Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a flaw tracked as CVE-2026-19302. Because symbolic links are improperly validated, a remote authenticated attacker can obtain sensitive information.
IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a server-side request forgery flaw. A remote authenticated attacker can exploit it to obtain sensitive information.
IBM Langflow OSS versions 1.0.0 through 1.11.2 are affected by CVE-2026-19300. Incomplete scrubbing of sensitive credential fields could allow a remote attacker to obtain sensitive information.
IBM Langflow OSS versions 1.0.0 through 1.11.2 are affected by CVE-2026-19299. A remote authenticated attacker can exploit a path traversal flaw to obtain sensitive information.
IBM Langflow OSS versions 1.0.0 through 1.11.2 contain CVE-2026-19298. A remote authenticated attacker can exploit an authorization bypass in the flow build process to execute arbitrary code.
IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a flaw tracked as CVE-2026-9186. Remote authenticated attackers can bypass the localhost-only restriction on MCP configuration installation by spoofing the X-Forwarded-For: 127.0.0.1 header. This allows arbitrary writes to IDE configuration files such as ~/.cursor/mcp.json.
IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a flaw in SaveToFileComponent where local file paths are built from attacker-controlled input without sufficient sanitization. An authenticated attacker with low privileges, such as a valid API key or user session, can send crafted paths to the /api/v1/run/{flow_id} endpoint, including absolute paths or path traversal sequences, to write or modify files in locations the Langflow process can write to. Successful exploitation may enable further compromise depending on the deployment environment.
IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a stored cross-site scripting vulnerability (CVE-2026-8447) in the Playground chat interface. The source does not describe how the injected script is delivered or what an attacker gains beyond the flaw itself.
FastChat contains an authentication bypass in the /register_worker endpoint that lets unauthenticated attackers register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompts, images, and responses, or probe internal network ports across the worker mesh.
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object, which evaluates untrusted language model output derived from web page content. Attackers can use indirect prompt injection through web pages to inject malicious Python code that runs on the operator's host without review.
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API. The API fetches multimodal media URLs without validation or redirect filtering, and unauthenticated attackers can supply arbitrary image_url, audio_url, or video_url parameters to make the server issue requests to internal services and cloud metadata endpoints.
CVE-2026-85675 affects OWL's DocumentProcessingToolkit, specifically its extract_document_content tool. The tool fetches caller-supplied URLs without any scheme, host, or IP filtering. An attacker can inject malicious URLs through prompt injection, causing the server to fetch internal resources, with the responses returned to the agent context.
LLaMA-Factory has a server-side request forgery flaw, tracked as CVE-2026-85673, in the multimodal media URL handler of its OpenAI-compatible API. Unauthenticated attackers can bypass the check_ssrf_url validation. Because requests.get follows redirects and re-resolves DNS without re-validating the target, attackers can use HTTP redirects or DNS rebinding to reach internal addresses and cloud metadata endpoints.
OGX (formerly Llama Stack, affected at commit fbe8e0f) has an unauthenticated server-side request forgery flaw in the OpenAI-compatible POST /v1/responses endpoint. The server_url parameter in MCP tool definitions is fetched server-side without the validate_url_not_private() check used for other URL inputs. On the default starter configuration, which runs without authentication, a remote attacker can make the server connect to arbitrary internal addresses, including cloud metadata endpoints such as http://169.254.169.254/, and forward attacker-supplied headers and bearer tokens to them.
CVE-2026-80098 is an improper verification of cryptographic signature flaw in Copilot Studio. An unauthorized attacker can exploit it over a network to elevate privileges.
CVE-2026-84779 is a Subscriber Broken Access Control flaw in Agentimus – AI SEO, llms.txt & MCP for AI Agents, affecting versions up to and including 1.51.0. The source text provides no further detail on how the flaw is reached or what an attacker gains.
Ollama fails to validate redirect destinations when pulling tensor-layer models, letting unauthenticated attackers redirect blob downloads to arbitrary hosts. An attacker controlling a registry can serve a malicious tensor-layer manifest and cause the server to issue GET requests to internal hosts, including cloud metadata endpoints.
Helicone's VaultManager.getDecryptedProviderKeyById() function, reachable through the GET /v1/vault/key/{providerKeyId} endpoint, does not check that the requester's organization matches the vault key's organization identifier. An attacker with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials belonging to other tenants, including plaintext OpenAI, Anthropic, and Bedrock API keys.
The CKAN MCP Server response cache builds its key from an ambiguous serialization of request parameters, because canonicalizeParams does not escape the & and = delimiters or the | separator used in buildCacheKey. Two distinct parameter sets can therefore produce the same key, so an attacker who primes a colliding entry on a shared cache can cause another client's different query to receive the attacker's cached response.
Fix: Build the cache key from an unambiguous, injection-proof encoding: hash a structured, canonical JSON with typed values, or percent-encode or escape each key and value before joining, using a separator that cannot appear in the encoded fields. Include a type tag so object and string values never coincide. Consider partitioning the cache per client or tenant on shared deployments.
LiteLLM proxy versions before 1.88.6 and 1.96.2 contain CVE-2026-84377. Any authenticated proxy user could redirect an outbound provider call to a destination they control, causing the proxy to send its configured provider credentials there. Incomplete request validation in several litellm/proxy files let routing and credential parameters such as api_base, base_url and litellm_credential_name be applied without clearing the stored key, exposing upstream credentials and enabling server-side requests to internal services reachable by the proxy.
Fix: Fixed in 1.88.6 and 1.96.2.