Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
langchain4j-aideepin before 3.31.0 contains an insecure direct object reference flaw that lets any authenticated user read other users' character-chat conversations. An attacker sends GET /character/{uuid} with a victim's character uuid, and CharacterService.detail resolves it without an ownership check, exposing questions, AI answers, and attachment and audio URLs.
easyVoice before 0.0.23 contains a server-side request forgery flaw that lets unauthenticated attackers make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can reach loopback and internal services through /api/v1/tts endpoints, using error messages reflected in the x-generate-tts-warning header to probe internal hosts and ports.
CVE-2026-118628 is a Server-Side Request Forgery information disclosure flaw in the get-artifacts function of MLflow. The server does not properly validate a URI before accessing resources, letting a remote attacker disclose information in the server's context without authentication.
CVE-2026-118627 is a remote code execution flaw in MLflow's SHAP load_explainer, caused by deserialization of untrusted data. An attacker can run arbitrary code in the context of the current user on affected installations, but only if the target visits a malicious page or opens a malicious file. The flaw lies in the loading of SHAP explainer models, which lacks proper validation of user-supplied data. Reported as ZDI-CAN-30301.
A missing authorization flaw in the MLflow Tracking Server lets a remote attacker escalate privileges on affected installations. The specific flaw exists in the configuration of BEFORE_REQUEST_HANDLERS, where access to functionality is granted without an authorization check. Exploitation requires authentication, and the issue is tracked as ZDI-CAN-32108.
CVE-2026-118625 is a missing authorization flaw in the MLflow Tracking Server. The flaw sits in the get_endpoints function, which grants access to functionality without an authorization check. A remote attacker who has authentication can use it to escalate privileges to resources normally protected from that user.
CVE-2026-118624 is a missing authorization flaw in the MLflow Tracking Server Jobs component. The flaw sits in the _find_validator function, which allows access to functionality without an authorization check. A remote attacker with authentication can exploit it to disclose information in the context of the service account.
CVE-2026-118623 is a remote code execution flaw in MLflow's PickleEvaluationArtifact component. The flaw sits in the parsing of pickle files, which lacks proper validation of user-supplied data and leads to deserialization of untrusted data. An attacker who gets a target to visit a malicious page or open a malicious file can execute code in the context of the current process.
Claude Code versions before 2.1.251 have a flaw in the Edit tool, which validates target paths by pathname and symlink resolution without binding them to the directory inode or file descriptor. On macOS, code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, so the unsandboxed Edit implementation overwrites a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script.
Claude Desktop on Windows, prior to 1.8089.0, calls git.exe through uv_spawn without an absolute path. Windows search-path resolution can therefore pick a malicious git.exe placed in the opened project's current working directory, so opening an attacker-controlled or shared repository executes the substituted program with the user's privileges.
Fix: Fixed in version 1.8089.0.
NVD/CVE DatabaseCVE-2026-115413 affects the AWS API MCP Server in versions >=1.3.0 and <1.6.0 when it runs the streamable-http transport with OAuth authentication. The server checks a bearer token's signature, issuer and expiry but not the application audience claim, so a token issued to another application in the same tenant is accepted. This may allow AWS API calls using the credentials configured on the host.
Fix: Fixed in awslabs.aws-api-mcp-server version 1.6.0. Operators using AUTH_TYPE=oauth should also set AUTH_AUDIENCE, or AUTH_CLIENT_ID for identity providers whose access tokens carry no audience claim, such as Amazon Cognito. Workaround: use the default stdio transport rather than streamable-http.
An authenticated user with Machine Learning read access in one Kibana space can read audit and error messages of data frame analytics jobs in other spaces they are not authorized to access. The flaw is an authorization bypass through a user-controlled key (CWE-639). Exposed messages can include destination index names, analyzed field names and failure information.
CVE-2026-89229 is a path traversal flaw (CWE-22, Improper Limitation of a Pathname to a Restricted Directory) in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot). A malicious application installed on the same device can send a crafted ACTION_SEND intent whose ContentProvider-supplied file name contains '..' sequences, allowing it to write arbitrary files.
CVE-2026-116635 affects the deployment status component of the AWS Serverless MCP Server, versions below v0.2.1 of awslabs.aws-serverless-mcp-server. Under certain conditions, an improper limitation of a pathname to a restricted directory might let an actor who can influence the MCP agent read JSON files outside the intended deployment status directory. Where write access has been enabled, the same flaw might allow creating or overwriting JSON files outside that directory.
Fix: Fixed in v0.2.1 of awslabs.aws-serverless-mcp-server.
CVE-2026-120497 is a stored cross-site scripting flaw in the HTML report generator of the aidlc-traceability CLI, an open source tool formerly published in the awslabs/aidlc-workflows repository. An actor who can modify a project's AI-DLC artifact files can embed script through crafted artifact titles or descriptions, which then runs in the browser of a user who opens a generated HTML traceability report. Affected versions are >=0.1.0 and earlier than commit 96cf0ea.
Fix: Fixed in commit 96cf0ea (fixed 2026-07-03).
AWS Security BulletinsCrewAI has an SSRF vulnerability because its SSRF guard and HTTP client check different content in a URL. Any request that injects a malicious URL can trigger SSRF, including through ScrapWebsiteTool.
DBHub's read-only mode can be bypassed on its MySQL and MariaDB connectors. The SQL parser treats "--" as a comment even when MySQL and MariaDB would not, so a payload such as "SELECT 1--1;DROP TABLE victim" passes the read-only check while the database executes the DROP TABLE, which allows writes and DDL when a database is exposed to an AI agent. The advisory states that PostgreSQL is not affected by this path.
Fix: The source suggests running only the validated statements instead of the original string and disabling multipleStatements on the MySQL and MariaDB connections unless it is required. As defense in depth, it suggests making the comment scanner dialect-aware so that for MySQL and MariaDB "--" starts a comment only when followed by whitespace, a control character, or the end of the line.
Beta9 gateway versions below 0.1.776 and worker versions below 0.1.756 let a tenant with any workspace token attach a volume whose identifier uses parent-directory segments, such as ../../.., so the mount resolves to the worker's filesystem root. The mount is read-write by default, exposing host files and other tenants' volumes stored on that host.
Fix: Upgrade the gateway to 0.1.776 or later and the worker to 0.1.756 or later. Both components need the upgrade, because stubs saved before the check are validated only when launched.
JFrog Security Research (Vulnerabilities)Beta9 worker versions below 0.1.756 let a tenant holding a workspace token and one running sandbox escape the container through the sandbox file API. The getHostPathFromContainerPath helper in pkg/worker/container_server.go joins tenant-supplied paths onto worker paths, so traversal segments and absolute symbolic links reach any file on the worker as root, including other tenants' files and the worker pod's Kubernetes service account token, which is bound to cluster-admin in the shipped remote-node manifests.
Fix: Fixed in worker 0.1.756, which opens these paths with os.OpenRoot so parent-directory and symlink lookups stay inside the container root or mount source, refuses writes to read-only mounts, and does not write through a symlink swapped in after path resolution.
Beta9 workers before 0.1.756 run each tenant image build step with Buildah using BUILDAH_ISOLATION=chroot, without passing --isolation. This leaves the step sharing the worker pod's PID, network, IPC and user namespaces, running as uid 0 with CAP_DAC_OVERRIDE, so a tenant with any workspace token can reach the worker's filesystem through /proc/1/root in a single image build. The CVSS score is 9.9 (critical), and the issue was discovered by Natan Nehorai of the JFrog Security Research Team.
Fix: Fixed in version 2.1.251.