Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
The OpenTelemetry.Resources.Host NuGet package on macOS has a vulnerability where it launches programs using bare names instead of absolute paths, allowing a less-privileged attacker to hijack the PATH environment variable (the list of directories the system searches for programs) and execute malicious code with the application's permissions. This vulnerability does not affect Linux or Windows systems.
Fix: The vulnerability was fixed by pull request open-telemetry/opentelemetry-dotnet-contrib#4760, which executes `ioreg` directly using its absolute path instead of relying on the PATH environment variable.
GitHub Advisory DatabaseThe WPBot WordPress plugin (a tool that adds AI features to WordPress websites) before version 8.7.6 is missing a security check on one of its functions, allowing low-level users (subscribers) to change important settings including the API key (a secret credential used to access the Claude AI service). This means even basic users could potentially hijack the plugin's connection to the AI service.
A vulnerability was found in vLLM versions 0.26.0 and 0.27.0 in the MoRIIO (a distributed key-value transfer component) acknowledgement handler that allows remote attackers to manipulate certain arguments and cause excessive resource consumption (a denial-of-service attack where a system runs out of memory or CPU). The developers were notified through a pull request but have not yet responded or released a fix.
The @zereight/mcp-gitlab package, which connects GitLab to an AI agent, has five security flaws that bypass its safety controls (read-only mode, project allow-lists, and authentication). These flaws let attackers execute write operations through GraphQL, access the tool without credentials, perform DNS rebinding attacks, exhaust sessions with fake tokens, and inject malicious instructions through CI job logs.
Oracle Coherence, a data management product in Oracle Fusion Middleware, has a vulnerability (CVE-2026-83416) that allows attackers with low-level network access to partially disable the service through a denial of service attack (DOS, where a system is made unavailable to legitimate users). The flaw affects several versions of the software and has a moderate severity rating of 4.3 out of 10.
A serious vulnerability exists in Oracle Coherence (a data management product used in Oracle Fusion Middleware) that allows an attacker with low-level network access to take complete control of the system. The flaw affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and has a CVSS score (a 0-10 rating of how severe a vulnerability is) of 8.8, indicating high risk to confidentiality, integrity, and availability of data.
A vulnerability (CVE-2026-83071) exists in Oracle's Business Intelligence Enterprise Edition software, specifically in its Machine Learning component, affecting versions 8.2.0.0.0 and 26.01.0.0.0. An attacker with low-level access to the computer where the software runs could exploit this flaw to take complete control of the system, affecting data confidentiality (keeping information secret), integrity (preventing unauthorized changes), and availability (keeping the system running). The vulnerability has a CVSS score (a 0-10 severity rating) of 7.8, indicating it is moderately serious.
MCPVault, a server that lets AI safely access files in an Obsidian vault (a note-taking app), had a security flaw before version 0.11.5 where its path filter (the code that blocks access to certain folders) only blocked top-level restricted folders like .git and node_modules. An attacker could bypass this by accessing these same folders when they were nested deeper in the directory structure, potentially exposing sensitive files, tokens (credentials used for authentication), or corrupting search indexes.
MCPVault (a tool that lets AI safely access files in Obsidian vaults, which are note-taking systems) has a security flaw in versions before 0.11.4 where it checks restricted directories in a way that doesn't account for how modern operating systems treat uppercase and lowercase letters the same. An attacker can trick an AI into accessing or modifying sensitive files by using different letter cases (like '.GIT' instead of '.git') or adding trailing spaces on Windows, bypassing the safety checks.
Flowise (a workflow automation tool) versions before 3.1.4 have a security flaw where it doesn't properly check if users have permission to access different workspaces (isolated project areas) in its OpenAI real-time endpoints. An authenticated user (someone with valid login credentials) can trick the system into letting them view and run tools from other users' workspaces by providing an unscoped chatflowid (a reference number without proper access restrictions), potentially exposing sensitive information and triggering unwanted actions.
A vulnerability called bucket squatting (exploiting unprotected cloud storage locations) in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions before 1.166.1 lets attackers run arbitrary code on systems (RCE, remote code execution) and steal authentication tokens belonging to tenant projects (shared computing environments).
CodeRAG, a tool that helps AI coding agents search through code, has a security flaw in versions before 1.3.1 where it automatically runs build files from repositories without checking if they're safe. An attacker can hide malicious code in a fake Gradle repository (a build system for Java projects), and when someone uses CodeRAG to index that repository, the hidden code runs with the user's full system permissions, potentially allowing the attacker to steal data, change files, install backdoors, or crash the system.
A vulnerability was found in vLLM (a library for running large language models) version 0.27.1 and earlier, where attackers can manipulate the chat_template parameter to cause excessive resource consumption through Jinja template rendering (a system for dynamically generating text). The vulnerability can be exploited remotely, and a fix has been proposed but not yet officially accepted.
IBM Langflow OSS versions 1.0.0 through 1.10.0 have a critical vulnerability where attackers can run arbitrary Python code (code that does whatever the attacker wants) with root privileges (the highest access level) by uploading components that import socket or urllib libraries. This allows attackers to steal AWS credentials, steal files from the server, or attack other services like PostgreSQL and Redis running on the same network, while a faulty security check incorrectly marks these malicious components as safe.
IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a server-side request forgery vulnerability (SSRF, a flaw that lets attackers trick the server into making unauthorized requests on their behalf). An attacker without authentication could exploit this to probe the network or launch further attacks.
IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a server-side request forgery vulnerability (SSRF, a flaw where an attacker tricks the server into making unwanted network requests). An authenticated attacker (someone with valid login credentials) could exploit this to send unauthorized requests from the system, potentially discovering network information or launching further attacks.
IBM Langflow OSS versions 1.0.0 through 1.10.2 have a server-side request forgery (SSRF, a vulnerability where an attacker tricks the server into making unintended requests to other systems) vulnerability that lets unauthenticated attackers send unauthorized requests from the affected system. This could be used to scan networks or set up follow-on attacks.
IBM Langflow OSS versions 1.0.0 through 1.11.5 has a security flaw where a logged-in attacker can view another user's MCP (Model Context Protocol, a system for connecting AI tools to external services) server settings because the cache key isolation (the method that keeps different users' data separate in temporary storage) is not working properly in the MCP Tools component.
Tract, a toolkit for running machine learning models (TensorFlow and ONNX inference, which means executing pre-trained AI models), has a vulnerability in how it handles tensor dimensions (the sizes of data arrays). Before versions 0.21.16, 0.22.2, and 0.23.1, an attacker could craft a malicious model file that tricks Tract into allocating a small amount of memory while actually trying to access a much larger area, potentially exposing nearby data in memory or crashing the program.
IBM Langflow OSS (an open-source tool for building AI applications) versions 1.0.0 through 1.10.2 has a security flaw where an attacker who is already logged into an account can change another user's password because the system doesn't properly verify who should be allowed to make that change. This allows unauthorized account takeovers for authenticated users.
Fix: Update WPBot WordPress plugin to version 8.7.6 or later.
NVD/CVE DatabaseFix: Update MCPVault to version 0.11.5 or later, where this issue is fixed.
NVD/CVE DatabaseFix: Update MCPVault to version 0.11.4, which fixes this issue.
NVD/CVE DatabaseFix: Upgrade Flowise to version 3.1.4 or later.
NVD/CVE DatabaseFix: Update to SDK version 1.166.1 or later.
NVD/CVE DatabaseFix: Update CodeRAG to version 1.3.1 or later, which fixes this issue.
NVD/CVE DatabaseFix: This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.
NVD/CVE Database