Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.1 has a vulnerability where attackers can reuse another user's FAISS namespace (a storage space for vector embeddings, which are numerical representations of data) to access private vector content and manipulate search results. This allows attackers to see information they shouldn't have access to and corrupt the results returned to other users.
Kimi Code versions before 0.27.0 have a security weakness in how it blocks unsafe network requests. The protection uses a static list (denylist) of forbidden hostnames and IP addresses, but it doesn't check if domain names resolve to internal addresses or follow redirects (automatic forwards to different URLs), so an attacker could use prompt injection (tricking the AI by hiding instructions in its input) or craft clever URLs to access internal services that should be blocked. Since FetchURL (a tool for fetching web content) is enabled by default without requiring user approval, this vulnerability is particularly dangerous.
AWS Bedrock AgentCore Python SDK has a vulnerability in the install_packages() method where improper input validation allows remote authenticated users to execute arbitrary commands in a Code Interpreter sandbox by crafting malicious package names. The issue affects versions before 1.18.1.
etcd (a distributed database system) has an authorization bypass vulnerability in its Watch API where users with READ permission on a single key can use `clientv3.WithFromKey()` (an open-ended request that watches from one key to the end of all stored keys) to see watch events for every key after their permitted key, not just their one allowed key. This only affects etcd clusters with authentication enabled.
The AWS API MCP Server (a tool that lets AI assistants interact with AWS services) has a security bug where if the security policy data fails to load when the server starts, the security checks are skipped for the entire time the server runs. This means users can perform AWS operations that should be blocked by the security policy, though AWS account permissions (IAM, the system that controls who can access what in AWS) still apply.
Budibase's `uploadUrl()` function uses a bare `fetch()` call without protection against SSRF (server-side request forgery, where a server is tricked into fetching URLs it shouldn't access). When the AI table generation feature processes attachment column values that are URLs, a builder-level user can craft prompts to make the LLM generate internal IP addresses or cloud metadata endpoints, which are then fetched server-side without validation, potentially exposing internal services and cloud metadata APIs.
Budibase's REST datasource integration has a DNS rebinding vulnerability (TOCTOU, or time-of-check-time-of-use flaw) that defeats IP pinning protection. The system validates a hostname and locks the connection to a safe IP using a Node agent, but the REST path uses undici's fetch instead, which ignores the pinned agent and re-resolves DNS at connection time, allowing an attacker to point the initial validation to a public IP and then rebind to an internal IP to access cloud metadata, databases, or internal services.
Budibase has a vulnerability in its chat-link handoff feature where an attacker can trick a victim user into linking the victim's account to the attacker's external chat identity (like Slack or Discord). The vulnerability exists because the confirmation endpoint is publicly accessible without proper security checks, the confirmation token is visible in plaintext on the confirmation page, and there is no CSRF token (a security check that prevents unauthorized requests) protecting the confirmation step. Once linked, the attacker can impersonate the victim user when sending messages through the chat, gaining access to the victim's permissions and data.
Open WebUI had a caching bug in its model-list endpoints where the `@cached` decorator used `key=` instead of `key_builder=`, causing all users to share a single cache entry instead of each having their own permission-filtered list. This meant one user could briefly see another user's accessible models if they made a request within the 1-second cache window after that user.
Open WebUI's Socket.IO server accepts unauthenticated WebSocket connections and has two collaborative document handlers (`ydoc:awareness:update` and `ydoc:document:leave`) that lack authentication checks. This allows an attacker without login credentials to spoof user presence, fake cursor positions, and broadcast false events to legitimate users editing documents together.
Open WebUI had a security gap where the `/api/v1/images/edit` endpoint (a path for sending image editing requests) didn't check if image editing was allowed, even though other image editing features did. This meant any logged-in user could bypass administrator controls that disabled image editing globally or for specific users, and could make billable requests to image editing services using the admin's credentials. The vulnerability affected versions 0.8.11 through 0.9.x.
The @prompty/core Nunjucks renderer (a template engine for the Prompty framework) had a critical vulnerability where it could execute arbitrary JavaScript code when processing untrusted template files. An attacker could use special template syntax to access internal JavaScript properties and run malicious code on the server.
Suna versions before 0.9.102 have a broken access control vulnerability (a flaw where the system fails to properly verify who should be allowed to access data) in its message queue API (the interface for managing task queues). Authenticated attackers can exploit missing ownership checks to read, delete, or manipulate message queues belonging to other users, including injecting malicious prompts into another user's AI agent session to execute commands with that user's permissions.
Microsoft Kiota, a tool that generates AI plugin manifests from API descriptions, has a path traversal vulnerability (CWE-22, a security flaw where attackers access files outside intended directories) in how it validates file references. An attacker controlling the API description can use percent-encoding (a way of representing special characters as %XX codes) to bypass safety checks and reference files outside the plugin package, potentially exposing sensitive files like `/etc/passwd`. The initial fix in v1.32.5 failed because it checked the encoded string before decoding it, allowing attackers to hide traversal patterns in encoded form.
Jan (a software tool) versions up to 0.8.4 have a CORS misconfiguration vulnerability (a security flaw where cross-origin requests, which normally have restrictions, are incorrectly allowed) in its local API server. Attackers on the same network can bypass security restrictions by exploiting how the server handles trusted hosts, allowing them to use the API without authentication to run AI tasks, see what models are available, and access responses they shouldn't normally see.
