desktop versions 1.0.0 through 1.8.4 have a security flaw where an unauthenticated user (someone without a login) can view other users' images by manipulating a user-controlled key (a piece of data that identifies which resource to access). This happens because the application doesn't properly check permissions when accessing images, which is a type of vulnerability called authorization bypass through user-controlled key (CWE-639).
IBM Langflow Desktop versions 1.2.0 through 1.8.4 has a path traversal vulnerability (CVE-2026-4502) that allows an authenticated attacker to write arbitrary files on a system by sending specially crafted URL requests with "dot dot" sequences (/../, which move up directory levels). This affects users who are already logged into the application.
IBM Langflow Desktop versions 1.6.0 through 1.8.4 has a stored cross-site scripting vulnerability (XSS, a flaw where an attacker can inject malicious code that gets saved and executed in a web interface). An authenticated user can embed JavaScript code in the Web UI, which could alter how the application works and potentially expose user credentials to attackers who access the same session.
IBM Langflow Desktop versions 1.0.0 through 1.8.4 have a vulnerability called SSRF (server-side request forgery, where an attacker tricks the server into making requests it shouldn't). An authenticated attacker (someone with login access) could exploit this to send unauthorized requests from the system, potentially discovering network information or launching additional attacks.
OpenTelemetry's disk retry feature for OTLP (OpenTelemetry Protocol, a standard format for sending telemetry data) had a security flaw where it stored temporary blob files (serialized data chunks) in a shared system temp directory accessible to other user accounts on multi-user systems. This allowed attackers to inject fake telemetry data, read sensitive telemetry information, or cause performance problems by filling the directory with large files.
A security flaw in n8n-mcp's URL validation allowed attackers to bypass SSRF (server-side request forgery, where an attacker tricks a server into making unwanted requests) protections using IPv4-mapped IPv6 addresses like `http://[::ffff:169.254.169.254]`. This could let an attacker who controls the `n8nApiUrl` input force the server to request sensitive data from cloud metadata endpoints, private networks, or localhost services, and the responses would be returned to the attacker along with API credentials.
Jupyter Notebook has a stored XSS (cross-site scripting, a type of attack where malicious code runs in a user's browser when they view a webpage or file) vulnerability that lets attackers steal authentication tokens (credentials that prove who you are) by tricking users into clicking fake controls in malicious notebook files. An attacker who steals these tokens can take over a user's account, read files, run code, and access the system.
The Claude SDK for TypeScript had a security flaw where a tool called `BetaLocalFilesystemMemoryTool` created files and folders with overly permissive access settings (using Node.js defaults like `0o666` for files and `0o777` for directories, which control who can read or modify them). This meant that on shared computers or in containerized environments (like Docker), other users could read sensitive agent data or modify it to change how the AI behaves.
A critical vulnerability in marked@18.0.0 allows an unauthenticated attacker to crash any Node.js application using this library by sending just 3 special characters (a tab, vertical tab, and newline). These characters trick the parser into infinite recursion (a function calling itself endlessly), which allocates memory indefinitely until the application runs out of memory (OOM, or out-of-memory error) and crashes.
OpenClaw versions before 2026.4.15 had a security flaw where the webchat audio embedding feature could read local files from the host system without proper security checks. An attacker who could control the output of an agent or tool could trick the system into embedding audio files from the host into chat responses, bypassing the containment restrictions that protect other file-serving paths.
CISA and international cybersecurity partners released guidance for organizations adopting agentic AI (AI systems that can take actions autonomously on behalf of users). The guidance identifies security challenges with these systems and provides steps for safely designing, deploying, and operating them while connecting AI risk management to existing cybersecurity practices.
Fix: If an immediate upgrade to a patched version is not possible: 1. Avoid enabling disk retry in shared environments. 2. Configure a dedicated directory with strict ACL/ownership and least privilege (access control lists that restrict who can read or write). 3. Ensure the directory is not shared across tenants/users. 4. Monitor for unexpected `*.blob` files or abnormal retry backlog growth.
GitHub Advisory DatabaseFix: Upgrade to **v2.47.14 or later** (via `npx n8n-mcp@latest` for npm or `docker pull ghcr.io/czlonkowski/n8n-mcp:latest` for Docker). If immediate upgrade is not possible, the source mentions three workarounds: (1) validate URLs before passing them to the SDK by rejecting IP literal hostnames and accepting only DNS-resolvable hostnames; (2) restrict outbound network traffic from the n8n-mcp process to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local addresses (169.254.0.0/16), and cloud metadata endpoints; and (3) do not accept user-controlled `n8nApiUrl` values and derive the URL from internal configuration only.
GitHub Advisory DatabaseFix: Update to Jupyter Notebook 7.5.6 or JupyterLab 4.5.7, which include patches. As a temporary workaround, disable the help extension by running: `jupyter labextension disable @jupyter-notebook/help-extension` and `jupyter labextension disable @jupyterlab/help-extension`. For additional hardening, disable command linker functionality by adding this to `overrides.json`: `{"@jupyterlab/apputils-extension:sanitizer": {"allowCommandLinker": false}}`.
GitHub Advisory DatabaseFix: Users on the affected versions are advised to update to the latest version.
GitHub Advisory DatabaseFix: Upgrade to OpenClaw version 2026.4.15 or later (the latest public release 2026.4.21 also contains the fix). The fix works by adding the local media root containment check to the webchat audio path and calling `assertLocalMediaAllowed` before reading local audio content. An additional `trustedLocalMedia` gate was added to prevent untrusted model or tool outputs from accessing local audio embedding.
GitHub Advisory Database