Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Claude Code had a security flaw where it checked a git worktree (a Git feature allowing multiple branch checkouts in separate directories) `commondir` file to decide if a folder was trustworthy, but didn't verify the file's contents. An attacker could create a malicious repository with a fake `commondir` file pointing to a folder the victim had previously trusted, tricking Claude Code into skipping its safety dialog and running malicious code from `.claude/settings.json` (a configuration file). This attack required the victim to clone the malicious repository and open it in Claude Code, and the attacker had to know a path the victim had already marked as safe.
Fix: Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.
GitHub Advisory DatabaseLiteLLM's proxy API key verification has a SQL injection vulnerability (a type of attack where an attacker inserts malicious database commands into input fields). An unauthenticated attacker could send a specially crafted authorization header to exploit this flaw and potentially read or modify the proxy's database, gaining unauthorized access to stored credentials.
Ray Data registers custom Arrow extension types (special data format handlers) globally in PyArrow, and when PyArrow reads a Parquet file (a data storage format) containing these types, it automatically deserializes metadata bytes using cloudpickle.loads(), which can execute arbitrary code. This vulnerability was reintroduced in July 2025 after a similar issue was supposedly fixed in May 2024, allowing attackers to run malicious code just by having Ray read a specially crafted Parquet file.
LiteLLM Proxy had a server-side template injection vulnerability (a security flaw where user input is processed as code rather than plain text) in its `/prompts/test` endpoint that allowed authenticated users to run arbitrary code within the proxy process and potentially access sensitive information like API keys or database credentials. The vulnerability affects any deployment running an affected version of LiteLLM Proxy.
The BetterDocs plugin for WordPress (versions up to 4.3.11) has a security flaw where the generate_openai_content_callback() function checks for a nonce (a security token that verifies a request is legitimate) but doesn't verify that the user has permission to perform the action. This allows any authenticated user with subscriber-level access or higher to make the plugin call OpenAI's AI service using the site owner's API key and paid quota, even though they shouldn't have that permission.
AnythingLLM, an application that lets LLMs reference external documents during conversations, has a security flaw in versions before 1.12.1 where chart captions aren't properly filtered for malicious code. An attacker can inject harmful instructions (prompt injection, where hidden commands are slipped into LLM inputs) through shared documents or chart records to execute XSS (cross-site scripting, code that runs in other users' browsers without permission) when those users view the conversation.
Flowise, a tool with a drag-and-drop interface for building customized AI workflows, has a vulnerability in versions before 3.1.0 where the GraphCypherQAChain node fails to properly clean user input before sending it to a Neo4j database (a graph database that stores connected data). An attacker could inject malicious Cypher commands (the query language for Neo4j) to steal, change, or delete data from the database.
CVE-2026-33102 is an open redirect vulnerability (a flaw where a website redirects users to an untrusted site) in Microsoft 365 Copilot that allows an attacker to elevate their privileges over a network without authorization. The vulnerability has a CVSS severity rating of 4.0 (a moderate severity score on a 0-10 scale).
Two OpenTelemetry libraries have a vulnerability where they read entire HTTP response bodies into memory without any size limit. An attacker controlling a remote endpoint or intercepting traffic (MitM, or man-in-the-middle attack, where someone secretly relays communications between two parties) could send a huge response to exhaust the application's memory and cause it to crash through an Out of Memory error.
OpenTelemetry .NET packages have a vulnerability where parsing propagation headers (headers that track request flow across services) can allocate excessive memory, potentially causing a denial of service (DoS, where a system becomes unavailable due to resource exhaustion). The issue occurs in baggage, B3, and Jaeger processing code that allocates temporary storage before checking size limits.
OpenTelemetry's dotnet implementation has a vulnerability in how it handles gRPC responses during retries. When the server sends a `grpc-status-details-bin` trailer (extra data sent with a response), the code reads a length value from it without checking if that length is reasonable, potentially allowing an attacker to force the application to allocate massive amounts of memory and crash it (a denial of service attack, or DoS). A malicious collector or someone intercepting network traffic could exploit this.
OpenTelemetry's OTLP exporter (a tool for sending telemetry data, which is information about how software is performing) reads error response bodies from servers with no limit on size, potentially causing memory exhaustion if an attacker controls the server or intercepts the connection. This could crash applications by filling up their available memory.
Pipecat's LivekitFrameSerializer contains a critical vulnerability where its deserialize() method uses pickle.loads() (a Python function that reconstructs objects from binary data) on untrusted WebSocket client data without validation. An attacker can send a malicious pickle payload to execute arbitrary code on the server, potentially compromising the entire system. This affects servers using the now-deprecated LivekitFrameSerializer, especially if exposed to external networks.
Flowise, a tool for building customized AI workflows with a drag-and-drop interface, had a security flaw in versions before 3.1.0 where a speech-generation endpoint didn't require authentication (authorization bypass, where access controls are bypassed by attackers) and could decrypt stored API keys when given a credential ID. This allowed attackers to retrieve sensitive credentials like OpenAI API keys without proper permission checks.
