Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Sub2API is a platform that manages API access (the ability to use AI services) by distributing shared accounts across multiple users. In versions 0.1.135 to 0.1.168, an authenticated user could manipulate the URL path to send requests to unintended servers using the platform's shared account credentials, because the system didn't validate where requests were being sent. This vulnerability was caused by path traversal (exploiting how the system handles file/URL paths without checking them).
Fix: This vulnerability is fixed in version 0.1.169.
NVD/CVE DatabaseToolJet, a platform for building internal tools and AI agents, had a security flaw in its database API before version 3.20.207 where it didn't properly check if users belonged to an organization before letting them access its data. An authenticated user (someone with a valid login) could trick the system by using their own workspace ID in a header while targeting another organization's database through API requests, allowing them to see or modify other organizations' tables and data.
TypeBot, a chatbot builder tool, has a security flaw in versions before 3.17.0 that lets low-privilege guest members steal OpenAI API keys (secret credentials used to access AI services). The vulnerability works because guests can trick the system into sending these secrets to attacker-controlled servers by manipulating a helper tool that lists available AI models.
goose is a general-purpose AI agent that runs on your machine. Before version 1.44.0, the `goose review` command had a security vulnerability where it ran Git commands without checking for malicious settings in a repository's `.git/config` file, allowing an attacker to execute arbitrary commands on your computer with your user's permissions and access to your environment secrets and API keys. This happened outside of goose's normal safety checks and permission system.
A vulnerability in Keras (a machine learning library) versions 3.15.0 and earlier allows attackers to crash applications by creating malicious .keras model files. When the keras.models.load_model() function opens these files, it doesn't check how much memory the data needs, causing the program to run out of memory (OOM, an out-of-memory condition where the system can't allocate more space) and crash. This risk affects machine learning pipelines that load models from untrusted sources like public repositories.
A path traversal vulnerability (a type of attack where an attacker can access files outside their intended directory) was found in claude-comfyui-mcp version 1.0.0, specifically in a function that copies image files. The vulnerability can be exploited locally (meaning an attacker needs access to the computer running the software) by manipulating the image file path, and the severity is rated as low.
A path traversal vulnerability (CWE-22, a flaw where an attacker can access files outside a restricted directory) was found in PV-Bhat gemsuite-mcp version 1.0.0, specifically in a file handling component that processes file_path arguments. An attacker with local access to the system could exploit this to access unauthorized files, though the project developers have not yet responded to the initial report.
A vulnerability (CVE-2026-19334) was found in NightTrek Ollama-mcp that allows command injection (running unauthorized system commands) through manipulated arguments in the src/index.ts file, but only if an attacker has local access to the system. Since the software uses a rolling release model (continuous updates without fixed version numbers), specific affected versions cannot be identified, and the developers have not yet responded to the security report.
A vulnerability (CVE-2026-19327) was found in abracadabra50 claude-sesh version 1.0.0 where an attacker can manipulate the sessionId argument to cause path traversal (accessing files outside the intended directory). The attack requires local access to the system and has a low severity rating of 1.9.
A vulnerability (CVE-2026-19268) was found in MCPGateway, a tool related to Claude usage tracking, where an attacker can inject commands by manipulating the 'since' argument in the Claude Usage Range Endpoint function. This command injection (tricking the system into running unintended commands) can be exploited remotely, and working exploit code is already publicly available.
The AI Copilot – Content Generator plugin for WordPress (versions up to 1.5.6) has a security flaw where it doesn't properly check if users are authorized to perform actions. An attacker who is not logged in can exploit this by using a publicly visible security token (nonce, a temporary code meant to prevent unauthorized actions) to create a new admin account and take over the entire website, as long as the plugin's form or chatbot is visible on the site's public pages.
NLTK (Natural Language Toolkit, a library for processing human language) versions 3.9.4 and earlier have a vulnerability in their downloader tool that allows one software package to corrupt or replace another package's trusted resources. The problem occurs because the downloader extracts files into shared folders and only checks if files are legitimate after they've already been written, enabling attackers to inject malicious code that persists even after restarting the program.
Flowise versions up to 3.1.4 have a vulnerability where authenticated attackers can access credentials and data from other workspaces because the system doesn't verify workspace ownership (insecure direct object reference, a flaw where users can access resources by guessing or knowing their identifiers). Attackers can exploit this to view assistant information, access files, and upload malicious files into other users' workspaces.
