Security advisories for vibe-coded apps · Updated · 19 new this week
Find the leak
before someone else does.
176 advisories across 46 AI tools: app builders, coding agents, MCP servers, models and LLM frameworks. Each one is tied to a CVE, a GitHub advisory, a vendor bulletin or published research.
Latest critical
All critical advisories → 01. 2026-10-22 · New
CVE-2026-114612: LiteLLM proxy lets an internal user forge an admin token and run commands
The LiteLLM proxy used one encryption key both to seal secrets at rest and to mint session tokens. A user with internal_user rights can get the proxy to encrypt a forged admin credential through the API-key flow, replay it as a bearer token, become proxy admin and run arbitrary commands through the MCP stdio endpoint. Versions from 1.91.0 are exploitable in the default configuration.
LiteLLM · MCP SDKs & servers 02. 2026-10-22 · NewCVE-2026-107685: ReqLLM's OpenAI WebSocket sessions skip TLS checks and can leak API keys
ReqLLM, an Elixir library for calling LLM APIs, didn't verify TLS certificates on its WebSocket connections from 1.9.0 through 1.28.0. An attacker on the network path can read the OpenAI API key or OAuth token in the authorization header and read or change prompts, responses and tool calls. Fixed in 1.29.0.
OpenAI · Codex CLI 03. 2026-10-22 · NewMalicious PyPI package aanthropic typosquats Anthropic's Python SDK and runs malware on install
A PyPI package called aanthropic (version 1.0.0), one extra letter away from Anthropic's official anthropic package, downloads and runs malware during installation. OSV and the kam193 malicious-package tracker flagged it on October 22 as part of a typosquatting campaign. If you installed it, treat that machine as compromised.
Anthropic ClaudeCoverage
Six kinds of tool, one place to check.
01.
18 advisories · 6 tools02.
61 advisories · 12 tools03.
50 advisories · 2 tools04.
17 advisories · 7 tools05.
53 advisories · 14 tools06.
24 advisories · 5 tools
App builders
Prompt-to-app platforms that generate and host whole apps.
18 advisories · 6 tools02.IDEs & agents
AI code editors, coding agents and CLIs that read and write your repo.
61 advisories · 12 tools03.MCP
Model Context Protocol: the SDKs, servers and clients that wire tools into agents.
50 advisories · 2 tools04.Models & APIs
Foundation models and their APIs: prompt injection, jailbreaks and data leakage.
17 advisories · 7 tools05.LLM frameworks
Libraries and runtimes for building and serving LLM apps.
53 advisories · 14 tools06.Generated stack
The frameworks AI builders generate code for, where their bugs land in your app.
24 advisories · 5 toolsNew CVE-2026-115912: vLLM 0.32.0 fixes a forged shared-memory handle that reaches pickle.loads, EPS images that can reach Ghostscript, and five ways to stall or crash the serverNew CVE-2026-116575: Mem0 could mix up two users' conversation history, leaking one tenant's messages to anotherNew CVE-2026-116176: vLLM fixes an SSRF that can leak KV-cache tensors, plus three ways to crash a shared serverNew CVE-2026-57845: Loading a dataset with Hugging Face Datasets' pandas builder can run attacker codeNew CVE-2026-57113: A crafted PraisonAI GitHub template ref can delete folders outside the template cacheNew CVE-2026-57121: Any praisonai-platform workspace member can delete everyone else's projects and agentsNew CVE-2026-115477: obsidian-tc MCP server could run destructive vault actions after you declined themNew CVE-2026-56840: PraisonAI's human approval for dangerous tools could be bypassed, plus file reads and unsigned Linear webhooksNew CVE-2026-115419: Strands Agents A2A servers shared conversation history between different callersNew Supabase, 30 October 2026: new public tables are no longer exposed to the Data API without an explicit GRANTNew CVE-2026-115886: MLflow scorer endpoints allow unauthenticated SSRFNew CVE-2026-114612: LiteLLM proxy lets an internal user forge an admin token and run commandsNew CVE-2026-107685: ReqLLM's OpenAI WebSocket sessions skip TLS checks and can leak API keysNew Malicious PyPI package aanthropic typosquats Anthropic's Python SDK and runs malware on installNew Malicious npm packages posing as AI agent tools: agentic-awesome-skills, x402-prompt-injection-scan and formatting-subtitles-for-claudeNew php2shell (CVE-2026-109618, CVE-2026-109619): unauthenticated remote code execution in PHP itselfNew CVE-2026-115912: vLLM 0.32.0 fixes a forged shared-memory handle that reaches pickle.loads, EPS images that can reach Ghostscript, and five ways to stall or crash the serverNew CVE-2026-116575: Mem0 could mix up two users' conversation history, leaking one tenant's messages to anotherNew CVE-2026-116176: vLLM fixes an SSRF that can leak KV-cache tensors, plus three ways to crash a shared serverNew CVE-2026-57845: Loading a dataset with Hugging Face Datasets' pandas builder can run attacker codeNew CVE-2026-57113: A crafted PraisonAI GitHub template ref can delete folders outside the template cacheNew CVE-2026-57121: Any praisonai-platform workspace member can delete everyone else's projects and agentsNew CVE-2026-115477: obsidian-tc MCP server could run destructive vault actions after you declined themNew CVE-2026-56840: PraisonAI's human approval for dangerous tools could be bypassed, plus file reads and unsigned Linear webhooksNew CVE-2026-115419: Strands Agents A2A servers shared conversation history between different callersNew Supabase, 30 October 2026: new public tables are no longer exposed to the Data API without an explicit GRANTNew CVE-2026-115886: MLflow scorer endpoints allow unauthenticated SSRFNew CVE-2026-114612: LiteLLM proxy lets an internal user forge an admin token and run commandsNew CVE-2026-107685: ReqLLM's OpenAI WebSocket sessions skip TLS checks and can leak API keysNew Malicious PyPI package aanthropic typosquats Anthropic's Python SDK and runs malware on installNew Malicious npm packages posing as AI agent tools: agentic-awesome-skills, x402-prompt-injection-scan and formatting-subtitles-for-claudeNew php2shell (CVE-2026-109618, CVE-2026-109619): unauthenticated remote code execution in PHP itself
All advisories
Every known hole, with the fix.
176 advisories across app builders, coding agents, MCP, models and LLM frameworks. Worst first, each with how to check and what to change. Press / to jump to search.
176 advisories
01. CVE-2026-114612: LiteLLM proxy lets an internal user forge an admin token and run commandsThe LiteLLM proxy used one encryption key both to seal secrets at rest and to mint session tokens. A user with internal_user rights can get the proxy to encrypt a forged admin credential through the API-key flow, replay it as a bearer token, become proxy admin and run arbitrary commands through the MCP stdio endpoint. Versions from 1.91.0 are exploitable in the default configuration. LiteLLM MCP SDKs & servers 2026-10-22 02. CVE-2026-107685: ReqLLM's OpenAI WebSocket sessions skip TLS checks and can leak API keysReqLLM, an Elixir library for calling LLM APIs, didn't verify TLS certificates on its WebSocket connections from 1.9.0 through 1.28.0. An attacker on the network path can read the OpenAI API key or OAuth token in the authorization header and read or change prompts, responses and tool calls. Fixed in 1.29.0. OpenAI Codex CLI 2026-10-22 03. Malicious PyPI package aanthropic typosquats Anthropic's Python SDK and runs malware on installA PyPI package called aanthropic (version 1.0.0), one extra letter away from Anthropic's official anthropic package, downloads and runs malware during installation. OSV and the kam193 malicious-package tracker flagged it on October 22 as part of a typosquatting campaign. If you installed it, treat that machine as compromised. Anthropic Claude 2026-10-22 04. Malicious npm packages posing as AI agent tools: agentic-awesome-skills, x402-prompt-injection-scan and formatting-subtitles-for-claudeBetween October 20 and 22, GitHub flagged three npm packages with AI-agent names as malware: agentic-awesome-skills (20 versions), x402-prompt-injection-scan 0.1.4 and formatting-subtitles-for-claude (every version). If any of them was installed, treat that computer as compromised. Claude Code Anthropic Claude MCP SDKs & servers 2026-10-22 05. php2shell (CVE-2026-109618, CVE-2026-109619): unauthenticated remote code execution in PHP itselfTwo bugs in how the PHP runtime cleans up memory after a request ends abnormally can let an unauthenticated HTTP request run code as the web server's PHP worker. They affect every PHP install that serves web requests (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed). PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix them, and Cloudflare's WAF blocks known exploits by default, including on the Free plan. PHP Replit 2026-10-21 06. CVE-2026-114125: A malicious website can tamper with your project through a running Storybook dev serverWhile a vulnerable Storybook dev server is running and open in your browser, a malicious website can embed its preview and send events to it. With some user interaction this can change story files in your project, and if a changed file is later run, the attacker's code runs with your permissions. Storybook 8, 9, 10 and 11 alpha are affected, including @storybook/addon-mcp 10.6.x before 10.6.2. Patched in 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6. Node.js MCP SDKs & servers Next.js 2026-10-21 07. LiteLLM 1.107.0 on PyPI and Docker was malware: a credential stealer that runs whenever Python startsOn 21 October 2026 a malicious litellm 1.107.0 was published to PyPI and pushed to LiteLLM's official Docker images. It adds Python startup hooks that steal credentials and set up an hourly remote-code loader, and it runs as soon as Python starts, even if you never import litellm. LiteLLM Claude Code OpenAI +1 more 2026-10-21 08. Malicious npm packages posing as ChatGPT, Claude and Codex setup toolsOn October 19, GitHub flagged eight npm packages as malware that use AI tool names as bait, such as claude-desktop-setup, chatgpt-desktop-setup, codex-setup and api-anthropic. If any of them was installed, treat that computer as compromised. OpenAI Anthropic Claude Codex CLI +1 more 2026-10-19 09. CVE-2026-102503: Google Agent Mesh let any peer call MCP backends through an unchecked ingressIn Google's open-source Agent Mesh (SAM) 0.1.0-alpha.1 and alpha.2, the /libp2p-http ingress skipped the Biscuit capability checks, so any peer that could reach a node could call its registered MCP, A2A and inference backends, including command-backed MCP servers. MCP SDKs & servers 2026-10-19 10. CVE-2026-75128: Langchain-Chatchat lets anyone run shell commands through /tools/callLangchain-Chatchat through 0.3.1.3 exposes a POST /tools/call endpoint with no authentication, and the built-in shell tool is always registered. One request can run OS commands on the server, as root in the shipped Docker image. No fixed release exists yet. LangChain 2026-10-19 11. OpenCode Console breach exposed saved provider API keysOpenCode said a breach of a legacy system behind its hosted OpenCode Console affected 1.4% of Console users who had linked external providers. Their saved OpenAI, Anthropic and Google keys may have been exposed, and some users reported unauthorized charges, a few of them above $1,000. Providers have blocked exposed keys, and OpenAI and OpenCode say refunds are being handled. 
