Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
NextChat versions 2.15.8 through 2.16.1 contain an improper URL validation flaw in the proxy endpoint. The x-base-url header is checked with substring matching rather than hostname parsing, so any URL containing 'api.openai.com' passes validation and receives the server's credentials in the Authorization header, allowing an attacker to obtain the server's OpenAI API key.
browser-use web-ui versions 2.0.0 through 3.0.0 do not validate browser settings paths in run_agent_task. An attacker can supply absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path and create directories at arbitrary locations. The attack runs through the unauthenticated Gradio interface, and the container runs as root, so directories can be created anywhere it has write access.
IBM Langflow OSS 1.0.0 through 1.11.1 contains a flaw that lets an authenticated attacker run arbitrary operating system commands in the server process. The attacker saves a flow with a crafted type field value, then triggers a build of a wrapper flow that references it. This escalates privileges from authenticated flow user to OS-level command execution under the server process identity, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control.
IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an improper authorization flaw, tracked as CVE-2026-19294. A remote authenticated attacker could exploit it to execute and read any user's private flow.
IBM Langflow OSS versions 1.0.0 through 1.11.1 are affected by CVE-2026-19286. Improper enforcement of security restrictions on the A2A public endpoint could allow a remote attacker to execute arbitrary code.
IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a namespace collision between user identifiers. A remote attacker can exploit this to obtain sensitive information and inject unauthorized messages.
IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a path traversal flaw (CVE-2026-18899). A remote attacker can exploit it to read arbitrary files.
IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a flaw tracked as CVE-2026-18891. Due to improper authentication, a remote attacker could execute arbitrary flows and access sensitive information.
IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a flaw tracked as CVE-2026-18729. A remote authenticated attacker can exploit improper control of code generation to execute arbitrary code.
IBM Langflow OSS versions 1.0.0 through 1.11.1 are vulnerable to server-side request forgery (SSRF), tracked as CVE-2026-18545. An authenticated attacker can send unauthorized requests from the system, which may enable network enumeration or support other attacks.
Stable Diffusion WebUI through 1.10.1 exposes credentials through its /sdapi/v1/cmd-flags endpoint. The endpoint returns parsed command-line arguments, including gradio_auth and api_auth values, in cleartext. An unauthenticated attacker can query it to retrieve configured usernames and passwords, then use them to log in and access the application.
Qwen-Agent through 0.0.34 contains a path traversal flaw in its document parser, which fails to restrict file access to intended directories. An attacker can supply absolute file paths to the unauthenticated Gradio interface and read arbitrary files that the server process can access.
Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in its document parsing path. The path treats caller-supplied paths as URLs without scheme restriction or host validation. An attacker can reach the unauthenticated Gradio interface to make the server issue HTTP requests to arbitrary internal addresses, including metadata services, and read retrieved content through the parsed document output.
CVE-2026-58616 is a race condition (CWE-362, improper synchronization of a shared resource) in Copilot Chat in Microsoft Edge. An authorized attacker can exploit it over a network to disclose information.
CVE-2026-54746 affects Hatchet from 0.40.0 through 0.91.1. The Dispatcher gRPC service fails to check that a worker ID in Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe belongs to the tenant in the bearer-token context. An authenticated tenant owner who guesses another tenant's worker UUID can overwrite that worker's affinity labels or disconnect it, causing cross-tenant integrity impact and denial of service on multi-tenant or shared deployments. Single-tenant deployments are not practically affected.
Fixed in 0.91.1.
Kubeflow Pipelines versions before 2.17.0 have an unauthenticated server-side request forgery flaw in the frontend /_proxy/ route, implemented in frontend/server/proxy-middleware.ts. The _routePathWithReferer() function forwards requests to any attacker-chosen HTTP or HTTPS target without a host allowlist or filtering of loopback, link-local, RFC1918, or cluster-local addresses. The route bypasses authorization middleware when ENABLE_AUTHZ=true and can be reached through crafted Referer headers, letting an unauthenticated attacker read or modify internal services, including cloud metadata credentials and Kubernetes APIs.
9router's request guard treats a request as local, and so exempt from API-key auth on the `/v1` LLM proxy, based on the client-controlled `Host` header in `isLocalRequest` (`src/dashboardGuard.js`). Because the default `DEFAULT_HOST` is `0.0.0.0` and `requireApiKey` is absent from `DEFAULT_SETTINGS`, a remote unauthenticated attacker sending `Host: localhost` gets an open AI relay using the victim's stored API keys, plus unauthenticated SSRF through `/v1/search` via `provider_options.baseUrl` with the `searxng` provider. Affected: 9router <= 0.4.80.
9router exposes an OpenAI/Anthropic-compatible LLM proxy that is meant to require an API key through Next.js middleware. The middleware checks the original request path before a rewrite maps `/codex/*` to `/api/v1/responses`, and `/codex` is missing from the protected prefix list, so requests to `/codex/*` skip the key check. Tested on v0.4.80 (commit 23da7b1fe3bb8edd2bdbdb63fbbb15a476b02c56, Next.js 16.2.9), an unauthenticated remote request to `/codex/x` returned 200 OK where `/api/v1/responses` returned 401, letting attackers trigger upstream provider calls with operator-stored credentials.
vLLM versions up to and including 0.17.0 are affected by CVE-2026-37237. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py fetch user-supplied media URLs with aiohttp and call r.read() without enforcing a maximum response size. A remote attacker can exhaust server memory by supplying a URL to an arbitrarily large file, causing a Denial of Service.
SiYuan before v3.8.1 has a path traversal flaw in its asset.upload MCP tool. The tool accepts arbitrary absolute file paths without validating them against the workspace boundary. An attacker can use prompt injection to make the AI Agent copy sensitive files such as SSH keys or credentials from outside the workspace into the asset directory.
Fix: Fixed in 2.17.0.
NVD/CVE Database