Flowise, a tool that lets users build custom AI workflows through a drag-and-drop interface, had a security flaw in versions before 3.1.0 where the public API endpoint (GET /api/v1/public-chatflows/:id) exposed sensitive data without filtering. The flaw revealed credential IDs, plaintext API keys (secret codes used to access other services), and password fields in the raw workflow data, making it possible for unauthorized people to see this sensitive information.
Flowise, a tool that lets users build custom AI flows through a visual interface, had a mass assignment vulnerability (a bug where user input can change database fields that shouldn't be user-controllable) in versions before 3.1.0 that allowed authenticated users to overwrite existing document storage objects and access objects from other workspaces, potentially breaking access controls (IDOR, or insecure direct object references, where an attacker can access resources by guessing their IDs).
Flowise, a tool for building customized AI language model workflows through a visual interface, had a security flaw in versions before 3.1.0 that let attackers reset any user's password without authorization. The vulnerability existed because the password reset function didn't verify that a valid reset token had been created, so attackers could submit a request with an empty or null token value (which is the default) to change a user's password if they knew the victim's email address.
Flowise, a tool for building AI workflows using a drag-and-drop interface, had a security flaw in versions before 3.1.0 where password reset links were sent over HTTP (unencrypted internet connection) instead of HTTPS (encrypted connection). This allowed attackers on the same network, such as on public Wi-Fi, to intercept these reset links through a MITM attack (man-in-the-middle attack, where someone secretly reads messages between two parties) and take over user accounts.
Flowise, a tool for building customized AI workflows with a drag-and-drop interface, had a security flaw in versions before 3.1.0 that let attackers bypass authentication (skip the login process) and steal OAuth 2.0 access tokens (credentials that grant permission to access other services). Attackers could access public chatflow configuration endpoints (URLs that show workflow settings) to find OAuth credential identifiers and use them to obtain valid access tokens without needing to log in.
Flowise, a tool with a drag-and-drop interface for building customized AI workflows, had security flaws in its request-blocking system before version 3.1.0. These flaws allowed attackers to bypass security protections through DNS Rebinding (a technique where a domain name's IP address changes between security checks) or by exploiting a default configuration that didn't enforce any blocklist, potentially enabling SSRF attacks (Server-Side Request Forgery, where an attacker tricks a server into making unwanted requests).
Fix: Fixed in version 1.83.7. The caller-supplied value is now always passed to the database as a separate parameter. Upgrade to 1.83.7 or later. Alternatively, if upgrading is not immediately possible, set `disable_error_logs: true` under `general_settings` to remove the path through which unauthenticated input reaches the vulnerable query.
GitHub Advisory DatabaseFix: Upgrade to version `1.83.7-stable` or later, which fixes the issue by switching the prompt template renderer to a sandboxed environment (a restricted area where code runs with limited permissions) that blocks the attack. If upgrading is not immediately possible, block the `POST /prompts/test` endpoint at your reverse proxy or API gateway, and review and rotate API keys that should not have access to prompt management routes.
GitHub Advisory DatabaseFix: Update to version 1.12.1 or later, which contains a patch for this issue.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 3.1.0. Users should update Flowise to version 3.1.0 or later.
NVD/CVE DatabaseFix: Fixed in OpenTelemetry.Sampler.AWS version 0.1.0-alpha.8 and OpenTelemetry.Resources.AWS version 1.15.1. The fixes introduce limits to HttpClient requests so that the response body is streamed rather than buffered entirely in memory. Additionally, workarounds include: ensuring the X-Ray sampling endpoint is not accessible to untrusted parties, using network-level controls (firewall rules, mTLS, service mesh) to prevent Man-in-the-Middle attacks, and if using a remote endpoint, placing it behind a reverse proxy that enforces a response body size limit.
GitHub Advisory DatabaseFix: Pull request #7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Additionally, the source mentions workarounds: configure appropriate HTTP request header limits in your web server, or disable baggage and/or trace propagation if not needed.
GitHub Advisory DatabaseFix: Pull request #7064 updates `GrpcStatusDeserializer` to validate decoded length-delimited field sizes before allocation by ensuring the requested length is sane and does not exceed the remaining payload. This causes malformed or truncated `grpc-status-details-bin` payloads to fail safely instead of attempting unbounded allocation.
GitHub Advisory DatabaseFix: PR #7017 updates the OTLP exporter to limit response body reads to 4MiB (megabytes) in error conditions and only attempt to read the response body when OpenTelemetry error logging is enabled.
GitHub Advisory DatabaseFix: In Pipecat version 0.0.90, the vulnerable LivekitFrameSerializer class was officially deprecated in favor of a safer LiveKitTransport method.
GitHub Advisory DatabaseFix: This vulnerability is fixed in version 3.1.0.
NVD/CVE DatabaseFix: Update Flowise to version 3.1.0 or later, where this vulnerability is fixed.
NVD/CVE DatabaseFix: Update Flowise to version 3.1.0 or later, where this vulnerability is fixed.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 3.1.0. Update Flowise to version 3.1.0 or later.
NVD/CVE DatabaseFix: Update Flowise to version 3.1.0 or later, where this vulnerability is fixed.
NVD/CVE DatabaseFix: Update Flowise to version 3.1.0 or later, where this vulnerability is fixed.
NVD/CVE DatabaseFix: Upgrade to version 3.1.0, where this vulnerability is fixed.
NVD/CVE Database