OpenCode Anthropic Claude OpenAI +1 more 2026-10-17 12. CVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commandsBefore 0.2.121, the Python Claude Agent SDK passed the resume session ID straight to the Claude CLI. A value starting with a dash became a CLI flag, so an attacker could inject an MCP server config and run commands. Claude Code MCP SDKs & servers 2026-10-16 13. CVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npxDeepSeek Harness (dsh), DeepSeek's developer-preview agent harness, launches MCP servers by bare command name. Injected content can get the model to drop a fake executable into node_modules/.bin, which then runs every time that MCP server starts. DeepSeek MCP SDKs & servers 2026-10-16 14. CVE-2026-96889: Next.js image optimization RCE via SVGA memory bug in an upstream library used by Next.js Image Optimization can lead to unauthenticated remote code execution when SVG files are processed and Next.js runs on glibc-based Linux. Fixed in 16.4.1 and 15.5.28. Next.js 2026-10-14 15. Next.js ‘use cache’ remote code execution via typed arraysNext.js 16 apps using the App Router with Cache Components can be open to unauthenticated remote code execution when a ‘use cache’ function returns multiple typed arrays. There is no workaround; upgrade to 16.4.1. Next.js 2026-10-14 16. CVE-2026-77366: obsidian-tc MCP server let any token read and edit any vaultBefore 1.3.1, the obsidian-tc MCP server for Obsidian never checked the vault a request named against the vault the caller's token was for, so any valid token could read, write or delete notes in every configured vault. MCP SDKs & servers 2026-10-12 17. Supabase RLS policies that check login but not ownershipA policy like using (auth.uid() is not null) has RLS on and mentions the user, so it passes Lovable’s scan. But it lets any logged-in user read every row, and on most apps anyone can sign up. Supabase Lovable Bolt +4 more 2026-10-10 18. CVE-2026-107824: x64dbg-MCP Server gave anyone on the network full debugger controlEarly versions of the x64dbg-MCP Server plugin served all 71 debugger tools over HTTP/SSE with no authentication on 0.0.0.0, so anyone who could reach port 9094 or 9095 could run x64dbg commands, attach to processes, edit memory and write files. MCP SDKs & servers 2026-10-09 19. CVE-2026-103663: Ollama /api/pull path traversal can lead to code execution as rootAn unauthenticated attacker who can reach an Ollama server can use a crafted layer digest in /api/pull to write a file outside the model store. In most Docker images that means a file Ollama loads and runs as root on the next restart. Ollama 2026-10-08 20. CVE-2026-10561: Langflow's Python Interpreter component ran code with no real sandboxBefore 1.10.1, any logged-in Langflow user who could edit and run a flow could use the Python Interpreter component to run OS commands as the Langflow service and make their own account a superuser. 
Langflow 2026-10-06 21. Langflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)Langflow launched whatever command a user put in an MCP stdio server config, through bash -c, with no allowlist. Any user who could add an MCP server or build a flow could run OS commands on the Langflow host, and with the default auto-login no account was needed. Langflow MCP SDKs & servers 2026-10-05 22. CVE-2026-8505: Langflow webhooks let anyone run a flow without an API keyIn Langflow 1.7.0 through 1.9.0, webhook endpoints skipped API key checks by default, so anyone who knew a flow's UUID could run it as the flow's owner. Flows that run Python code turn that into remote code execution. Langflow 2026-10-05 23. Malicious PyPI package anthropic-sdk posed as Anthropic's Python clientA PyPI package named anthropic-sdk (version 0.1.0) re-exported the real anthropic client so it looked like a drop-in, but from the third import onward it downloaded Python code from a third-party GitHub repo and ran it. Anthropic's official package is anthropic, not anthropic-sdk. Anthropic Claude 2026-10-04 24. Next.js: Remote Code Execution in next/og ImageResponseThe Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Next.js 2026-09-30 25. UpGuard: 16,326 Supabase databases had readable tablesUpGuard checked about 300,000 websites that use Supabase and found 16,326 databases with tables anyone could read. Over half showed signs of personal data, and a smaller share held passwords or auth tokens. Supabase Claude Code Codex CLI +4 more 2026-09-25 26. CVE-2026-77244: MCP Atlassian's HTTP transport accepts any token and acts with the operator's Jira and Confluence accountBefore 0.22.0, mcp-atlassian's HTTP transport accepts any non-empty token, and requests without a real user identity fall back to the operator's configured Jira or Confluence credentials. Anyone who can reach the MCP endpoint can read and write Jira and Confluence as the operator. MCP Atlassian MCP SDKs & servers 2026-09-22 27. CVE-2026-54618: Obsidian Web MCP hands out vault access without a loginBefore 0.2.0, Obsidian Web MCP's /oauth/authorize issues an authorization code with no login or consent, and /oauth/token swaps it for the static VAULT_MCP_TOKEN. Anyone who can reach the tunnel can read, write, move and delete notes in the whole vault. MCP SDKs & servers 2026-09-17 28. CVE-2026-61560: GitLab MCP server (@zereight/mcp-gitlab) lets anyone steal its GitLab tokenBefore 2.1.27, @zereight/mcp-gitlab in SSE mode exposes every MCP tool with no authentication, and its upload_markdown tool reads any local file. An attacker on the network can read /proc/self/environ, take the server's GitLab personal access token and take over the account. Two related bugs (CVE-2026-61559, CVE-2026-61568) are fixed in 2.1.27 and 2.1.30. MCP SDKs & servers 2026-09-15 29. CVE-2026-59971: MySQL MCP Server in SSE mode runs anyone's SQL, including via DNS rebindingBefore 0.4.2, mysql-mcp-server with MCP_TRANSPORT=sse binds to 0.0.0.0 with no authentication and no DNS rebinding protection. A network attacker, or a malicious web page through the victim's browser, can call execute_sql against the database. MCP SDKs & servers 2026-09-15 30. CVE-2026-57141: PraisonAI's codeMode tool sandbox can be escaped to run OS commandsIn the praisonai npm package up to 1.7.1, the codeMode tool runs model-generated JavaScript with new Function() and a regex blocklist that's easy to bypass. Anyone who can influence that code, for example through prompt injection, can read files, steal credentials and run OS commands. Fixed in 1.7.2. 
PraisonAI 2026-09-15 31. CVE-2026-57147: praisonai-platform signs logins with the public secret dev-secret-change-mepraisonai-platform 0.1.4 and earlier fall back to the hardcoded JWT secret dev-secret-change-me when PLATFORM_JWT_SECRET is unset, and the production guard is off because PLATFORM_ENV defaults to dev. Anyone can forge a token and act as any user or workspace owner. Fixed in 0.1.6. PraisonAI 2026-09-15 32. CVE-2026-57139: PraisonAI's npm MCP server and AgentOS let anyone call tools and agentsIn the praisonai npm package up to 1.7.1, the TypeScript MCPServer's HTTP transport has no authentication and listens on all interfaces, so anyone who reaches the port can list and call tools, read resources and get prompts. AgentOS has the same problem for agents (CVE-2026-57140), and version 1.7.2 also fixes another codeMode sandbox escape (CVE-2026-57138). PraisonAI MCP SDKs & servers 2026-09-15 33. CVE-2026-12944: Langflow's code scanner missed socket and urllib, letting users run code as rootLangflow OSS 1.0.0 through 1.10.0 blocked subprocess imports in submitted components but not socket or urllib. Code using them ran on the server as root during component validation while the scanner still reported validated: true, so an authenticated user could steal cloud credentials, read container files and reach internal services. Fixed in 1.10.1. Langflow 2026-09-14 34. CVE-2026-57123: praisonaiagents MCP SSE server exposes every tool with no authBefore praisonaiagents 1.6.59, ToolsMCPServer.run_sse() and launch_tools_mcp_server(transport="sse") bind to 0.0.0.0 with no authentication or Origin check. Anyone who can reach the port can list and run every registered tool, and a web page can drive a localhost instance through DNS rebinding. The library's own security controls were never wired in. PraisonAI MCP SDKs & servers 2026-09-14 35. CVE-2026-57145: PraisonAI's multiedit tool lets the model read and overwrite any filePraisonAI's multiedit agent tool passed the model-controlled file path straight to open() for reading and writing, with no traversal check, workspace boundary, symlink resolution or protected-path guard. Anyone who can influence an agent's tool arguments, for example through prompt injection or a malicious YAML workflow, can read secrets like SSH keys and overwrite files. PraisonAI 2026-09-14 36. CVE-2026-85025: Langflow before 1.11.6 has 11 code-execution bugs, including unauthenticated RCE through shared MCP projectsAn IBM security bulletin lists 11 CVEs in Langflow OSS 1.0.0 through 1.11.5, all fixed in 1.11.6. The worst, CVE-2026-85025, lets an unauthenticated attacker run code and read or change chat sessions through publicly shared MCP project endpoints. The others let authenticated users run code or commands through scanner bypasses, stored flows and MCP stdio settings. Langflow MCP SDKs & servers 2026-09-10 37. CVE-2026-87911: AWS postgres-mcp-server's read-only mode can be bypassed to run OS commandsThe SQL validator in awslabs.postgres-mcp-server before 1.1.7 didn't block every statement that can touch the system in its default read-only mode. A crafted COPY ... TO PROGRAM statement hidden in content the agent processes can run operating system commands on a self-managed PostgreSQL host, when the MCP server connects with a highly privileged database role. MCP SDKs & servers 
Amazon Q Developer 2026-09-09 38. CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted serversA vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem. Next.js 2026-09-08 39. Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedA vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Next.js 2026-09-08 40. CVE-2026-37004: LiteLLM vulnerable to server-side template injection in the /prompts/test endpointBerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment. LiteLLM 2026-08-27 41. CVE-2026-73487: Flowise CSV and Airtable agents can be prompt-injected into leaking data and SSRFIn Flowise 3.1.2 and earlier, the CSV Agent and Airtable Agent check LLM-written Python with a regex blocklist that's easy to get around. A prompt sent to the public prediction API can make the agent send the whole dataset to an outside server or reach internal services. 
