Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
The `diffusers` package has a TOCTOU (time-of-check-time-of-use, where a security check happens at one moment but the actual data used comes from a different moment) vulnerability in its `DiffusionPipeline.from_pretrained` function that loads models from HuggingFace Hub. An attacker can bypass the `trust_remote_code` security check by updating a repository between two separate download calls, allowing arbitrary code to execute without the user explicitly approving it.
RTK (Rust Token Killer, a tool that filters sensitive data before showing command output to an LLM) had a vulnerability where it automatically loaded filter configuration files from a project directory without asking the user first, allowing attackers to secretly modify what an LLM sees. An attacker could place a malicious filter file in a repository to hide or alter command output (like file contents or security scan results) without any warning, potentially concealing malicious code during development.
NVIDIA Triton Inference Server has a vulnerability in its DALI backend (a component that processes data) that allows attackers to cause uncontrolled resource consumption, potentially leading to a denial of service attack (making the service unavailable to legitimate users).
NVIDIA Triton Inference Server has a vulnerability in its DALI backend (a component that processes data) where an attacker could trigger an integer overflow (a bug where a number exceeds the maximum value a system can store). This could allow an attacker to execute malicious code, modify data, or crash the service.
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend (a component that processes data) where an attacker could perform an out-of-bounds read (accessing memory locations outside the intended range). Exploiting this could allow code execution (running malicious commands), data tampering (changing information), denial of service (making the system unavailable), or information disclosure (leaking sensitive data).
NVIDIA Triton Inference Server has a vulnerability where an attacker could cause an integer overflow (a situation where a number exceeds the maximum value a program can store, causing unexpected behavior), potentially leading to denial of service (making a system unavailable to users). The vulnerability has a CVSS 4.0 severity rating (a 0-10 scale measuring how serious a security flaw is).
CVE-2026-24209 is a path traversal vulnerability (a flaw where an attacker manipulates file paths to access files outside their intended directory) in NVIDIA Triton Inference Server that could allow an attacker to cause a denial of service (making a system unavailable to users). The vulnerability has a CVSS 4.0 severity rating, though a full assessment from NIST has not yet been provided.
NVIDIA Triton Inference Server contains a path traversal vulnerability (CWE-22, a flaw where attackers can access files outside the intended directory) that could allow an attacker to cause a denial of service (making the service unavailable). The vulnerability has a CVSS 4.0 severity rating, though a detailed assessment has not yet been provided by NIST.
NVIDIA Triton Inference Server has a vulnerability (CVE-2026-24207) where an attacker could bypass authentication (skip security checks that normally verify who someone is), potentially allowing them to run code, gain higher privileges, change data, crash the service, or steal information. The vulnerability is classified as an authentication bypass using an alternate path or channel (CWE-288, a type of weakness where attackers find different ways to access a system without proper verification).
NVIDIA Triton Inference Server contains a vulnerability (CVE-2026-24206) that allows attackers to bypass authentication (a security check that verifies who you are), potentially leading to privilege escalation (gaining higher-level access), denial of service (making a system unavailable), or information disclosure (unauthorized access to data). The vulnerability is classified as CWE-288, which means it exploits an alternate path to bypass normal authentication checks.
Coder's Azure identity verification has a critical flaw: it checks that a certificate comes from a trusted Azure authority but never verifies the actual PKCS#7 signature (a cryptographic stamp that proves data hasn't been tampered with). An attacker can forge identity data and steal session tokens that grant access to Git keys, OAuth tokens, and secrets. All Coder v2 versions are affected.
PenPot's MCP REPL server binds to all network interfaces (0.0.0.0:4403) and exposes an unauthenticated /execute endpoint that runs arbitrary JavaScript code, allowing anyone on the network to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own). The vulnerability exists because the server listen call omits a host argument, defaulting to 0.0.0.0, and the /execute endpoint has no authentication checks before executing user-supplied code.
Coder's Azure identity endpoint was vulnerable to SSRF (server-side request forgery, where an attacker tricks a server into making requests to unintended targets) because it accepted unsigned certificates and fetched arbitrary URLs without validation. An attacker could craft a fake certificate pointing to any internal or external address, forcing the Coder server to connect to it and reveal whether the target was reachable through error messages, enabling network reconnaissance and potential attacks on internal services.
9router, a tool for managing AI plugins, has a critical vulnerability where two unprotected API endpoints can be chained together to run arbitrary OS commands. The problem occurs because the authentication middleware (a security check) only protects 8 specific routes, while 40+ routes under `/api/cli-tools/*` and `/api/mcp/*` have no protection, allowing attackers with network access to register malicious commands and then trigger them without any credentials.