LangGraph's Postgres and SQLite stores had a bug where namespace scoping (a feature that separates data between users or tenants) didn't properly respect boundaries because it used a string-matching function called LIKE that doesn't understand the dot separator used in namespace paths. This meant a request for data from namespace "alice" could accidentally return data from "alice2" or "alice_user" without any special attack needed. The bug only affects applications where namespace labels could share prefixes, like "1" and "12", or contain underscore characters.
Strands Agents, an open-source SDK for building AI agents, has a vulnerability in its memory tools (mongodb_memory, elasticsearch_memory, and mem0_memory) where the namespace field (the key that separates data between different users) is exposed as a parameter that the LLM can control. An attacker could craft a prompt injection (tricking the AI by hiding instructions in its input) to forge a namespace and read, modify, or delete memories belonging to other users, or inject false memories into another user's data.
Apache CXF, a web services framework, has a vulnerability where it doesn't set a default limit on how many form parameters (data fields submitted in a web request) it will accept. This can allow attackers to send requests with extremely large numbers of parameters, causing a denial of service attack (making the service unavailable by overwhelming it with resource consumption).
A security flaw was found in poco-ai poco-agent versions up to 0.5.4 in the WorkspaceManager._setup_session_persistence function, which results in incomplete cleanup (not fully removing temporary files or data after a session ends). The vulnerability is difficult to exploit and requires complex remote attacks, with a low severity rating (CVSS 2.9).
FrontMCP, a TypeScript framework for the Model Context Protocol (MCP, a system for AI models to interact with external tools), has a critical vulnerability in versions before 1.5.7 where a sandboxed code execution tool leaks access to the host's Function constructor, allowing attackers to run arbitrary code on the server and steal sensitive data like API keys and database credentials. The vulnerability can be exploited by unauthenticated users on unconfigured servers, or through prompt injection (tricking an AI by hiding instructions in its input) on authenticated servers.
CVE-2026-18954 is an authorization bug in Amazon DocumentDB MCP Server (a tool that lets AI assistants access databases). The bug allows certain database operations called aggregation pipeline stages ($out and $merge, which are write operations) to bypass read-only protections, potentially letting an authenticated user make unwanted changes to the database.
Fix: This issue is fixed in version 3.20.207-lts.
NVD/CVE DatabaseFix: Update TypeBot to version 3.17.0, which patches the issue.
NVD/CVE DatabaseMetabase has a SQL injection vulnerability (SQL injection, where an attacker inserts malicious SQL code into input fields) that allows an unauthenticated attacker to gain admin access to the application without logging in. Once inside, the attacker could steal database credentials, read sensitive data, change settings, and export information. This vulnerability is actively being exploited by real attackers.
Fix: Apply mitigations in accordance with vendor instructions from Metabase, ensuring compliance with CISA's BOD 26-04 guidance on prioritizing security updates. For cloud services, follow BOD 26-04 guidance or discontinue use if mitigations are unavailable. See Metabase's security update at https://www.metabase.com/blog/security-update and the security advisory at https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf.
CISA Known Exploited VulnerabilitiesFix: This issue is fixed in version 1.44.0. Update goose to version 1.44.0 or later.
NVD/CVE DatabaseFix: Apply patch 786c9d74800e6d0858b65778f31beb71b3983a50 to resolve this issue. The patch is available at https://github.com/abracadabra50/claude-sesh/commit/786c9d74800e6d0858b65778f31beb71b3983a50.
NVD/CVE DatabaseFix: Upgrade to langgraph-checkpoint-postgres version 3.1.1 or langgraph-checkpoint-sqlite version 3.1.1. The fix changes how prefix scoping works to require the dot separator before any remainder, escapes special characters in namespace labels, and uses segment-aware matching for both prefix and suffix conditions. On SQLite specifically, the code switched from using LIKE to using GLOB for matching descendant namespaces.
GitHub Advisory DatabaseFix: Update strands-agents-tools to version 0.8.3 or later. The bulletin states 'Impacted versions: < 0.8.3', indicating the vulnerability is fixed in version 0.8.3 and above.
AWS Security BulletinsFix: Users are recommended to upgrade to versions 4.2.3, 4.1.8, or 3.6.12, which fix this issue by using a default limit of 500 parameters.
NVD/CVE DatabaseFix: This issue is fixed in version 1.5.7.
NVD/CVE DatabaseFix: Update to version 1.0.12 or later.
AWS Security Bulletins