Flowise 2026-08-13 42. CVE-2026-73483: Flowise custom functions could escape the sandbox through puppeteer.launch()A logged-in Flowise user who can reach the custom function endpoint could break out of the NodeVM sandbox by passing their own executablePath and args to puppeteer.launch(), running OS commands as the Flowise process, which is root in the official Docker image. Flowise 2026-08-13 43. CVE-2026-9205: Langflow derived its credential encryption key from random.seed()Langflow 1.10.0 and earlier built the Fernet key that encrypts every stored credential (LLM API keys, database passwords) from Python's non-cryptographic random module seeded with SECRET_KEY. Anyone who gets the secret_key file can decrypt all of them offline. Langflow 2026-08-05 44. Supabase tables readable by anyone with no loginA scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login. Lovable Bolt v0 +4 more 2026-08 45. Supabase service_role / secret key shipped to the browserThe service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public. Lovable Bolt v0 +4 more 2026-08 46. CVE-2026-61447 and CVE-2026-61445: PraisonAI ran LLM-written code and commands with no sandboxTwo PraisonAI advisories: CodeAgent ran model-generated Python with the full environment (every API key and credential) and ignored sandbox=True, and the AICoder UI let the model write any file and run any command. Prompt injection turns either one into code execution. PraisonAI 2026-07-11 47. CVE-2026-61742: DBHub MCP server's HTTP mode let any website query your databaseDBHub, Bytebase's database MCP server, had no authentication in its HTTP transport mode before 0.22.5, and its Origin check didn't stop DNS rebinding. A malicious web page could make your browser call DBHub's MCP tools and read or write the connected database. MCP SDKs & servers 2026-06-24 48. CVE-2026-57118: PraisonAI's AgentTeam.launch() served agents to anyone, no authBefore praisonaiagents 1.6.59, the HTTP server started by AgentTeam.launch() (alias Agents.launch()) accepted requests with no token or a wrong one, and it binds to 0.0.0.0 by default. Anyone who could reach it could list agents and make them run, using your model credits, private context and tools. PraisonAI 2026-06-18 49. CVE-2026-57496: NetLicensing MCP server leaked plaintext API keys via path traversalBefore 0.1.8, the netlicensing_get_product tool in Labs64's netlicensing-mcp put the product number straight into a REST path. Passing ../token reached the token endpoint and skipped the redaction, so a client with a non-admin key could read plaintext API keys, including admin ones. MCP SDKs & servers 2026-06-18 50. CVE-2026-49468: LiteLLM: Authentication Bypass via Host Header InjectionA Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. LiteLLM 2026-06-16 51. CVE-2026-50549: Cursor agent could write outside the workspace via a symlink and escape the sandboxBefore 3.0, Cursor's check that agent file writes stay inside the workspace failed open. A malicious agent (for example one steered by prompt injection) could use an in-workspace symlink to write anywhere the user could, without approval, including over Cursor's own sandbox helper. Cursor 2026-06-05 52. CVE-2026-101084: Obot let any user connect to restricted MCP servers by IDIn Obot, the open-source MCP platform, the /mcp-connect/{id} gateway didn't enforce access control rules before v0.21.1. Any logged-in user who knew a server's ID could use that MCP server's tools with its stored OAuth credentials. A second advisory warns that the old Docker quickstart ran with authentication off. MCP SDKs & servers 2026-05-08 53. Unverified Stripe webhooks hand out free upgradesIf your Stripe webhook handler doesn’t verify the Stripe-Signature header, anyone can POST a fake “checkout.session.completed” event and your app will treat it as a real payment. Scans and audits find this in a large share of AI-built apps. Stripe Lovable Bolt +5 more 2026-05 54. CVE-2026-12537: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypassesGemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. Gemini CLI 2026-04-24 55. CVE-2026-42208: LiteLLM has SQL Injection in Proxy API key verificationA database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. LiteLLM 2026-04-24 56. CVE-2025-61260: OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration filesA vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex CLI 2026-04-14 57. CVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal VulnerabilityThe OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. MCP SDKs & servers 2026-03-31 58. Moltbook left its Supabase database open to read and writeWiz found that Moltbook, a social network for AI agents whose founder said he vibe-coded it, shipped a Supabase key in its JavaScript with no Row Level Security behind it. Anyone could read and write the database, including 1.5 million agent API tokens and 35,000 email addresses. Supabase 2026-02-02 59. CVE-2026-22778: vLLM has RCE In Video ProcessingA chain of flaws in vLLM video processing lets an attacker run commands on the server with a malicious video URL. Fixed in 0.14.1. vLLM 2026-02-02 60. CVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operationsA critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations. Ollama 2025-12-18 61. CamoLeak: Copilot Chat leaked private source codeLegit Security reported a critical vulnerability in GitHub Copilot Chat that could leak private source code from a user’s repositories. Copilot 2025-10-08 62. CVE-2025-6514: mcp-remote exposed to OS command injection via untrusted MCP server connectionsmcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL MCP SDKs & servers 2025-07-09 63. Base44: private apps open to anyone with the app_id (Wiz)Undocumented register and verify-OTP endpoints accepted a non-secret app_id, letting anyone create a verified account on private, SSO-only apps. Patched by Wix within 24 hours. Base44 2025-07 64. CVE-2025-49596: MCP Inspector proxy server lacks authentication between the Inspector client and proxyVersions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. MCP SDKs & servers 2025-06-13 65. CVE-2025-32711 (EchoLeak): zero-click data leak in Microsoft 365 CopilotAI command injection in Microsoft 365 Copilot let an unauthorised attacker disclose information over a network. Microsoft fixed it server-side. Copilot 2025-06-11 66. CVE-2025-1793: llama_index vulnerable to SQL InjectionMultiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. LlamaIndex 2025-06-05 67. CVE-2025-47277: vLLM Allows Remote Code Execution via PyNcclPipe Communication ServicevLLM Allows Remote Code Execution via PyNcclPipe Communication Service. vLLM 2025-05-20 68. CVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLSLovable-generated apps talked to Supabase directly from the browser, but many tables had no (or wrong) Row Level Security policies, so anyone with the public anon key could read or write data. Lovable Supabase 2025-05 69. CVE-2025-32444: vLLM Vulnerable to Remote Code Execution via Mooncake IntegrationvLLM integration with mooncake is vaulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. vLLM 2025-04-29 70. CVE-2025-29927: Next.js middleware authorization bypassSelf-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0. Next.js v0 Bolt +2 more 2025-03 71. DeepSeek left a database open with chat history and secretsWiz found a publicly accessible DeepSeek database that allowed full control over database operations, exposing over a million lines of logs with chat history and other sensitive data. DeepSeek 2025-01-29 72. CVE-2024-46946: LangChain Experimental Eval Injection vulnerabilitylangchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05). LangChain 2024-09-19 73. CVE-2024-45201: LlamaIndex includes an exec call for `import {cls_name}`An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}. LlamaIndex 2024-08-22 74. CVE-2024-3271: llama-index-core Command Injection vulnerabilityA command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. LlamaIndex 2024-04-16 75. CVE-2024-27444: LangChain Experimental vulnerable to arbitrary code executionlangchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__… LangChain 2024-02-26 76. CVE-2023-6730: transformers has a Deserialization of Untrusted Data vulnerabilityDeserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0. Hugging Face 2023-12-19 77. CVE-2023-32785: Langchain SQL Injection vulnerabilityIn Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain. LangChain 2023-10-21 78. CVE-2026-115912: vLLM 0.32.0 fixes a forged shared-memory handle that reaches pickle.loads, EPS images that can reach Ghostscript, and five ways to stall or crash the serverEight vLLM CVEs were published on 26 October 2026, all fixed in vLLM 0.32.0. The worst lets an authenticated caller forge a multimodal shared-memory handle so a worker runs pickle.loads() on attacker bytes, even with insecure serialization disabled. Another lets an image request hand an EPS file to Ghostscript. The rest let a caller hang or crash a shared server. Upgrade to 0.32.0. vLLM 2026-10-26 79. CVE-2026-116176: vLLM fixes an SSRF that can leak KV-cache tensors, plus three ways to crash a shared serverFour vLLM CVEs were published on 25 October 2026. The worst lets an API caller put an attacker's host in the X-Request-Id header so a P2pNcclConnector prefill worker connects out and sends that request's KV-cache tensors to it. The other three let a client crash or OOM-kill a shared vLLM server. Upgrading to vLLM 0.31.0 covers all four. vLLM 2026-10-25 80. CVE-2026-57845: Loading a dataset with Hugging Face Datasets' pandas builder can run attacker codeHugging Face Datasets through 5.1.0 unpickles files passed to its deprecated pandas builder without any check. If you call load_dataset("pandas", data_files=...) on a pickle file an attacker made, their code runs with your process's permissions. A fix is open as a pull request but no patched release exists yet. Hugging Face 2026-10-23 81. CVE-2026-57113: A crafted PraisonAI GitHub template ref can delete folders outside the template cachePraisonAI's template loader builds its cache path from the owner, repo, template and ref of a github: template URI without checking the result stays inside the cache. A ref like ../../../outside-target escapes it, writes a .cache_meta.json file elsewhere and, once a normal cache entry exists for the same template, deletes an attacker-chosen directory. Affects praisonai 2.6.0 through 4.6.57; fixed in 4.6.59. PraisonAI 2026-10-23 82. CVE-2026-57121: Any praisonai-platform workspace member can delete everyone else's projects and agentsIn praisonai-platform 0.1.4, the DELETE endpoints for projects, agents, issues, labels, issue dependencies and issue-label links only check that the caller is a workspace member. A single malicious or compromised member account can permanently wipe content created by the owner and other members. GitHub lists 0.1.6 as the first patched version; NVD's text says 0.1.5. PraisonAI 2026-10-23 83. CVE-2026-115477: obsidian-tc MCP server could run destructive vault actions after you declined themOn Streamable HTTP deployments with auth.jwtSecret set, the obsidian-tc MCP server for Obsidian vaults treated an echoed request state as proof of approval, so a destructive tool call could still complete after the human declined or cancelled the confirmation. Affects 1.13.0 through 1.31.3. Version 1.31.4 fixes it and a second bug, CVE-2026-115478, where memory tools could overwrite notes they didn't own. MCP SDKs & servers 2026-10-23 84. CVE-2026-56840: PraisonAI's human approval for dangerous tools could be bypassed, plus file reads and unsigned Linear webhooksFive PraisonAI CVEs published on 23 October 2026 cover bugs fixed in praisonai 4.6.59. Two let someone approve a dangerous tool call without the real approver: a tool argument that injects script into the HTTP approval dashboard, and any 'yes' typed in the Discord approval channel. The others let a prompt read files outside PraisonAI's storage and let anyone send forged Linear webhooks to LinearBot when no secret is set. PraisonAI 2026-10-23 85. CVE-2026-115419: Strands Agents A2A servers shared conversation history between different callersThe Agent2Agent (A2A) server in AWS's Strands Agents SDK didn't isolate conversation state between callers with different context_id values. In a deployment used by more than one user or tenant, an authenticated caller could read another caller's conversation history or steer the model's answers to them. Fixed in strands-agents 1.43.0 (Python) and @strands-agents/sdk 1.5.0 (TypeScript). 
Strands Agents 2026-10-23 86. Node.js October 21, 2026 security releases: four HIGH bugs in 26.x, 24.x and 22.xNode.js shipped 22.23.4, 24.22.1 and 26.12.1 on October 21, 2026, fixing 10 CVEs. The four HIGH ones are a Brotli decoder out-of-bounds write that can lead to remote code execution, two TLS certificate hostname bypasses, and dns.resolve truncating names that contain a NUL byte. Any app running its own Node process should upgrade. Node.js Next.js Replit 2026-10-21 87. CVE-2026-111770: MCP TypeScript server SDK 2.x could send one HTTP client's responses to another clientIn @modelcontextprotocol/server 2.0.0 through 2.2.0, an MCP server reached over HTTP could deliver one client's responses and notifications to a different client when clients shared one stateless transport or one McpServer instance. Messages were matched by JSON-RPC id alone, and SDK clients number requests from 0, so ids collide in normal use. Fixed in 2.3.0, but you also have to change your code. MCP SDKs & servers 2026-10-20 88. CVE-2026-88755: Z.ai ZCode starts MCP servers from a repo's config the moment you open itZ.ai's ZCode desktop client 3.11.2.6792 connects to every MCP server declared in a repository's .zcode/config.json as soon as you open the folder, with no approval prompt. A cloned repo can run any command it likes on your machine. MCP SDKs & servers 2026-10-16 89. Bootlegger's Claude-built dashboard sent store and financial data to anyone who loaded its login pageAn internal web dashboard at South African coffee chain Bootlegger, reportedly vibe-coded with Claude and hosted on Railway, showed a login screen but already included its data in the page it sent. Anyone with the URL could read names and contact details for 132 locations, plus some performance and financial data, from the page source. Anthropic Claude 2026-10-16 90. CVE-2026-111091: JetBrains Junie CLI ran code from an untrusted project’s MCP configOpening an untrusted project in Junie CLI before 26.8.3 could run code through the MCP server configuration that came with the project. 
