Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
Hatchet, a platform for orchestrating background tasks, AI agents and durable workflows, has a flaw prior to 0.91.1. The GET /api/v1/stable/durable-tasks/{durable-task} endpoint, implemented by listDurableEventLog, does not require the target tenant as a parent resource. An authenticated user who obtains another tenant's durable task UUID can read that task's event log, which can expose task display names, workflow identifiers, user messages, wait conditions, branching logic and timing information.
Fix: Fixed in 0.91.1.
NVD/CVE DatabaseCVE-2026-61687 affects Hatchet, a platform for orchestrating background tasks, AI agents, and durable workflows, in versions prior to 0.91.1. ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback, then accepts an empty state parameter as equal, letting an unauthenticated attacker bind a victim's session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and auth.google.enabled, auth.github.enabled, or the Slack integration to be enabled.
Hatchet, a platform for orchestrating background tasks, AI agents and durable workflows, prior to 0.91.1 has a flaw in the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go. The handler calls http.Get() on payload.UnsubscribeURL after VerifyPayload(), but BuildSignature() excludes that field, so an authenticated tenant can replace it with an internal URL in an otherwise valid AWS-signed message. The resulting server-side request can reach the EC2 Instance Metadata Service, internal services and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality.
CVE-2026-55563 affects Feast, the open source feature store for AI and machine learning, prior to 0.65.0. The workflow .github/workflows/pr_integration_tests.yml uses pull_request_target with the synchronize event and keeps ok-to-test, approved, or lgtm labels on newly pushed commits, so a fork contributor can get approval for a benign revision and then run changed code through privileged make targets. The job exposes GCP, AWS, and Snowflake credentials to that code, enabling runner code execution, credential disclosure, and possible access to downstream cloud resources.
CVE-2026-94093 affects DLR-RM stable-baselines3 up to 2.9.0, specifically the PPO.load, load_replay_buffer and VecNormalize.load functions in save_util.py. Crafted input leads to unsafe deserialization that can be triggered remotely, and a public exploit exists. Version 2.9.0 added weights_only=True hardening to the PyTorch tensor load path, but PR #1913 reverted it on master to fix PyTorch 1.13 compatibility, and these core load APIs have no safe mode or gate.
Fix: The source states that the outstanding hardening in PR #2264 is pending and has not yet shipped. No fixed version is given.
A weakness in the Load function of gensim/utils.py in piskvorky gensim up to 4.4.0 (Model Loader component) allows deserialization when the fname argument is manipulated, and it can be triggered remotely. A public exploit exists. The maintainer closed issue #3663 the same day without a comment, patch, or fix, and the unsafe pickle.load in SaveLoad.load remains unguarded at develop HEAD.
Tencent BrowserSkill through 0.3.0 contains an authentication bypass in the local daemon WebSocket origin validation. The validation accepts any chrome-extension origin made of 32 characters in the range a-p, so an attacker can register a malicious extension as a browser client. That extension can intercept and manipulate the page content, DOM and screenshots returned to the AI agent.
Mistral Vibe before 2.25.5 contains a remote code execution flaw in its worktree creation process, which runs git hooks before trust validation. An attacker who supplies a repository with a crafted post-checkout hook can execute arbitrary shell commands with the privileges of the user running Vibe.
Fix: Fixed in 2.25.5. The source does not discuss any other mitigation.
NVD/CVE DatabasevLLM through 0.29.0 does not properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). An attacker can supply out-of-bounds token indices that corrupt the logits memory of concurrent requests, so different in-flight HTTP requests return incorrect tokens.
vLLM through 0.29.0 has a memory corruption flaw in the Triton _bincount_kernel. Prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. An attacker can submit multimodal audio requests with tokens equal to vocabulary size, causing out-of-bounds writes that corrupt concurrent requests' sampler state and alter repetition penalty behavior.
vLLM versions before 0.29.0 validate allowed_token_ids against the tokenizer length instead of the model output logits width, in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass this check, which causes LogitBiasState to corrupt GPU logits state so that concurrent requests can sample tokens outside their allowlists.
Fix: Fixed in 0.29.0.
NVD/CVE DatabaseA containerized MCP server running under the default `network` permission profile (`insecure_allow_all: true`) can reach host-local services through `host.docker.internal`, including the ToolHive API, other ToolHive-managed MCP server proxies, and other localhost services. Because the ToolHive API and MCP proxy endpoints are unauthenticated, a compromised or malicious MCP server can move laterally without a container escape. The source rates the severity High.
LMDeploy, through its latest release, passes the quant_dtype value from a model's HuggingFace quantization_config directly into eval(f'torch.{quant_dtype}') at lmdeploy/pytorch/config.py line 620 with no validation. The AWQ branch does not override this value, so a malicious model can run arbitrary Python when loaded with lmdeploy. The advisory describes this as a supply-chain vector affecting any user who loads an untrusted model.
LMDeploy's PyTorch DistServe control plane deserialized ZeroMQ messages with recv_pyobj(), which uses pickle and can execute arbitrary code during deserialization. An attacker who can reach the POST /distserve/p2p_connect endpoint can point the server at a malicious ZeroMQ peer, and deployments without API-key authentication allow unauthenticated remote code execution with the privileges of the serving process. Affected versions are lmdeploy >= 0.9.2, < 0.16.0, and only when PD-disaggregation/DistServe is enabled.
vLLM versions before 0.28.0 do not validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints. An unauthenticated attacker can crash the engine by submitting a negative token ID, which triggers a CUDA device-side assertion that poisons the GPU context and makes all later requests fail until the process restarts.
Fix: Fixed in vLLM 0.28.0. The source does not state an upgrade path or workaround beyond this version.
The GPTranslate WordPress plugin, all versions up to and including 2.34.6, exposes sensitive information through the enqueue_frontend_scripts function (CVE-2026-89278). Unauthenticated attackers can fetch any public page, apply the inverse transformation bundled in the plugin's public JavaScript asset, and recover the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation). The exposure affects the default configuration (gpt-3.5-turbo in client mode) and all supported non-DeepSeek providers, while deepseek-* models and gpt-* models in server-proxy mode suppress key emission.
CVE-2026-85887 is an incorrect permission assignment for a critical resource in M365 Copilot. An authorized attacker can exploit it over a network to disclose information.
vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max_tokens=0 to exhaust decode-worker memory without bound until the worker restarts.
CVE-2026-85885 is an improper neutralization of special elements used in a command ('command injection') flaw in M365 Copilot. An authorized attacker can exploit it over a network to elevate privileges.
CVE-2026-78501 is an improper neutralization of special elements used in a command ('command injection') flaw in Microsoft 365 Copilot's Business Chat. An unauthorized attacker can exploit it over a network to disclose information.
Fix: Fixed in version 0.91.1.
Fix: Fixed in 0.91.1
Fix: Fixed in version 0.65.0.
Fix: Fixed in LMDeploy 0.16.0, which replaces pickle-based ZeroMQ messaging with JSON (send_json()/recv_json()) and validates received objects against the DistServeCacheFreeRequest Pydantic schema. Interim workarounds: prevent untrusted clients from reaching /distserve/* endpoints, restrict the DistServe HTTP and ZeroMQ control planes to trusted cluster networks, configure API-key authentication, and block arbitrary outbound ZeroMQ connections from serving nodes. The source states these workarounds reduce exposure but do not make pickle deserialization safe.