Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
A vulnerability in vllm-project vLLM 0.26.0 and 0.27.0 affects the MoRIIO Acknowledgement Handler in vllm/distributed/kv_transfer/kv_connector/v1/moriio/moriio_connector.py, specifically MoRIIOConnectorScheduler.request_finished, MoRIIOConnectorWorker.get_finished and MoRIIOWrapper._handle_release_message. Manipulating the request_id or kv_transfer_params argument causes resource consumption, and the attack can be launched remotely. The project was notified early through a pull request but had not responded at the time of disclosure.
The @zereight/mcp-gitlab package (reviewed at commit 60adcc0de5b0e96c4c2029f7a25d2775946421d8, version 2.1.28) has five defects that defeat its safety controls: read-only mode, the GITLAB_ALLOWED_PROJECT_IDS allow-list, and transport auth. The execute_graphql tool is the most serious, since a document prefixed with a comma can execute a mutation while being classified as read-only, and the handler bypasses the project allow-list entirely. Other defects expose the /mcp and SSE transports without authentication and allow session-exhaustion denial of service.
CVE-2026-83071 affects the Machine Learning component of Oracle Business Intelligence Enterprise Edition in Oracle Analytics, in supported versions 8.2.0.0.0 and 26.01.0.0.0. A low-privileged attacker with logon to the infrastructure where the product runs can easily exploit it to compromise the product, and successful attacks can result in takeover of Oracle Business Intelligence Enterprise Edition. The CVSS 3.1 base score is 7.8, with high confidentiality, integrity and availability impacts.
MCPVault, a Model Context Protocol server for accessing files in an Obsidian vault, uses root-anchored deny-list patterns in PathFilter (src/pathfilter.ts) prior to 0.11.5. Nested .git, .obsidian, and node_modules path segments therefore pass isAllowed() and isAllowedForListing(). An attacker who influences a path chosen by an AI agent can read nested repository or Obsidian metadata, such as remote URLs or embedded tokens, or pollute the listAllTags index with nested node_modules content.
Fixed in 0.11.5.
Prior to version 0.11.4, MCPVault's PathFilter in src/pathfilter.ts matched restricted directory patterns case-sensitively and compared paths without canonicalizing filesystem-equivalent names. On case-insensitive macOS and Windows filesystems, case variants of .git, .obsidian, or node_modules, and Windows names with trailing dots or spaces, bypassed both isAllowed() and isAllowedForListing(). An attacker who influences a path selected by an AI agent can use this in read, write, move, search, or listing operations to expose or modify sensitive repository and Obsidian metadata. Vault-root .. containment is not affected.
CVE-2026-91933 affects Flowise before 3.1.4. Its openai-realtime endpoints do not enforce workspace-level authorization checks, so an authenticated user can supply an unscoped chatflowid to reach tools from ChatFlows in other workspaces. Through GET and POST requests, an attacker can retrieve tool definitions, execute tools in victim workspaces, trigger external side effects, and read sensitive tool outputs.
Fix: Fixed in 3.1.4.
CVE-2026-19407 affects the Google Cloud Gemini Enterprise Agent Platform SDK for Python in versions prior to 1.166.1. The flaw is a bucket squatting issue that allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft.
CodeRAG versions prior to 1.3.1 execute repository-controlled code during the default agent-coderag sync flow. When build.gradle or build.gradle.kts is present, _sync_gradle runs a repository-supplied gradlew or gradlew.bat via asyncio.create_subprocess_exec, and validate_path checks only the directory, not the executable's content or integrity. Indexing an attacker-controlled Gradle repository therefore runs attacker code with the victim's operating-system privileges, enabling disclosure, modification, persistence, or denial of service.
Fixed in 1.3.1.
A vulnerability in vllm-project vLLM up to 0.27.1 affects an unspecified part of the /v1/chat/completions endpoint, in the Jinja Template Rendering component. Manipulating the chat_template argument causes resource consumption, and the attack can be launched remotely. The exploit is publicly disclosed and may be used.
Fix: A pull request to fix this issue is awaiting acceptance. No fixed version is stated in the source.
IBM Langflow OSS versions 1.0.0 through 1.10.0 can let attackers run arbitrary Python code with root privileges (UID=0) on the Langflow server. Attackers do this by submitting components that contain socket or urllib imports. The flaw enables AWS credential theft via IMDSv1 SSRF with full IAM role permissions, arbitrary file exfiltration from the container filesystem, and lateral movement to internal services such as PostgreSQL and Redis within the Docker network. The scanner also incorrectly returns "validated": true, which gives a false security signal.
IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to server-side request forgery (SSRF), tracked as CVE-2026-12767. An unauthenticated attacker may be able to send unauthorized requests from the system, which could lead to network enumeration or facilitate other attacks.
IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a server-side request forgery (SSRF) flaw, tracked as CVE-2026-12766. An authenticated attacker can make the system send unauthorized requests, which could enable network enumeration or support other attacks.
IBM Langflow OSS versions 1.0.0 through 1.10.2 contain a server-side request forgery (SSRF) flaw, tracked as CVE-2026-12765. An unauthenticated attacker can make the system send unauthorized requests, which may enable network enumeration or other attacks.
IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a flaw in the MCP Tools component. An authenticated attacker can reach another user's MCP server context because cache keys are not properly isolated.
Tract, a self-contained TensorFlow and ONNX inference toolkit, has a flaw in tract-nnef prior to 0.21.16, 0.22.2 and 0.23.1. Unchecked usize multiplication in nnef/src/tensors.rs read_tensor lets a crafted NNEF archive loaded through model_for_path or model_for_read make a size check accept a small allocation while as_slice_unchecked in data/src/tensor.rs creates a much larger slice. Reading via as_uniform can disclose adjacent heap data, and later access can crash the process with a segmentation fault; no out-of-bounds write or code execution was demonstrated.
IBM Langflow OSS versions 1.0.0 through 1.10.2 contain an improper authentication flaw, tracked as CVE-2026-17628. A remote authenticated attacker can exploit it to change the password of another account.
PraisonAI, a multi-agent teams system, has a flaw in its unauthenticated POST /api/v1/runs Jobs API before praisonai 4.6.59 and praisonaiagents 1.6.59. The endpoint accepts attacker-controlled agent_yaml, and its approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. A remote caller can thereby make a configured language model agent run arbitrary operating-system commands without credentials or operator interaction.
A flaw in vllm-project vLLM up to 0.29.0 affects the function TiktokenTokenizer::new in rust/src/text/src/backend/hf/mod.rs, within the tiktoken vocab File Handler component. Manipulating this function causes a denial of service, and the attack requires local access. A public exploit exists, and a pull request to fix the issue is awaiting acceptance.
Fix: The source states that a pull request to fix this issue awaits acceptance. It does not name a fixed version or a workaround.
CrewAI versions before fb2323b rely on a Python blocklist that blocks modules at import time. This approach works at the wrong level of abstraction and does not stop access to Python's full object graph, so a different flaw from CVE-2026-2275 remains. The source gives ctypes.CDLL(None) as an example: it loads the C library without any import statement.
ESPnet versions before 202609 deserialize pretrained model checkpoints with torch.load using weights_only=False. A crafted checkpoint file can execute attacker-chosen code when it is loaded through the initialization or fine-tuning path.
Fix: Fixed in version 0.11.4.
Fix: This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.
Fix: This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59.
NVD/CVE Database