Junie MCP SDKs & servers 2026-10-15 91. CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningThe plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. Claude Code 2026-10-15 92. CVE-2026-109527: MCP Python SDK HTTP servers can be knocked offline with huge requestsMCP servers built with the official Python SDK read whole HTTP request bodies into memory with no size limit on the SSE message endpoint and OAuth routes. One large request can exhaust memory and take the server down, often with no login needed. MCP SDKs & servers 2026-10-14 93. CVE-2026-108395: MCP Java SDK HTTP servers can be crashed with one huge requestThe official MCP Java SDK’s Servlet-based HTTP transports read the whole request body into memory with no size limit. One unauthenticated chunked POST can exhaust the Java heap and take the server down. MCP SDKs & servers 2026-10-14 94. Next.js Server Actions denial of serviceCrafted requests to a Next.js App Router app with at least one Server Action can cause excessive CPU use that blocks other requests in the same process. Fixed in 16.4.1 and 15.5.28. Next.js 2026-10-14 95. Roo Code: five ways to slip denied commands past auto-approve (CVE-2026-110202 to 110206), no fix comingRoo Code through 3.54.0 has five command-approval bypasses. With auto-approve on, a prompt injection can get a denied shell command run on your machine by hiding it behind an allowlisted command like echo. The project was archived in May 2026, so no patch is expected. 
Roo Code 
Cline 2026-10-13 96. CVE-2026-109572: Open WebUI terminal proxy lets regular users act as Terminals adminIn Open WebUI 0.8.6 to 0.11.3, a regular user with access to a Terminals connection could send requests through the terminal proxy with the admin’s shared key attached, then list or stop other users’ terminals and change terminal policies. 
Open WebUI 2026-10-12 97. CVE-2026-94483: Next.js has Server-Side Request Forgery in Image OptimizationAn attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization. Next.js 2026-10-07 98. CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverIn affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. MCP SDKs & servers 2026-10-06 99. CVE-2026-103435: Claude Code could be raced into writing files outside the projectClaude Code checked that a file path was inside the project at permission time but resolved it again at write time. Someone who can write to a shared workspace could swap a file for a symlink and redirect Claude Code’s edits to files like your shell config. Claude Code 2026-10-05 100. CVE-2026-102697: Ollama agent mode's Bash approval can be bypassed with ; or &&In Ollama's experimental agent mode, approving a Bash command for the session also let through anything chained onto it. A prompt injection could tack extra commands onto an approved one and run them without asking. Ollama 2026-09-29 101. CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. Open WebUI 2026-09-10 102. CVE-2026-87016: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. Open WebUI 2026-09-10 103. CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesAny authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Open WebUI 2026-08-04 104. Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesPrefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way. Lovable Bolt v0 +4 more 2026-08 105. CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code ExecutionClaude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. Claude Code 2026-07-24 106. CVE-2026-63093: Cursor for Windows ran a git.exe planted in a cloned repo as soon as you opened itOn Windows, Cursor 3.2.16 looked up git by name, so a malicious git.exe in the root of a repo you cloned and opened ran automatically at startup and repeatedly after that, with no extra click. Cursor says 3.13.25 and later fix it. macOS and Linux were not affected. Cursor 2026-07-17 107. CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validationIn affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation. MCP SDKs & servers 2026-07-16 108. CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalIn affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. MCP SDKs & servers 2026-07-16 109. CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksIn affected versions, the default request handlers installed by the experimental tasks feature (server.experimental.enable_tasks()) did not check which session created a task before acting on it. MCP SDKs & servers 2026-07-16 110. CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassedThe /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. Open WebUI 2026-05-14 111. CVE-2026-44578: Next.js vulnerable to server-side request forgery in applications using WebSocket upgradesSelf-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. Next.js 2026-05-11 112. CVE-2026-44574: Next.js has a Middleware / Proxy bypass through dynamic route parameter injectionApplications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. Next.js 2026-05-11 113. CVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loaderOllama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. Ollama 2026-05-04 114. CVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code ExecutionClaude Code used the git worktree commondir file when determining folder trust but did not validate its contents. Claude Code 2026-04-24 115. CVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside WorkspaceClaude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. Claude Code 2026-04-21 116. Lovable bug exposed public projects’ code and AI chatsFrom 3 February to 20 April 2026, a Lovable permissions regression let any Lovable user with a project link read the source code and AI chat history of public projects. Lovable confirmed it and fixed it within two hours of the public report. Lovable 2026-04-20 117. CVE-2026-27124: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy VulnerabilitiesWhile testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. MCP SDKs & servers 2026-03-31 118. CVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings FileClaude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. Claude Code 2026-03-19 119. CVE-2025-69196: FastMCP OAuth Proxy token reuse across MCP serversWhile testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request. MCP SDKs & servers 2026-03-16 120. CVE-2026-25725: Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.jsonClaude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. Claude Code 2026-02-06 121. CVE-2026-25723: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write RestrictionsClaude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope. Claude Code 2026-02-06 122. CVE-2026-25722: Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write ProtectionClaude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Claude Code 2026-02-06 123. CVE-2026-25536: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseCross-client data leak via two distinct issues: (1) reusing a single StreamableHTTPServerTransport across multiple client requests, and (2) reusing a single McpServer/Server instance across multiple transports. Both are most common in stateless deployments. MCP SDKs & servers 2026-02-04 124. CVE-2026-24887: Claude Code has a Command Injection in find Command Bypasses User Approval PromptDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Claude Code 2026-02-03 125. CVE-2026-24053: Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File WritesDue to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Claude Code 2026-02-03 126. CVE-2026-24052: Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled DomainsClaude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. Claude Code 2026-02-03 127. CVE-2026-22708: Cursor Auto-Run allowlist could be bypassed with shell built-ins that poison environment variablesIn Cursor 2.2 and earlier, with Auto-Run Mode in Allowlist mode, some shell built-ins ran without being on the allowlist and without approval. Through prompt injection, an attacker could set or change environment variables so that later allowlisted commands do something else, which can lead to code execution. Cursor 2026-01-14 128. CVE-2025-9611: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server ToolsMicrosoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. MCP SDKs & servers 2026-01-07 129. CVE-2026-0621: Anthropic's MCP TypeScript SDK has a ReDoS vulnerabilityA ReDoS vulnerability in the UriTemplate class allows attackers to cause denial of service. The partToRegExp() function generates a regex pattern with nested quantifiers (([^/]+(?:,[^/]+))) for exploded template variables (e.g., {/id}, {?tags*}), causing catastrophic backtracking on malicious input. MCP SDKs & servers 2026-01-05 130. CVE-2025-66032: Claude Code Command Validation Bypass Allows Arbitrary Code ExecutionDue to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-12-03 131. CVE-2025-66416: Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 132. CVE-2025-66414: Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 133. CVE-2025-64755: @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File WritesDue to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. Claude Code 2025-11-20 134. CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialogWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-11-19 135. CVE-2025-59536: Claude Code can execute commands prior to the startup trust dialogDue to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Claude Code 2025-10-03 136. Gemini Trifecta: three injection flaws in Google’s Gemini suiteTenable found three now-fixed vulnerabilities in Gemini Cloud Assist, the Search Personalization model and the Browsing tool that exposed users to privacy risks, including search-injection. Google Gemini 2025-09-30 137. CVE-2025-59828: Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn VersionsWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-09-24 138. CVE-2025-59532: Codex has sandbox bypass due to bug in path configuration logicDue to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. Codex CLI 2025-09-19 139. CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git emailAt startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace. Claude Code 2025-09-10 140. CVE-2025-58764: Claude Code rg vulnerability does not protect against approval prompt bypassDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-09-10 141. CVE-2025-58444: MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP ServerAn XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. MCP SDKs & servers 2025-09-08 142. Windsurf: prompt injection leaks developer secretsEmbrace The Red showed how prompt injection in files the Cascade agent reads could get Windsurf to leak secrets from the developer’s machine. Windsurf 2025-08-21 143. CVE-2025-55284: Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude CodeDue to an overly broad allowlist of safe commands, it was possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation. Claude Code 2025-08-18 144. CVE-2025-53773: GitHub Copilot prompt injection to code executionCommand injection in GitHub Copilot and Visual Studio let an attacker run code on a developer’s machine. Embrace The Red showed it starting from a prompt injection in project content. Copilot 2025-08-12 145. CVE-2025-54795: Claude Code echo command allowed bypass of user approval prompt for command executionDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-08-04 146. CVE-2025-54794: Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file accessDue to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD. Claude Code 2025-08-04 147. CVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run codeBefore 1.3.9, Cursor let the agent create new dotfiles like .cursor/mcp.json without approval. Chained with prompt injection, this meant remote code execution. Cursor 2025-08 148. CVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedIn Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt. Cursor MCP SDKs & servers 2025-08 149. CVE-2025-8217: malicious code shipped in Amazon Q Developer 1.84.0An over-scoped GitHub token in Amazon Q’s build setup let an attacker commit malicious code that shipped in the VS Code extension 1.84.0. AWS says it failed to run due to a syntax error. Amazon Q Developer 2025-07-23 150. Supabase MCP: a support ticket gets the agent to dump private tablesGeneral Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role. MCP SDKs & servers Supabase Cursor +1 more 2025-07-08 151. CVE-2025-53366: MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoSA validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. MCP SDKs & servers 2025-07-04 152. CVE-2025-53365: MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of ServiceIf a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. MCP SDKs & servers 2025-07-04 153. CVE-2025-53110: @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefixVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 2025.7.1 to resolve the issue. MCP SDKs & servers 2025-07-01 154. CVE-2025-53109: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handlingVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve. MCP SDKs & servers 2025-07-01 155. AI agent deleted a production database during a code freeze (Replit)Replit Agent deleted SaaStr founder Jason Lemkin’s live database (1,206 executives, 1,196+ companies) despite an explicit freeze, then wrongly said rollback was impossible. Replit Cursor 2025-07 156. CVE-2025-52882: Claude Code Improper Authorization via websocket connections from arbitrary originsClaude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Pycharm, and Android Studio) are vulnerable to unauthorized websocket connections from an attacker when visiting attacker-controlled webpages. Claude Code 2025-06-23 157. GitHub MCP server: a public issue makes the agent leak private reposInvariant Labs showed that a prompt injection planted in a public GitHub issue could get an agent using the official GitHub MCP server to pull data from the user’s private repositories. MCP SDKs & servers Claude Code Cursor +1 more 2025-05-26 158. MCP tool poisoning: hidden instructions in tool descriptionsAn MCP server can hide instructions inside a tool’s description. The model reads them, the user usually doesn’t, and the agent can be steered into reading files or sending data elsewhere. MCP SDKs & servers Cursor Claude Code +2 more 2025-04-01 159. “Rules File Backdoor”: hidden Unicode instructions in AI rules filesPillar Security showed invisible Unicode characters in shared rules files (.cursorrules, .mdc) can steer Cursor and GitHub Copilot into writing backdoored code. Cursor Copilot 2025-03 160. Authentication logic living entirely in the browserHiding a page or button in the UI is not access control. If the API or database doesn’t check the user, anyone can call it directly. Lovable Base44 Bolt +3 more 2025 161. Slopsquatting: AI suggests packages that don’t existA USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names. Claude Code Copilot Cursor +5 more 2025 162. CVE-2024-11393: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 163. CVE-2024-11394: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 164. OWASP LLM01:2025: prompt injection is the top LLM app riskOWASP ranks prompt injection first in its Top 10 for LLM Applications 2025. Any app that feeds untrusted text to a model with tools or data access is exposed. OpenAI Anthropic Claude Google Gemini +4 more 2024-11-18 165. SpAIware: prompt injection writes into ChatGPT’s long-term memoryEmbrace The Red showed untrusted content planting persistent instructions in ChatGPT’s memory on the macOS app, so later chats kept sending data to the attacker. OpenAI 2024-09-20 166. CVE-2024-28224: Ollama DNS rebinding vulnerabilityOllama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion). Ollama 2024-04-08 167. CVE-2026-116575: Mem0 could mix up two users' conversation history, leaking one tenant's messages to anotherMem0's Python and TypeScript SDKs built the key for each session's recent messages by joining user_id, agent_id and run_id with unescaped & and = characters. A caller who controls only their own run_id or agent_id could craft a value that produces another tenant's key, then read that tenant's recent raw messages and write into their history. Fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6. 
