Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
A vulnerability was found in vLLM (a library for running large language models) version 0.27.1 and earlier, where attackers can manipulate the chat_template parameter to cause excessive resource consumption through Jinja template rendering (a system for dynamically generating text). The vulnerability can be exploited remotely, and a fix has been proposed but not yet officially accepted.
A vulnerability was discovered in ModelCloud GPTQModel up to version 7.2.0 that allows an attacker to cause an out-of-bounds read (accessing memory outside the intended range) by manipulating the g_idx argument in the Triton dequantization kernel (a component that decompresses compressed numerical data). This vulnerability can be exploited remotely and has been publicly disclosed.
A security flaw (CVE-2026-85704) was found in the freegpt-webui project's Jailbreak Mode feature, affecting a function called getJailbreak in the server/config.py file. The flaw creates a race condition (a bug where the timing of operations causes unexpected behavior), which can be exploited remotely, though it requires significant technical skill to carry out. The vulnerability affects an older version of the product that is no longer maintained.
A security flaw was found in Doccano (an open-source tool for labeling data used in machine learning projects) version 1.8.5 and earlier that allows attackers to bypass access controls (protections that restrict who can do what) through the bulk-delete endpoint. The flaw can be exploited remotely (from anywhere over the internet), the exploit code has been publicly released, and the vendor has not responded to early notifications about the problem.
browse-mcp versions before 0.8.2 had a critical security flaw where file download and state management functions didn't properly check file paths, allowing attackers to write files to any location on the system (like startup scripts or configuration files) and potentially execute code. The vulnerability could be exploited by malicious MCP clients (software components that interact with the browser tool) or through prompt injection (tricking an AI by hiding instructions in web page content).
faf-mcp (a tool that helps AI assistants work with files) had a security flaw where it accepted file paths from callers without properly restricting access to a safe directory. This meant an attacker could trick the system into reading sensitive files like SSH keys or cloud credentials, or writing files outside the intended project folder, by using absolute paths or directory-traversal tricks (like `../`). The vulnerability could be exploited through prompt injection (hiding malicious instructions in user-provided content that an AI processes).
CVE-2026-47606 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows an attacker to perform absolute path traversal (accessing files outside their intended directory by using path tricks like "../"). If successfully exploited, this vulnerability could allow an attacker to run code on the system or access sensitive information.
A security vulnerability (CVE-2026-75093) was found in sonos tract software up to version 0.23.4 that incorrectly calculates buffer sizes (memory allocation amounts) in a specific function, potentially allowing remote attacks. The vulnerability has been publicly disclosed and can be exploited.
vLLM (an AI inference and serving engine for large language models) versions 0.20.2rc0 to 0.26.0 have a vulnerability where concurrent requests to the chat API can bypass safety checks on prompt embeddings (pre-computed numerical representations of text input). This happens because the safety checking function uses a process-global state that can be exploited when multiple requests run simultaneously, potentially allowing invalid data to pass through even when safety features are enabled.
A path traversal vulnerability (a type of attack where an attacker can access files outside their intended directory) was found in claude-comfyui-mcp version 1.0.0, specifically in a function that copies image files. The vulnerability can be exploited locally (meaning an attacker needs access to the computer running the software) by manipulating the image file path, and the severity is rated as low.
JFrog Artifactory has an improper authentication vulnerability (a flaw in how the software verifies user identity) that could accidentally give an internal anonymous-user token (a credential that grants access without logging in) to someone who shouldn't have access, especially when anonymous access is supposed to be turned off. This could expose sensitive files and data stored in Artifactory. This vulnerability is currently being exploited by attackers in real attacks.
Fix: Apply mitigations according to JFrog vendor instructions at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases, following CISA's BOD 26-04 guidance for prioritizing security updates. If mitigations are unavailable, discontinue use of the product for cloud services per BOD 26-04 requirements. Due date for patching is 2026-09-25.
CISA Known Exploited VulnerabilitiesFix: Upgrading to version 7.3.0 resolves this issue. The patch is identified as 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1.
NVD/CVE DatabaseKludex Starlette contains an HTTP request/response smuggling vulnerability (a technique where attackers manipulate how web servers process requests and responses) that allows attackers to inject malicious paths into the host part of a URL, potentially bypassing authentication systems that rely on checking the URL's path. This vulnerability is being actively exploited by attackers in the wild.
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 guidance on prioritizing security updates. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each system's internet exposure and ensure adherence to BOD 26-04 patching guidelines by the due date of 2026-09-16.
CISA Known Exploited VulnerabilitiesJFrog Artifactory has an improper authentication vulnerability (a flaw in how the software checks whether users are who they claim to be) that allows attackers without valid credentials to gain admin access through its default configuration. This is being actively exploited by real attackers in the wild.
Fix: Apply mitigations according to vendor instructions from JFrog's security advisories at https://docs.jfrog.com/releases/docs/jfrog-security-advisories, following CISA's BOD 26-04 guidance for patching timelines and risk assessment. If mitigations are unavailable, discontinue use of the product.
CISA Known Exploited VulnerabilitiesJFrog Artifactory has a vulnerability where authenticated users can write data outside the intended Docker cache path (a directory where temporary files are stored) under certain conditions with remote repositories. This is a path traversal issue (a security flaw that lets attackers access files outside where they're supposed to) that is currently being exploited by attackers in real attacks.
