AI & LLM Vulnerabilities

CVE-2026-47479 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows an attacker to cause uncontrolled resource consumption (using up all available computing power or memory), potentially leading to a denial of service (making the service unavailable to legitimate users). The vulnerability has a CVSS 4.0 severity rating, though a complete assessment from NIST has not yet been provided.

CVE-2026-47478 is a vulnerability in NVIDIA Triton Inference Server for Linux where an attacker can exploit the use of an expired file descriptor (a reference to an open file that is no longer valid), potentially causing a denial of service (making the service unavailable to legitimate users). The vulnerability has a CVSS 4.0 severity rating, though the exact scoring details have not yet been provided.

CVE-2026-47477 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows an attacker to cause a stack-based buffer overflow (a situation where data written to memory exceeds its allocated space, potentially crashing the system). A successful attack could result in denial of service (making the service unavailable to legitimate users).

CVE-2026-47476 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows attackers to cause uncontrolled resource consumption (using up computing resources like memory or CPU without limit), potentially leading to denial of service (making the system unavailable to legitimate users). The vulnerability is classified as CWE-400 (uncontrolled resource consumption), though a CVSS severity score has not yet been assigned by NIST.

AWS HealthLake MCP Server (a tool that lets AI assistants access AWS health data) before version 0.0.14 has a security flaw where it doesn't check that pagination URLs (links used to load more results) point to the legitimate server. An authenticated attacker can exploit this by sending a crafted next_token parameter (a special value that tells the server what data to load next) to redirect requests to their own server and steal temporary AWS credentials (temporary access keys that grant permissions).

The yutu MCP tool `caption-download` has a vulnerability where it writes downloaded files to any path specified by an attacker, bypassing the `YUTU_ROOT` directory boundary that should confine all file operations. Unlike other caption methods that properly use `pkg.Root.Open()` to restrict file access, `Caption.Download()` directly calls `os.Create()` on the attacker-supplied file path, allowing arbitrary file writes anywhere the yutu process has permission to write (CVSS 7.7, high severity).

CVE-2026-58617 is a vulnerability in Microsoft 365 Copilot for iOS that allows an unauthorized attacker to gain elevated privileges (higher access permissions) over a network due to improper access control (failing to properly verify who is allowed to do what in the system). The vulnerability has a CVSS score of 4.0, which indicates a moderate severity level.

CVE-2026-50510 is a vulnerability in GitHub Copilot where improper file naming restrictions allow an unauthorized attacker to execute code on a user's local machine. The vulnerability is classified as CWE-641 (improper restriction of names for files and other resources), and details are being tracked by Microsoft and NIST.

A vulnerability in Symfony Mailer's Address class allowed attackers to inject email headers and SMTP commands (the protocol used to send emails) by embedding line break characters in email addresses. The constructor was supposed to validate addresses but failed to catch addresses with hidden `\r\n` bytes in the local-part (the text before the `@` symbol), which could be exploited to add unauthorized recipients or headers when the email was sent.

Keras version 3.12.0 has a vulnerability where an attacker can create a specially crafted tar archive (a compressed file format) that gets extracted in unintended locations. The problem is that symlinks (shortcuts that point to other files or directories) bypass safety checks that regular files must pass, allowing attackers to read files, overwrite files, or escape the intended extraction directory. This is especially dangerous on Python 3.10 and 3.11.

CrewAI versions before 1.15.1 have a server-side request forgery vulnerability (SSRF, a flaw where an attacker tricks a server into making unwanted network requests) in the validate_url function. Attackers can bypass security checks by using URL redirects or DNS rebinding techniques (methods that change where a domain points to after an initial lookup) to access internal services and cloud metadata that should be blocked.

OpenClaw versions before 2026.6.8 have an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides (a feature that lets the system use different AI models through a standard interface). Attackers with lower trust levels can exploit misconfigured input paths to bypass admin authorization checks (security rules that verify whether a user should be allowed to do something) and run restricted operations.

Ollama (an AI model software) has a vulnerability in its downloadBlob function where it doesn't properly validate user input, allowing attackers to access memory beyond an array's intended size. This can cause a denial-of-service attack (making the service unavailable) without needing authentication (special login credentials).