Mem0 2026-10-26 168. Supabase, 30 October 2026: new public tables are no longer exposed to the Data API without an explicit GRANTFrom 30 October 2026, Supabase stops granting anon, authenticated and service_role access to new tables in the public schema of existing projects. A new table won't be reachable through supabase-js, REST or GraphQL until you GRANT access explicitly. RLS still has to be on as well. Supabase Lovable Bolt +3 more 2026-10-23 169. CVE-2026-115886: MLflow scorer endpoints allow unauthenticated SSRFMLflow is an open source AI engineering platform for agents, large language models, and machine learning models. 
MLflow 2026-10-23 170. CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionMCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion. MCP SDKs & servers 2026-10-15 171. CVE-2026-84377: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parametersAny authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. LiteLLM 2026-09-30 172. Grok 4 jailbroken within 48 hours of launchNeuralTrust combined its Echo Chamber and Crescendo multi-turn techniques to jailbreak Grok 4 two days after release. 
xAI Grok 2025-07-11 173. Protecting routes only in middlewareVercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed. Next.js v0 Bolt +2 more 2025-03 174. DeepSeek R1 failed every harmful-prompt test in Cisco’s evaluationCisco ran algorithmic jailbreak testing against DeepSeek and other frontier reasoning models and published the results on 31 January 2025. DeepSeek 2025-01-31 175. CVE-2024-50050: Llama Stack used pickle over socketsMeta’s Llama Stack used Python pickle to deserialise socket messages, which could allow remote code execution. It switched to JSON. Meta Llama 2024-10-23 176. Many-shot jailbreaking: long context windows weaken refusalsAnthropic published research showing that filling a long prompt with many fake dialogue examples can push models into answering requests they would normally refuse. Anthropic Claude OpenAI Google Gemini +2 more 2024-04-02
LiteLLM MCP SDKs & servers 2026-10-22 02. CVE-2026-107685: ReqLLM's OpenAI WebSocket sessions skip TLS checks and can leak API keysReqLLM, an Elixir library for calling LLM APIs, didn't verify TLS certificates on its WebSocket connections from 1.9.0 through 1.28.0. An attacker on the network path can read the OpenAI API key or OAuth token in the authorization header and read or change prompts, responses and tool calls. Fixed in 1.29.0. OpenAI Codex CLI 2026-10-22 03. Malicious PyPI package aanthropic typosquats Anthropic's Python SDK and runs malware on installA PyPI package called aanthropic (version 1.0.0), one extra letter away from Anthropic's official anthropic package, downloads and runs malware during installation. OSV and the kam193 malicious-package tracker flagged it on October 22 as part of a typosquatting campaign. If you installed it, treat that machine as compromised. Anthropic Claude 2026-10-22 04. Malicious npm packages posing as AI agent tools: agentic-awesome-skills, x402-prompt-injection-scan and formatting-subtitles-for-claudeBetween October 20 and 22, GitHub flagged three npm packages with AI-agent names as malware: agentic-awesome-skills (20 versions), x402-prompt-injection-scan 0.1.4 and formatting-subtitles-for-claude (every version). If any of them was installed, treat that computer as compromised. Claude Code Anthropic Claude MCP SDKs & servers 2026-10-22 05. php2shell (CVE-2026-109618, CVE-2026-109619): unauthenticated remote code execution in PHP itselfTwo bugs in how the PHP runtime cleans up memory after a request ends abnormally can let an unauthenticated HTTP request run code as the web server's PHP worker. They affect every PHP install that serves web requests (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed). PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix them, and Cloudflare's WAF blocks known exploits by default, including on the Free plan. PHP Replit 2026-10-21 06. CVE-2026-114125: A malicious website can tamper with your project through a running Storybook dev serverWhile a vulnerable Storybook dev server is running and open in your browser, a malicious website can embed its preview and send events to it. With some user interaction this can change story files in your project, and if a changed file is later run, the attacker's code runs with your permissions. Storybook 8, 9, 10 and 11 alpha are affected, including @storybook/addon-mcp 10.6.x before 10.6.2. Patched in 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6. Node.js MCP SDKs & servers Next.js 2026-10-21 07. LiteLLM 1.107.0 on PyPI and Docker was malware: a credential stealer that runs whenever Python startsOn 21 October 2026 a malicious litellm 1.107.0 was published to PyPI and pushed to LiteLLM's official Docker images. It adds Python startup hooks that steal credentials and set up an hourly remote-code loader, and it runs as soon as Python starts, even if you never import litellm. LiteLLM Claude Code OpenAI +1 more 2026-10-21 08. Malicious npm packages posing as ChatGPT, Claude and Codex setup toolsOn October 19, GitHub flagged eight npm packages as malware that use AI tool names as bait, such as claude-desktop-setup, chatgpt-desktop-setup, codex-setup and api-anthropic. If any of them was installed, treat that computer as compromised. OpenAI Anthropic Claude Codex CLI +1 more 2026-10-19 09. CVE-2026-102503: Google Agent Mesh let any peer call MCP backends through an unchecked ingressIn Google's open-source Agent Mesh (SAM) 0.1.0-alpha.1 and alpha.2, the /libp2p-http ingress skipped the Biscuit capability checks, so any peer that could reach a node could call its registered MCP, A2A and inference backends, including command-backed MCP servers. MCP SDKs & servers 2026-10-19 10. CVE-2026-75128: Langchain-Chatchat lets anyone run shell commands through /tools/callLangchain-Chatchat through 0.3.1.3 exposes a POST /tools/call endpoint with no authentication, and the built-in shell tool is always registered. One request can run OS commands on the server, as root in the shipped Docker image. No fixed release exists yet. LangChain 2026-10-19 11. OpenCode Console breach exposed saved provider API keysOpenCode said a breach of a legacy system behind its hosted OpenCode Console affected 1.4% of Console users who had linked external providers. Their saved OpenAI, Anthropic and Google keys may have been exposed, and some users reported unauthorized charges, a few of them above $1,000. Providers have blocked exposed keys, and OpenAI and OpenCode say refunds are being handled. OpenCode Anthropic Claude OpenAI +1 more 2026-10-17 12. CVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commandsBefore 0.2.121, the Python Claude Agent SDK passed the resume session ID straight to the Claude CLI. A value starting with a dash became a CLI flag, so an attacker could inject an MCP server config and run commands. Claude Code MCP SDKs & servers 2026-10-16 13. CVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npxDeepSeek Harness (dsh), DeepSeek's developer-preview agent harness, launches MCP servers by bare command name. Injected content can get the model to drop a fake executable into node_modules/.bin, which then runs every time that MCP server starts. DeepSeek MCP SDKs & servers 2026-10-16 14. CVE-2026-96889: Next.js image optimization RCE via SVGA memory bug in an upstream library used by Next.js Image Optimization can lead to unauthenticated remote code execution when SVG files are processed and Next.js runs on glibc-based Linux. Fixed in 16.4.1 and 15.5.28. Next.js 2026-10-14 15. Next.js ‘use cache’ remote code execution via typed arraysNext.js 16 apps using the App Router with Cache Components can be open to unauthenticated remote code execution when a ‘use cache’ function returns multiple typed arrays. There is no workaround; upgrade to 16.4.1. Next.js 2026-10-14 16. CVE-2026-77366: obsidian-tc MCP server let any token read and edit any vaultBefore 1.3.1, the obsidian-tc MCP server for Obsidian never checked the vault a request named against the vault the caller's token was for, so any valid token could read, write or delete notes in every configured vault. MCP SDKs & servers 2026-10-12 17. Supabase RLS policies that check login but not ownershipA policy like using (auth.uid() is not null) has RLS on and mentions the user, so it passes Lovable’s scan. But it lets any logged-in user read every row, and on most apps anyone can sign up. Supabase Lovable Bolt +4 more 2026-10-10 18. CVE-2026-107824: x64dbg-MCP Server gave anyone on the network full debugger controlEarly versions of the x64dbg-MCP Server plugin served all 71 debugger tools over HTTP/SSE with no authentication on 0.0.0.0, so anyone who could reach port 9094 or 9095 could run x64dbg commands, attach to processes, edit memory and write files. MCP SDKs & servers 2026-10-09 19. CVE-2026-103663: Ollama /api/pull path traversal can lead to code execution as rootAn unauthenticated attacker who can reach an Ollama server can use a crafted layer digest in /api/pull to write a file outside the model store. In most Docker images that means a file Ollama loads and runs as root on the next restart. Ollama 2026-10-08 20. CVE-2026-10561: Langflow's Python Interpreter component ran code with no real sandboxBefore 1.10.1, any logged-in Langflow user who could edit and run a flow could use the Python Interpreter component to run OS commands as the Langflow service and make their own account a superuser. Langflow 2026-10-06 21. Langflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)Langflow launched whatever command a user put in an MCP stdio server config, through bash -c, with no allowlist. Any user who could add an MCP server or build a flow could run OS commands on the Langflow host, and with the default auto-login no account was needed. Langflow MCP SDKs & servers 2026-10-05 22. CVE-2026-8505: Langflow webhooks let anyone run a flow without an API keyIn Langflow 1.7.0 through 1.9.0, webhook endpoints skipped API key checks by default, so anyone who knew a flow's UUID could run it as the flow's owner. Flows that run Python code turn that into remote code execution. Langflow 2026-10-05 23. Malicious PyPI package anthropic-sdk posed as Anthropic's Python clientA PyPI package named anthropic-sdk (version 0.1.0) re-exported the real anthropic client so it looked like a drop-in, but from the third import onward it downloaded Python code from a third-party GitHub repo and ran it. Anthropic's official package is anthropic, not anthropic-sdk. Anthropic Claude 2026-10-04 24. Next.js: Remote Code Execution in next/og ImageResponseThe Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Next.js 2026-09-30 25. UpGuard: 16,326 Supabase databases had readable tablesUpGuard checked about 300,000 websites that use Supabase and found 16,326 databases with tables anyone could read. Over half showed signs of personal data, and a smaller share held passwords or auth tokens. Supabase Claude Code Codex CLI +4 more 2026-09-25 26. CVE-2026-77244: MCP Atlassian's HTTP transport accepts any token and acts with the operator's Jira and Confluence accountBefore 0.22.0, mcp-atlassian's HTTP transport accepts any non-empty token, and requests without a real user identity fall back to the operator's configured Jira or Confluence credentials. Anyone who can reach the MCP endpoint can read and write Jira and Confluence as the operator. MCP Atlassian MCP SDKs & servers 2026-09-22 27. CVE-2026-54618: Obsidian Web MCP hands out vault access without a loginBefore 0.2.0, Obsidian Web MCP's /oauth/authorize issues an authorization code with no login or consent, and /oauth/token swaps it for the static VAULT_MCP_TOKEN. Anyone who can reach the tunnel can read, write, move and delete notes in the whole vault. MCP SDKs & servers 2026-09-17 28. CVE-2026-61560: GitLab MCP server (@zereight/mcp-gitlab) lets anyone steal its GitLab tokenBefore 2.1.27, @zereight/mcp-gitlab in SSE mode exposes every MCP tool with no authentication, and its upload_markdown tool reads any local file. An attacker on the network can read /proc/self/environ, take the server's GitLab personal access token and take over the account. Two related bugs (CVE-2026-61559, CVE-2026-61568) are fixed in 2.1.27 and 2.1.30. MCP SDKs & servers 2026-09-15 29. CVE-2026-59971: MySQL MCP Server in SSE mode runs anyone's SQL, including via DNS rebindingBefore 0.4.2, mysql-mcp-server with MCP_TRANSPORT=sse binds to 0.0.0.0 with no authentication and no DNS rebinding protection. A network attacker, or a malicious web page through the victim's browser, can call