Fix: Apply mitigations in accordance with vendor instructions from JFrog's security advisories (https://docs.jfrog.com/releases/docs/jfrog-security-advisories) and follow CISA's BOD 26-04 patching guidelines. If mitigations are unavailable, discontinue use of the product.
CISA Known Exploited VulnerabilitiesA vulnerability in the Linux Kernel's IPv6 networking subsystem (the protocol that allows devices to communicate on networks) can allow privilege escalation (gaining higher-level access to a system than intended). This affects multiple Linux-based products from vendors like Suse and Red Hat, and is currently being exploited by attackers.
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA's Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. The due date for remediation is 2026-08-30. References to specific kernel fixes are available at the git.kernel.org links provided in the source material.
CISA Known Exploited VulnerabilitiesThe Linux Kernel has an out-of-bounds memory write vulnerability (a bug where code writes data beyond the intended memory boundaries), which could let a local user gain admin-level access or crash the system. This vulnerability is being actively exploited in real-world attacks and affects the open-source Linux Kernel component that many products rely on.
Fix: Apply mitigations according to vendor instructions and follow CISA's BOD 26-04 guidance for prioritizing security updates based on risk. If mitigations are unavailable for cloud services, discontinue use of the product. Organizations must evaluate each system's internet exposure and ensure compliance with BOD 26-04 patching guidelines by the due date of 2026-09-09.
CISA Known Exploited VulnerabilitiesFix: Fixed in version 0.8.2. The patch confines file downloads to a specific directory (~/.browse-mcp/downloads) and state files to (~/.browse-mcp/state), rejects absolute paths and directory escape sequences (..), strips filenames to their base names only, and enforces the origin fence (allowed website restrictions) on all fetches. Users should upgrade to browse-mcp 0.8.2.
GitHub Advisory DatabaseMicrosoft Entra ID (formerly called Azure Active Directory, which manages user identities and access) has a deserialization of untrusted data vulnerability (a flaw where the software unsafely processes data from untrusted sources, allowing attackers to run malicious code). An attacker could exploit this over a network to execute code without authorization, and this vulnerability is currently being exploited by real attackers.
Fix: Apply mitigations according to Microsoft's vendor instructions while following CISA's BOD 26-04 (Prioritizing Security Updates Based on Risk) guidance. For cloud services, follow BOD 26-04 guidance for cloud environments, or discontinue use of the product if mitigations are unavailable. Organizations must evaluate their systems' internet exposure and ensure they meet BOD 26-04 patching requirements by the due date of 2026-08-24.
CISA Known Exploited VulnerabilitiesFix: Fixed in version 2.1.3 by adding path confinement: reads are restricted to `.faf` / `.fafm` context files only, general file operations are confined to the project root (with an optional `FAF_ALLOWED_ROOTS` environment variable to override), symlink bypasses are closed, and absolute paths and `../` escapes are rejected. Upgrade with `npm install -g faf-mcp@2.1.3` or use `npx faf-mcp`. If you cannot upgrade immediately, run the server only on trusted local projects and set `FAF_ALLOWED_ROOTS` to a single project directory for a hard boundary.
GitHub Advisory DatabaseFix: Apply patch 66b10bda8895f4bfaf8c205361f0125cdf51f99b to resolve the issue.
NVD/CVE DatabaseApple macOS has a security flaw that allows attackers on the same network to access Screen Sharing (a remote desktop feature) without needing a valid password. This vulnerability is currently being exploited by attackers in real-world attacks.
Fix: Apply mitigations according to Apple's vendor instructions and follow CISA's BOD 26-04 guidance for security update prioritization. If mitigations are unavailable, discontinue use of the affected product. See Apple support pages at https://support.apple.com/en-us/148170, https://support.apple.com/en-us/148171, and https://support.apple.com/en-us/148172 for specific patching instructions.
CISA Known Exploited VulnerabilitiesMicrosoft SharePoint has a weak authentication vulnerability that allows attackers to bypass security features over a network without proper credentials. This flaw is currently being exploited by real attackers. Organizations must apply patches according to Microsoft's instructions and follow CISA's BOD 26-04 guidance (a federal directive for prioritizing security updates), or stop using the product if no fix is available.
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 guidance. For cloud services, follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. See Microsoft Security Response Center (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040) for specific patches. Due date for patching: 2026-08-21.
CISA Known Exploited VulnerabilitiesFix: This issue is fixed in version 0.26.0. Users should update vLLM to version 0.26.0 or later.
NVD/CVE DatabaseMetabase has a SQL injection vulnerability (SQL injection, where an attacker inserts malicious SQL code into input fields) that allows an unauthenticated attacker to gain admin access to the application without logging in. Once inside, the attacker could steal database credentials, read sensitive data, change settings, and export information. This vulnerability is actively being exploited by real attackers.
Fix: Apply mitigations in accordance with vendor instructions from Metabase, ensuring compliance with CISA's BOD 26-04 guidance on prioritizing security updates. For cloud services, follow BOD 26-04 guidance or discontinue use if mitigations are unavailable. See Metabase's security update at https://www.metabase.com/blog/security-update and the security advisory at https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf.
CISA Known Exploited Vulnerabilities