A domain allowlist (list of approved websites) in the Apify Model Context Protocol server is bypassed because it uses simple string prefix matching instead of proper URL validation. An attacker can create a fake subdomain like `https://docs.apify.com.evil.com/` that passes the check, allowing the tool to fetch arbitrary content from attacker-controlled servers and return it to the AI, which can lead to prompt injection (tricking the AI by hiding instructions in fetched content) and potential account compromise.
Envoy AI Gateway has a vulnerability where it improperly parses JSON-RPC messages (a protocol for remote procedure calls) in a case-insensitive way, even though the specification requires case-sensitive matching. This allows attackers to send messages with duplicate fields using different capitalization (like 'name' and 'Name'), causing the gateway to alter and forward a different request than what was originally sent, potentially bypassing security checks in systems that use this gateway.
A security flaw in n8n (a workflow automation tool) allowed authenticated users to bypass restrictions on which websites could receive sensitive credentials, potentially exposing them. The vulnerability was in an endpoint (a URL that accepts requests) that didn't properly check the intended security rules before sending data to external servers.
The `download_media` and `auth_fetch` tools in auth-fetch-mcp accept any URL without validation, allowing an attacker (via prompt injection or a malicious MCP client) to make the server fetch from private or internal services like cloud metadata endpoints or localhost, and then exfiltrate the response data. The `download_media` tool makes this worse by saving fetched content to disk where it can be read and stolen.
An attacker published malicious code in guardrails-ai version 0.10.1 on PyPI (a package repository where developers download Python libraries), but PyPI removed it within 2 hours and found no evidence that user data was stolen through this compromise. This is an example of a supply chain attack, where someone tries to harm users by corrupting a widely-used software package.
MLflow version 3.9.0 has a vulnerability in its Assistant feature where /ajax-api endpoints don't properly validate the origin (the source website making a request). This allows an attacker on a malicious webpage to send cross-origin requests (requests from a different domain) to trick the MLflow Assistant running on a victim's computer, bypass security restrictions meant to only allow local access, and execute arbitrary commands (run any code they choose) through the Claude Code sub-agent.
Fix: Fixed in v0.32.0 (PRs #623, #625): the `.rtk/filters.toml` file is now blocked by default with a visible warning stating '[rtk] WARNING: untrusted project filters — Filters NOT applied. Run rtk trust to review and enable.' The patch also adds SHA-256 hash verification (a cryptographic check ensuring the file hasn't changed) to re-block filters if the file is modified after being trusted, and introduces new `rtk trust` and `rtk untrust` commands to let users explicitly approve configuration files.
GitHub Advisory DatabaseFix: Update to patched versions: v2.33.3, v2.32.2, v2.31.12, v2.30.8, v2.29.13, or v2.24.5. If unable to patch immediately, reconfigure Azure templates to use token authentication instead of azure-instance-identity by setting coder_agent.auth to 'token' and adding CODER_AGENT_TOKEN=${coder_agent.main.token} to environment variables.
GitHub Advisory DatabaseFix: Fixed in PR #25274 (commit 57b11d405). Upgrade to patched versions: v2.33.3, v2.32.2, v2.31.12, v2.30.8, v2.29.13, or v2.24.5 (ESR), depending on your release line.
GitHub Advisory DatabaseFix: The issue has been fixed in n8n version 2.20.0. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should restrict n8n access to fully trusted users only and limit credential sharing to users who genuinely require access to those credentials, though these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
GitHub Advisory DatabaseFix: The source text describes the fix shape but does not provide an explicit implementation or version update: 'after URL parsing, resolve to IP, reject if private/loopback/link-local. Same defense as the well-known SSRF-guard pattern shipped by other MCP fetchers in the ecosystem (e.g., `Akitaroh/scraper-mcp` `src/security/url-guard.ts`).' However, no patched version, release number, or completed code fix is provided in the source.
GitHub Advisory DatabaseFix: Downgrade to guardrails-ai==0.10.0, which is unaffected. Alternatively, install from GitHub using `pip install git+https://github.com/guardrails-ai/guardrails.git@v0.10.0`. If you installed 0.10.1, rotate all credentials accessible from that machine (GitHub PATs, cloud provider keys, package registry tokens, API keys) and audit your GitHub account for unauthorized workflows or repositories. Snowglobe and Guardrails Hub users should rotate API keys before 2:00 PM Pacific on May 13, 2026, when all existing keys will be invalidated.
GitHub Advisory DatabaseFix: Update to MLflow version 3.10.0, where this issue is resolved.
NVD/CVE Database