execute_sql against the database. MCP SDKs & servers 2026-09-15 30. CVE-2026-57141: PraisonAI's codeMode tool sandbox can be escaped to run OS commandsIn the praisonai npm package up to 1.7.1, the codeMode tool runs model-generated JavaScript with new Function() and a regex blocklist that's easy to bypass. Anyone who can influence that code, for example through prompt injection, can read files, steal credentials and run OS commands. Fixed in 1.7.2. PraisonAI 2026-09-15 31. CVE-2026-57147: praisonai-platform signs logins with the public secret dev-secret-change-mepraisonai-platform 0.1.4 and earlier fall back to the hardcoded JWT secret dev-secret-change-me when PLATFORM_JWT_SECRET is unset, and the production guard is off because PLATFORM_ENV defaults to dev. Anyone can forge a token and act as any user or workspace owner. Fixed in 0.1.6. PraisonAI 2026-09-15 32. CVE-2026-57139: PraisonAI's npm MCP server and AgentOS let anyone call tools and agentsIn the praisonai npm package up to 1.7.1, the TypeScript MCPServer's HTTP transport has no authentication and listens on all interfaces, so anyone who reaches the port can list and call tools, read resources and get prompts. AgentOS has the same problem for agents (CVE-2026-57140), and version 1.7.2 also fixes another codeMode sandbox escape (CVE-2026-57138). PraisonAI MCP SDKs & servers 2026-09-15 33. CVE-2026-12944: Langflow's code scanner missed socket and urllib, letting users run code as rootLangflow OSS 1.0.0 through 1.10.0 blocked subprocess imports in submitted components but not socket or urllib. Code using them ran on the server as root during component validation while the scanner still reported validated: true, so an authenticated user could steal cloud credentials, read container files and reach internal services. Fixed in 1.10.1. Langflow 2026-09-14 34. CVE-2026-57123: praisonaiagents MCP SSE server exposes every tool with no authBefore praisonaiagents 1.6.59, ToolsMCPServer.run_sse() and launch_tools_mcp_server(transport="sse") bind to 0.0.0.0 with no authentication or Origin check. Anyone who can reach the port can list and run every registered tool, and a web page can drive a localhost instance through DNS rebinding. The library's own security controls were never wired in. PraisonAI MCP SDKs & servers 2026-09-14 35. CVE-2026-57145: PraisonAI's multiedit tool lets the model read and overwrite any filePraisonAI's multiedit agent tool passed the model-controlled file path straight to open() for reading and writing, with no traversal check, workspace boundary, symlink resolution or protected-path guard. Anyone who can influence an agent's tool arguments, for example through prompt injection or a malicious YAML workflow, can read secrets like SSH keys and overwrite files. PraisonAI 2026-09-14 36. CVE-2026-85025: Langflow before 1.11.6 has 11 code-execution bugs, including unauthenticated RCE through shared MCP projectsAn IBM security bulletin lists 11 CVEs in Langflow OSS 1.0.0 through 1.11.5, all fixed in 1.11.6. The worst, CVE-2026-85025, lets an unauthenticated attacker run code and read or change chat sessions through publicly shared MCP project endpoints. The others let authenticated users run code or commands through scanner bypasses, stored flows and MCP stdio settings. Langflow MCP SDKs & servers 2026-09-10 37. CVE-2026-87911: AWS postgres-mcp-server's read-only mode can be bypassed to run OS commandsThe SQL validator in awslabs.postgres-mcp-server before 1.1.7 didn't block every statement that can touch the system in its default read-only mode. A crafted COPY ... TO PROGRAM statement hidden in content the agent processes can run operating system commands on a self-managed PostgreSQL host, when the MCP server connects with a highly privileged database role. MCP SDKs & servers Amazon Q Developer 2026-09-09 38. CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted serversA vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem. Next.js 2026-09-08 39. Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedA vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Next.js 2026-09-08 40. CVE-2026-37004: LiteLLM vulnerable to server-side template injection in the /prompts/test endpointBerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment. LiteLLM 2026-08-27 41. CVE-2026-73487: Flowise CSV and Airtable agents can be prompt-injected into leaking data and SSRFIn Flowise 3.1.2 and earlier, the CSV Agent and Airtable Agent check LLM-written Python with a regex blocklist that's easy to get around. A prompt sent to the public prediction API can make the agent send the whole dataset to an outside server or reach internal services. Flowise 2026-08-13 42. CVE-2026-73483: Flowise custom functions could escape the sandbox through puppeteer.launch()A logged-in Flowise user who can reach the custom function endpoint could break out of the NodeVM sandbox by passing their own executablePath and args to puppeteer.launch(), running OS commands as the Flowise process, which is root in the official Docker image. Flowise 2026-08-13 43. CVE-2026-9205: Langflow derived its credential encryption key from random.seed()Langflow 1.10.0 and earlier built the Fernet key that encrypts every stored credential (LLM API keys, database passwords) from Python's non-cryptographic random module seeded with SECRET_KEY. Anyone who gets the secret_key file can decrypt all of them offline. Langflow 2026-08-05 44. Supabase tables readable by anyone with no loginA scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login. Lovable Bolt v0 +4 more 2026-08 45. Supabase service_role / secret key shipped to the browserThe service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public. Lovable Bolt v0 +4 more 2026-08 46. CVE-2026-61447 and CVE-2026-61445: PraisonAI ran LLM-written code and commands with no sandboxTwo PraisonAI advisories: CodeAgent ran model-generated Python with the full environment (every API key and credential) and ignored sandbox=True, and the AICoder UI let the model write any file and run any command. Prompt injection turns either one into code execution. PraisonAI 2026-07-11 47. CVE-2026-61742: DBHub MCP server's HTTP mode let any website query your databaseDBHub, Bytebase's database MCP server, had no authentication in its HTTP transport mode before 0.22.5, and its Origin check didn't stop DNS rebinding. A malicious web page could make your browser call DBHub's MCP tools and read or write the connected database. MCP SDKs & servers 2026-06-24 48. CVE-2026-57118: PraisonAI's AgentTeam.launch() served agents to anyone, no authBefore praisonaiagents 1.6.59, the HTTP server started by AgentTeam.launch() (alias Agents.launch()) accepted requests with no token or a wrong one, and it binds to 0.0.0.0 by default. Anyone who could reach it could list agents and make them run, using your model credits, private context and tools. PraisonAI 2026-06-18 49. CVE-2026-57496: NetLicensing MCP server leaked plaintext API keys via path traversalBefore 0.1.8, the netlicensing_get_product tool in Labs64's netlicensing-mcp put the product number straight into a REST path. Passing ../token reached the token endpoint and skipped the redaction, so a client with a non-admin key could read plaintext API keys, including admin ones. MCP SDKs & servers 2026-06-18 50. CVE-2026-49468: LiteLLM: Authentication Bypass via Host Header InjectionA Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. LiteLLM 2026-06-16 51. CVE-2026-50549: Cursor agent could write outside the workspace via a symlink and escape the sandboxBefore 3.0, Cursor's check that agent file writes stay inside the workspace failed open. A malicious agent (for example one steered by prompt injection) could use an in-workspace symlink to write anywhere the user could, without approval, including over Cursor's own sandbox helper. Cursor 2026-06-05 52. CVE-2026-101084: Obot let any user connect to restricted MCP servers by IDIn Obot, the open-source MCP platform, the /mcp-connect/{id} gateway didn't enforce access control rules before v0.21.1. Any logged-in user who knew a server's ID could use that MCP server's tools with its stored OAuth credentials. A second advisory warns that the old Docker quickstart ran with authentication off. MCP SDKs & servers 2026-05-08 53. Unverified Stripe webhooks hand out free upgradesIf your Stripe webhook handler doesn’t verify the Stripe-Signature header, anyone can POST a fake “checkout.session.completed” event and your app will treat it as a real payment. Scans and audits find this in a large share of AI-built apps. Stripe Lovable Bolt +5 more 2026-05 54. CVE-2026-12537: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypassesGemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. Gemini CLI 2026-04-24 55. CVE-2026-42208: LiteLLM has SQL Injection in Proxy API key verificationA database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. LiteLLM 2026-04-24 56. CVE-2025-61260: OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration filesA vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex CLI 2026-04-14 57. CVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal VulnerabilityThe OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. MCP SDKs & servers 2026-03-31 58. Moltbook left its Supabase database open to read and writeWiz found that Moltbook, a social network for AI agents whose founder said he vibe-coded it, shipped a Supabase key in its JavaScript with no Row Level Security behind it. Anyone could read and write the database, including 1.5 million agent API tokens and 35,000 email addresses. Supabase 2026-02-02 59. CVE-2026-22778: vLLM has RCE In Video ProcessingA chain of flaws in vLLM video processing lets an attacker run commands on the server with a malicious video URL. Fixed in 0.14.1. vLLM 2026-02-02 60. CVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operationsA critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations. Ollama 2025-12-18 61. CamoLeak: Copilot Chat leaked private source codeLegit Security reported a critical vulnerability in GitHub Copilot Chat that could leak private source code from a user’s repositories. Copilot 2025-10-08 62. CVE-2025-6514: mcp-remote exposed to OS command injection via untrusted MCP server connectionsmcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL MCP SDKs & servers 2025-07-09 63. Base44: private apps open to anyone with the app_id (Wiz)Undocumented register and verify-OTP endpoints accepted a non-secret app_id, letting anyone create a verified account on private, SSO-only apps. Patched by Wix within 24 hours. Base44 2025-07 64. CVE-2025-49596: MCP Inspector proxy server lacks authentication between the Inspector client and proxyVersions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. MCP SDKs & servers 2025-06-13 65. CVE-2025-32711 (EchoLeak): zero-click data leak in Microsoft 365 CopilotAI command injection in Microsoft 365 Copilot let an unauthorised attacker disclose information over a network. Microsoft fixed it server-side. Copilot 2025-06-11 66. CVE-2025-1793: llama_index vulnerable to SQL InjectionMultiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. LlamaIndex 2025-06-05 67. CVE-2025-47277: vLLM Allows Remote Code Execution via PyNcclPipe Communication ServicevLLM Allows Remote Code Execution via PyNcclPipe Communication Service. vLLM 2025-05-20 68. CVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLSLovable-generated apps talked to Supabase directly from the browser, but many tables had no (or wrong) Row Level Security policies, so anyone with the public anon key could read or write data. Lovable Supabase 2025-05 69. CVE-2025-32444: vLLM Vulnerable to Remote Code Execution via Mooncake IntegrationvLLM integration with mooncake is vaulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. vLLM 2025-04-29 70. CVE-2025-29927: Next.js middleware authorization bypassSelf-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0. Next.js v0 Bolt +2 more 2025-03 71. DeepSeek left a database open with chat history and secretsWiz found a publicly accessible DeepSeek database that allowed full control over database operations, exposing over a million lines of logs with chat history and other sensitive data. DeepSeek 2025-01-29 72. CVE-2024-46946: LangChain Experimental Eval Injection vulnerabilitylangchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05). LangChain 2024-09-19 73. CVE-2024-45201: LlamaIndex includes an exec call for `import {cls_name}`An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}. LlamaIndex 2024-08-22 74. CVE-2024-3271: llama-index-core Command Injection