BlenderMCP before commit 30a3308 has a path traversal vulnerability (a security flaw where attackers can access files outside intended directories) in its download_polyhaven_asset method. Attackers using MITM attacks (interception of network traffic between two parties) or prompt injection (tricking an AI by hiding instructions in its input) can inject malicious file paths like '../../.bashrc' to overwrite sensitive files and gain persistent code execution (the ability to run commands that stay active even after restarting).
CVE-2026-50517 is a vulnerability in Microsoft 365 Copilot where deserialization (the process of converting stored data back into usable objects) of untrusted data allows an authorized attacker to execute code over a network. This means someone with legitimate access to the system could run malicious commands remotely by sending specially crafted data to the application.
A vulnerability (CVE-2026-16796) was found in the AWS Bedrock AgentCore Python SDK's install_packages() method that fails to properly validate package name inputs, allowing an authenticated attacker to run arbitrary commands (code execution) within the sandbox environment where Python packages are installed. This affects versions of bedrock-agentcore before 1.18.1.
PyTorch torchvision (a library for computer vision tasks) versions up to 0.28.0 contain an out-of-bounds heap read vulnerability (a bug where software reads memory it shouldn't access) in the GIF image decoder. Attackers can send malicious or broken GIF files to crash programs using this library or steal data from nearby memory.
h2oGPT versions up to 0.2.1 have a path traversal vulnerability (a flaw where attackers can navigate outside intended directories by using special path sequences) in its OpenAI-compatible files API that allows unauthenticated attackers to read, write, and delete files on the server. The vulnerability exists because the bearer token (a type of authentication credential) is used directly in file paths without validation, and the default API key is empty, so attackers can bypass authentication and potentially run arbitrary code by modifying startup files.
Fix: Update to version 0.27.0 or later.
NVD/CVE DatabaseFix: Upgrade to bedrock-agentcore version 1.18.1 or later. As a workaround, do not pass untrusted or model-generated input to install_packages(). Applications accepting dynamic package names should validate them against strict PyPI (Python Package Index) naming rules, including constraining any extras group (optional dependencies) to comma-separated identifiers, before calling the SDK.
GitHub Advisory DatabaseFix: Upgrade to etcd 3.7.1, etcd 3.6.14, or etcd 3.5.33. If upgrading is not immediately possible, audit all READ permission grants and revoke or restrict any you wouldn't trust with full read access, and use firewall rules or network policies to limit which hosts can connect to etcd's client port.
GitHub Advisory DatabaseFix: This issue has been addressed in version 1.3.47. AWS recommends upgrading to the latest version. Until you upgrade, you can prevent the bypass by using least-privilege IAM credentials (restricted permissions like ReadOnlyAccess) or by restarting the server once network connectivity is restored if it started during connection problems.
GitHub Advisory DatabaseFix: Replace `key=` with `key_builder=` at both call sites in `routers/openai.py` (line ~488) and `routers/ollama.py` (line ~302), adjusting the lambda to take the function as its first argument: `@cached(ttl=MODELS_CACHE_TTL, key_builder=lambda _func, request, user=None: (f'openai_all_models_{user.id}' if user else 'openai_all_models'),)`
GitHub Advisory DatabaseFix: The source suggests three fixes: (1) Set `always_connect=False` or reject unauthenticated connections in the `connect` handler, (2) Add `SESSION_POOL` checks to `ydoc:awareness:update` and `ydoc:document:leave` (similar to how other Ydoc handlers like `ydoc:document:join` correctly verify membership), and (3) Add room membership verification before broadcasting to document rooms.
GitHub Advisory DatabaseFix: The direct route was split into a thin `/edit` route that now enforces the `ENABLE_IMAGE_EDIT` control and per-user `features.image_generation` permission checks before delegating to the shared image editing implementation. Fixed in v0.10.0.
GitHub Advisory DatabaseFix: Upgrade @prompty/core to version 2.0.0-beta.5 or later. The patch sanitizes template inputs to only allow own-data values, blocks access to constructor and prototype properties, and prevents template function calls while preserving normal template features like variable substitution, conditionals, and loops.
GitHub Advisory DatabaseFix: Update Suna to version 0.9.102 or later.
NVD/CVE DatabaseFix: Upgrade to the first released `Microsoft.OpenApi.Kiota` version after 1.33.0 that includes the fixes from pull requests #7910 and #7913. The fix decodes percent-encoded references before validation, rejects control characters and NUL bytes (which could truncate paths), and applies NFKC-folding (a Unicode normalization technique) to catch homoglyph bypasses. Alternatively, only generate plugins from trusted API descriptions and manually review generated manifests to ensure `response_semantics.static_template.file` values are simple relative paths within the `adaptiveCards/` folder with no `..`, rooted paths, URIs, or percent-encoded separators.
GitHub Advisory DatabaseFix: Fixed in commit 3e1c1e7 (a specific code change in the software's development history).
NVD/CVE DatabaseFix: Update BlenderMCP to commit 30a3308 or later, as referenced in the GitHub commit link provided: https://github.com/ahujasid/blender-mcp/commit/30a3308446cd8f81a9446e5a2ed657c0d8d86072
NVD/CVE DatabaseFix: Update bedrock-agentcore to version 1.18.1 or later.
AWS Security BulletinsFix: Fixed in commit 4e05dc2. Users should update to a version of PyTorch torchvision that includes this commit (after version 0.28.0).
NVD/CVE Database