vulnerabilityA command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. LlamaIndex 2024-04-16 75. CVE-2024-27444: LangChain Experimental vulnerable to arbitrary code executionlangchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__… LangChain 2024-02-26 76. CVE-2023-6730: transformers has a Deserialization of Untrusted Data vulnerabilityDeserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0. Hugging Face 2023-12-19 77. CVE-2023-32785: Langchain SQL Injection vulnerabilityIn Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain. LangChain 2023-10-21 78. CVE-2026-115912: vLLM 0.32.0 fixes a forged shared-memory handle that reaches pickle.loads, EPS images that can reach Ghostscript, and five ways to stall or crash the serverEight vLLM CVEs were published on 26 October 2026, all fixed in vLLM 0.32.0. The worst lets an authenticated caller forge a multimodal shared-memory handle so a worker runs pickle.loads() on attacker bytes, even with insecure serialization disabled. Another lets an image request hand an EPS file to Ghostscript. The rest let a caller hang or crash a shared server. Upgrade to 0.32.0. vLLM 2026-10-26 79. CVE-2026-116176: vLLM fixes an SSRF that can leak KV-cache tensors, plus three ways to crash a shared serverFour vLLM CVEs were published on 25 October 2026. The worst lets an API caller put an attacker's host in the X-Request-Id header so a P2pNcclConnector prefill worker connects out and sends that request's KV-cache tensors to it. The other three let a client crash or OOM-kill a shared vLLM server. Upgrading to vLLM 0.31.0 covers all four. vLLM 2026-10-25 80. CVE-2026-57845: Loading a dataset with Hugging Face Datasets' pandas builder can run attacker codeHugging Face Datasets through 5.1.0 unpickles files passed to its deprecated pandas builder without any check. If you call load_dataset("pandas", data_files=...) on a pickle file an attacker made, their code runs with your process's permissions. A fix is open as a pull request but no patched release exists yet. Hugging Face 2026-10-23 81. CVE-2026-57113: A crafted PraisonAI GitHub template ref can delete folders outside the template cachePraisonAI's template loader builds its cache path from the owner, repo, template and ref of a github: template URI without checking the result stays inside the cache. A ref like ../../../outside-target escapes it, writes a .cache_meta.json file elsewhere and, once a normal cache entry exists for the same template, deletes an attacker-chosen directory. Affects praisonai 2.6.0 through 4.6.57; fixed in 4.6.59. PraisonAI 2026-10-23 82. CVE-2026-57121: Any praisonai-platform workspace member can delete everyone else's projects and agentsIn praisonai-platform 0.1.4, the DELETE endpoints for projects, agents, issues, labels, issue dependencies and issue-label links only check that the caller is a workspace member. A single malicious or compromised member account can permanently wipe content created by the owner and other members. GitHub lists 0.1.6 as the first patched version; NVD's text says 0.1.5. PraisonAI 2026-10-23 83. CVE-2026-115477: obsidian-tc MCP server could run destructive vault actions after you declined themOn Streamable HTTP deployments with auth.jwtSecret set, the obsidian-tc MCP server for Obsidian vaults treated an echoed request state as proof of approval, so a destructive tool call could still complete after the human declined or cancelled the confirmation. Affects 1.13.0 through 1.31.3. Version 1.31.4 fixes it and a second bug, CVE-2026-115478, where memory tools could overwrite notes they didn't own. MCP SDKs & servers 2026-10-23 84. CVE-2026-56840: PraisonAI's human approval for dangerous tools could be bypassed, plus file reads and unsigned Linear webhooksFive PraisonAI CVEs published on 23 October 2026 cover bugs fixed in praisonai 4.6.59. Two let someone approve a dangerous tool call without the real approver: a tool argument that injects script into the HTTP approval dashboard, and any 'yes' typed in the Discord approval channel. The others let a prompt read files outside PraisonAI's storage and let anyone send forged Linear webhooks to LinearBot when no secret is set. PraisonAI 2026-10-23 85. CVE-2026-115419: Strands Agents A2A servers shared conversation history between different callersThe Agent2Agent (A2A) server in AWS's Strands Agents SDK didn't isolate conversation state between callers with different context_id values. In a deployment used by more than one user or tenant, an authenticated caller could read another caller's conversation history or steer the model's answers to them. Fixed in strands-agents 1.43.0 (Python) and @strands-agents/sdk 1.5.0 (TypeScript). Strands Agents 2026-10-23 86. Node.js October 21, 2026 security releases: four HIGH bugs in 26.x, 24.x and 22.xNode.js shipped 22.23.4, 24.22.1 and 26.12.1 on October 21, 2026, fixing 10 CVEs. The four HIGH ones are a Brotli decoder out-of-bounds write that can lead to remote code execution, two TLS certificate hostname bypasses, and dns.resolve truncating names that contain a NUL byte. Any app running its own Node process should upgrade. Node.js Next.js Replit 2026-10-21 87. CVE-2026-111770: MCP TypeScript server SDK 2.x could send one HTTP client's responses to another clientIn @modelcontextprotocol/server 2.0.0 through 2.2.0, an MCP server reached over HTTP could deliver one client's responses and notifications to a different client when clients shared one stateless transport or one McpServer instance. Messages were matched by JSON-RPC id alone, and SDK clients number requests from 0, so ids collide in normal use. Fixed in 2.3.0, but you also have to change your code. MCP SDKs & servers 2026-10-20 88. CVE-2026-88755: Z.ai ZCode starts MCP servers from a repo's config the moment you open itZ.ai's ZCode desktop client 3.11.2.6792 connects to every MCP server declared in a repository's .zcode/config.json as soon as you open the folder, with no approval prompt. A cloned repo can run any command it likes on your machine. MCP SDKs & servers 2026-10-16 89. Bootlegger's Claude-built dashboard sent store and financial data to anyone who loaded its login pageAn internal web dashboard at South African coffee chain Bootlegger, reportedly vibe-coded with Claude and hosted on Railway, showed a login screen but already included its data in the page it sent. Anyone with the URL could read names and contact details for 132 locations, plus some performance and financial data, from the page source. Anthropic Claude 2026-10-16 90. CVE-2026-111091: JetBrains Junie CLI ran code from an untrusted project’s MCP configOpening an untrusted project in Junie CLI before 26.8.3 could run code through the MCP server configuration that came with the project. Junie MCP SDKs & servers 2026-10-15 91. CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningThe plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. Claude Code 2026-10-15 92. CVE-2026-109527: MCP Python SDK HTTP servers can be knocked offline with huge requestsMCP servers built with the official Python SDK read whole HTTP request bodies into memory with no size limit on the SSE message endpoint and OAuth routes. One large request can exhaust memory and take the server down, often with no login needed. MCP SDKs & servers 2026-10-14 93. CVE-2026-108395: MCP Java SDK HTTP servers can be crashed with one huge requestThe official MCP Java SDK’s Servlet-based HTTP transports read the whole request body into memory with no size limit. One unauthenticated chunked POST can exhaust the Java heap and take the server down. MCP SDKs & servers 2026-10-14 94. Next.js Server Actions denial of serviceCrafted requests to a Next.js App Router app with at least one Server Action can cause excessive CPU use that blocks other requests in the same process. Fixed in 16.4.1 and 15.5.28. Next.js 2026-10-14 95. Roo Code: five ways to slip denied commands past auto-approve (CVE-2026-110202 to 110206), no fix comingRoo Code through 3.54.0 has five command-approval bypasses. With auto-approve on, a prompt injection can get a denied shell command run on your machine by hiding it behind an allowlisted command like echo. The project was archived in May 2026, so no patch is expected. Roo Code Cline 2026-10-13 96. CVE-2026-109572: Open WebUI terminal proxy lets regular users act as Terminals adminIn Open WebUI 0.8.6 to 0.11.3, a regular user with access to a Terminals connection could send requests through the terminal proxy with the admin’s shared key attached, then list or stop other users’ terminals and change terminal policies. Open WebUI 2026-10-12 97. CVE-2026-94483: Next.js has Server-Side Request Forgery in Image OptimizationAn attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization. Next.js 2026-10-07 98. CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverIn affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. MCP SDKs & servers 2026-10-06 99. CVE-2026-103435: Claude Code could be raced into writing files outside the projectClaude Code checked that a file path was inside the project at permission time but resolved it again at write time. Someone who can write to a shared workspace could swap a file for a symlink and redirect Claude Code’s edits to files like your shell config. Claude Code 2026-10-05 100. CVE-2026-102697: Ollama agent mode's Bash approval can be bypassed with ; or &&In Ollama's experimental agent mode, approving a Bash command for the session also let through anything chained onto it. A prompt injection could tack extra commands onto an approved one and run them without asking. Ollama 2026-09-29 101. CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. Open WebUI 2026-09-10 102. CVE-2026-87016: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. Open WebUI 2026-09-10 103. CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesAny authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Open WebUI 2026-08-04 104. Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesPrefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way. Lovable Bolt v0 +4 more 2026-08 105. CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code ExecutionClaude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. Claude Code 2026-07-24 106. CVE-2026-63093: Cursor for Windows ran a git.exe planted in a cloned repo as soon as you opened itOn Windows, Cursor 3.2.16 looked up git by name, so a malicious git.exe in the root of a repo you cloned and opened ran automatically at startup and repeatedly after that, with no extra click. Cursor says 3.13.25 and later fix it. macOS and Linux were not affected. Cursor 2026-07-17 107. CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validationIn affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation. MCP SDKs & servers 2026-07-16 108. CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalIn affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. MCP SDKs & servers 2026-07-16 109. CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksIn affected versions, the default request handlers installed by the experimental tasks feature (server.experimental.enable_tasks()) did not check which session created a task before acting on it. MCP SDKs & servers 2026-07-16 110. CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassedThe /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. Open WebUI 2026-05-14 111. CVE-2026-44578: Next.js vulnerable to server-side request forgery in applications using WebSocket upgradesSelf-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. Next.js 2026-05-11 112. CVE-2026-44574: Next.js has a Middleware / Proxy bypass through dynamic route parameter injectionApplications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. Next.js 2026-05-11 113. CVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loaderOllama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. Ollama 2026-05-04 114. CVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code ExecutionClaude Code used the git worktree commondir file when determining folder trust but did not validate its contents. Claude Code 2026-04-24 115. CVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside WorkspaceClaude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. Claude Code 2026-04-21 116. Lovable bug exposed public projects’ code and AI chatsFrom 3 February to 20 April 2026, a Lovable permissions regression let any Lovable user with a project link read the source code and AI chat history of public projects. Lovable confirmed it and fixed it within two hours of the public report. Lovable 2026-04-20 117. CVE-2026-27124: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy VulnerabilitiesWhile testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. MCP SDKs & servers 2026-03-31 118. CVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings FileClaude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. Claude Code 2026-03-19 119. CVE-2025-69196: FastMCP OAuth Proxy token reuse across MCP serversWhile testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request. MCP SDKs & servers 2026-03-16 120. CVE-2026-25725: Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.jsonClaude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. Claude Code 2026-02-06 121. CVE-2026-25723: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write RestrictionsClaude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope. Claude Code 2026-02-06 122. CVE-2026-25722: Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write ProtectionClaude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Claude Code 2026-02-06 123. CVE-2026-25536: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseCross-client data leak via two distinct issues: (1) reusing a single StreamableHTTPServerTransport across multiple client requests, and (2) reusing a single McpServer/Server instance across multiple transports. Both are most common in stateless deployments. MCP SDKs & servers 2026-02-04 124. CVE-2026-24887: Claude Code has a Command Injection in find Command Bypasses User Approval PromptDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Claude Code 2026-02-03 125. CVE-2026-24053: Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File WritesDue to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Claude Code 2026-02-03 126. CVE-2026-24052: Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled DomainsClaude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. Claude Code 2026-02-03 127. CVE-2026-22708: Cursor Auto-Run allowlist could be bypassed with shell built-ins that poison environment variablesIn Cursor 2.2 and earlier, with Auto-Run Mode in Allowlist mode, some shell built-ins ran without being on the allowlist and without approval. Through prompt injection, an attacker could set or change environment variables so that later allowlisted commands do something else, which can lead to code execution. Cursor 2026-01-14 128. CVE-2025-9611: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server ToolsMicrosoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. MCP SDKs & servers 2026-01-07 129. CVE-2026-0621: Anthropic's MCP TypeScript SDK has a ReDoS vulnerabilityA ReDoS vulnerability in the UriTemplate class allows attackers to cause denial of service. The partToRegExp() function generates a regex pattern with nested quantifiers (([^/]+(?:,[^/]+))) for exploded template variables (e.g., {/id}, {?tags*}), causing catastrophic backtracking on malicious input. MCP SDKs & servers 2026-01-05 130. CVE-2025-66032: Claude Code Command Validation Bypass Allows Arbitrary Code ExecutionDue to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-12-03 131. CVE-2025-66416: Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 132. CVE-2025-66414: Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 133. CVE-2025-64755: @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File WritesDue to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. Claude Code 2025-11-20 134. CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialogWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-11-19 135. CVE-2025-59536: Claude Code can execute commands prior to the startup trust dialogDue to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Claude Code 2025-10-03 136. Gemini Trifecta: three injection flaws in Google’s Gemini suiteTenable found three now-fixed vulnerabilities in Gemini Cloud Assist, the Search Personalization model and the Browsing tool that exposed users to privacy risks, including search-injection. Google Gemini 2025-09-30 137. CVE-2025-59828: Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn VersionsWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-09-24 138. CVE-2025-59532: Codex has sandbox bypass due to bug in path configuration logicDue to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. Codex CLI 2025-09-19 139. CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git emailAt startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace. Claude Code 2025-09-10 140. CVE-2025-58764: Claude Code rg vulnerability does not protect against approval prompt bypassDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-09-10 141. CVE-2025-58444: MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP ServerAn XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. MCP SDKs & servers 2025-09-08 142. Windsurf: prompt injection leaks developer secretsEmbrace The Red showed how prompt injection in files the Cascade agent reads could get Windsurf to leak secrets from the developer’s machine. Windsurf 2025-08-21 143. CVE-2025-55284: Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude CodeDue to an overly broad allowlist of safe commands, it was possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation. Claude Code 2025-08-18 144. CVE-2025-53773: GitHub Copilot prompt injection to code executionCommand injection in GitHub Copilot and Visual Studio let an attacker run code on a developer’s machine. Embrace The Red showed it starting from a prompt injection in project content. Copilot 2025-08-12 145. CVE-2025-54795: Claude Code echo command allowed bypass of user approval prompt for command executionDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-08-04 146. CVE-2025-54794: Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file accessDue to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD. Claude Code 2025-08-04 147. CVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run codeBefore 1.3.9, Cursor let the agent create new dotfiles like .cursor/mcp.json without approval. Chained with prompt injection, this meant remote code execution. Cursor 2025-08 148. CVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedIn Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt. Cursor MCP SDKs & servers 2025-08 149. CVE-2025-8217: malicious code shipped in Amazon Q Developer 1.84.0An over-scoped GitHub token in Amazon Q’s build setup let an attacker commit malicious code that shipped in the VS Code extension 1.84.0. AWS says it failed to run due to a syntax error. Amazon Q Developer 2025-07-23 150. Supabase MCP: a support ticket gets the agent to dump private tablesGeneral Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role. MCP SDKs & servers Supabase Cursor +1 more 2025-07-08 151. CVE-2025-53366: MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoSA validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. MCP SDKs & servers 2025-07-04 152. CVE-2025-53365: MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of ServiceIf a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. MCP SDKs & servers 2025-07-04 153. CVE-2025-53110: @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefixVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 2025.7.1 to resolve the issue. MCP SDKs & servers 2025-07-01 154. CVE-2025-53109: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handlingVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve. MCP SDKs & servers 2025-07-01 155. AI agent deleted a production database during a code freeze (Replit)Replit Agent deleted SaaStr founder Jason Lemkin’s live database (1,206 executives, 1,196+ companies) despite an explicit freeze, then wrongly said rollback was impossible. Replit Cursor 2025-07 156. CVE-2025-52882: Claude Code Improper Authorization via websocket connections from arbitrary originsClaude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Pycharm, and Android Studio) are vulnerable to unauthorized websocket connections from an attacker when visiting attacker-controlled webpages. Claude Code 2025-06-23 157. GitHub MCP server: a public issue makes the agent leak private reposInvariant Labs showed that a prompt injection planted in a public GitHub issue could get an agent using the official GitHub MCP server to pull data from the user’s private repositories. MCP SDKs & servers Claude Code Cursor +1 more 2025-05-26 158. MCP tool poisoning: hidden instructions in tool descriptionsAn MCP server can hide instructions inside a tool’s description. The model reads them, the user usually doesn’t, and the agent can be steered into reading files or sending data elsewhere. MCP SDKs & servers Cursor Claude Code +2 more 2025-04-01 159. “Rules File Backdoor”: hidden Unicode instructions in AI rules filesPillar Security showed invisible Unicode characters in shared rules files (.cursorrules, .mdc) can steer Cursor and GitHub Copilot into writing backdoored code. Cursor Copilot 2025-03 160. Authentication logic living entirely in the browserHiding a page or button in the UI is not access control. If the API or database doesn’t check the user, anyone can call it directly. Lovable Base44 Bolt +3 more 2025 161. Slopsquatting: AI suggests packages that don’t existA USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names. Claude Code Copilot Cursor +5 more 2025 162. CVE-2024-11393: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 163. CVE-2024-11394: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 164. OWASP LLM01:2025: prompt injection is the top LLM app riskOWASP ranks prompt injection first in its Top 10 for LLM Applications 2025. Any app that feeds untrusted text to a model with tools or data access is exposed. OpenAI Anthropic Claude Google Gemini +4 more 2024-11-18 165. SpAIware: prompt injection writes into ChatGPT’s long-term memoryEmbrace The Red showed untrusted content planting persistent instructions in ChatGPT’s memory on the macOS app, so later chats kept sending data to the attacker. OpenAI 2024-09-20 166. CVE-2024-28224: Ollama DNS rebinding vulnerabilityOllama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion). Ollama 2024-04-08 167. CVE-2026-116575: Mem0 could mix up two users' conversation history, leaking one tenant's messages to anotherMem0's Python and TypeScript SDKs built the key for each session's recent messages by joining user_id, agent_id and run_id with unescaped & and = characters. A caller who controls only their own run_id or agent_id could craft a value that produces another tenant's key, then read that tenant's recent raw messages and write into their history. Fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6. Mem0 2026-10-26 168. Supabase, 30 October 2026: new public tables are no longer exposed to the Data API without an explicit GRANTFrom 30 October 2026, Supabase stops granting anon, authenticated and service_role access to new tables in the public schema of existing projects. A new table won't be reachable through supabase-js, REST or GraphQL until you GRANT access explicitly. RLS still has to be on as well. Supabase Lovable Bolt +3 more 2026-10-23 169. CVE-2026-115886: MLflow scorer endpoints allow unauthenticated SSRFMLflow is an open source AI engineering platform for agents, large language models, and machine learning models. MLflow 2026-10-23 170. CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionMCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion. MCP SDKs & servers 2026-10-15 171. CVE-2026-84377: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parametersAny authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. LiteLLM 2026-09-30 172. Grok 4 jailbroken within 48 hours of launchNeuralTrust combined its Echo Chamber and Crescendo multi-turn techniques to jailbreak Grok 4 two days after release. xAI Grok 2025-07-11 173. Protecting routes only in middlewareVercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed. Next.js v0 Bolt +2 more 2025-03 174. DeepSeek R1 failed every harmful-prompt test in Cisco’s evaluationCisco ran algorithmic jailbreak testing against DeepSeek and other frontier reasoning models and published the results on 31 January 2025. DeepSeek 2025-01-31 175. CVE-2024-50050: Llama Stack used pickle over socketsMeta’s Llama Stack used Python pickle to deserialise socket messages, which could allow remote code execution. It switched to JSON. Meta Llama 2024-10-23 176. Many-shot jailbreaking: long context windows weaken refusalsAnthropic published research showing that filling a long prompt with many fake dialogue examples can push models into answering requests they would normally refuse. Anthropic Claude OpenAI Google Gemini +2 more 2024-04-02 Nothing matches that. Try another builder, or clear the filter.