Advisories
These are the AI-tool CVEs and product advisories this desk has covered. They are not a complete industry catalog. CVSS, KEV status, and the fixed version appear only when the source recorded them. Not recorded does not mean the score is zero or that KEV is clear.
44 advisories. Last updated November 7, 2026 at 9:26 AM CST.
Threat statsSources and methodologyIncident RSSIncident JSON
These chips filter advisories this desk has logged. Leave them off to see every row.
| Date | Advisory |
|---|---|
| Nov 6, 2026 | Lavish-axi loopback HTTP DNS-rebinding arbitrary file read / prompt queue
|
| Nov 6, 2026 | GROBID unauthenticated /api/modelTraining unbounded thread-pool DoS
|
| Nov 6, 2026 | OpenBMB Internet of Agents Code Executor unauth code injection
|
| Nov 6, 2026 | Agenta workflow revision URL SSRF leaks secret-resolve Authorization token
|
| Nov 6, 2026 | PyTorch TorchServe /tmp model-handler swap local privilege escalation
|
| Nov 6, 2026 | Dify authenticated SSRF bypass via remote-files/Squid ACL gap (cloud metadata/IAM risk)
|
| Nov 6, 2026 | Tracecat Docker Compose SAML unsigned-response account takeover (AI-agent SOAR)
|
| Nov 5, 2026 | MCP TypeScript SDK unauth HTTP request validation DoS (heap OOM)
|
| Nov 5, 2026 | MCP TypeScript server shared transport delivers one HTTP client messages to another
|
| Nov 5, 2026 | Amazon GluonTS crafted tar archive path traversal allows arbitrary local file write (CVSS 7.8/8.4 High); fixed 0.17.0
|
| Nov 5, 2026 | DB-GPT CodeAction execute_code unauth code injection (companion to CVE-2026-123019)
|
| Nov 5, 2026 | DB-GPT HuggingFace Adapter trust_remote_code default enables remote code execution
|
| Nov 5, 2026 | AgentScope unauthenticated OS command injection via MCP stdio workspace config
|
| Nov 5, 2026 | AgentScope Bash Tool check_permissions bypass enables arbitrary file writes
|
| Nov 5, 2026 | AgentScope Agent Service X-User-ID missing authentication
|
| Nov 5, 2026 | OpenBMB Internet of Agents WebSocket ConnectionManager missing authentication
|
| Nov 5, 2026 | ChatCLI MCP OAuth accepts unvalidated Protected Resource Metadata (token confusion)
|
| Nov 5, 2026 | mcp-go OAuthHandler accepts unvalidated well-known Protected Resource Metadata
|
| Nov 5, 2026 | OpenHuman MCP tool metadata prompt injection into agent context
|
| Nov 5, 2026 | OpenHuman leaks JSON-RPC bearer token via approval session_id
|
| Nov 5, 2026 | Banks prompt library RCE via unsafe Tool.import_path in CompletionExtension
|
| Nov 5, 2026 | Code Graph RAG MCP read_file path traversal arbitrary file read
|
| Nov 5, 2026 | Code Graph RAG AstGrepService symlink escape outside project_root
|
| Nov 5, 2026 | Kubeflow Pipelines multi-user empty-namespace shared pipeline modify/delete auth gap
|
| Nov 4, 2026 | GPUStack auth bypass exploited in the wild, CVSS 9.8
|
| Nov 4, 2026 | MLflow SHAP load_explainer deserialization RCE (user interaction required)
|
| Nov 4, 2026 | MLflow get-artifacts unauthenticated SSRF information disclosure
|
| Nov 4, 2026 | DeepSeek Harness unauthenticated local RPC/WebSocket control plane can drive session.prompt and host tools (CVSS 8.4 High, AV:L)
|
| Nov 3, 2026 | AgenticFlow sandbox escape exposed saved LLM keys, MCP tokens, and workspace data
|
| Nov 3, 2026 | Docker Sandboxes sbx cp symlink flaw lets a sandboxed AI agent read or overwrite host files (CVE-2026-103916)
|
| Nov 1, 2026 | Beta9 (Beam) cross-tenant sandbox escapes, CVSS 9.9
|
| Nov 1, 2026 | Prefab UI generative UI sandbox escape (FastMCP generate_prefab_ui), CVSS 10
|
| Oct 30, 2026 | TAKO AI Agent for Okta authenticated RCE, CVSS 8.8
|
| Oct 29, 2026 | MLflow PickleEvaluationArtifact untrusted pickle deserialization RCE (CVSS 7.8 High, UI required); fixed 3.13.0
|
| Oct 29, 2026 | EMBRACE embedded-browser flaws in Cursor, Copilot, Codex, VS Code, and Claude Desktop
|
| Oct 28, 2026 | Strands Agents Tools secret masking bypass (GHSA moderate, AWS important)
|
| Oct 28, 2026 | Kubeflow Pipelines multi-user empty-namespace upload skips SubjectAccessReview (cross-tenant pipeline injection)
|
| Oct 28, 2026 | Kubeflow Pipelines frontend unauthenticated SSRF via http/https artifact sources
|
| Oct 28, 2026 | Kubeflow Pipelines unauthenticated SSRF through artifact provider endpoints
|
| Oct 27, 2026 | Mittwald MCP server compromise: AI-assistant session tokens stolen
|
| Oct 26, 2026 | ChatGPT shared-link P1 flaw could run attacker code and read private chats
|
| Oct 2, 2026 | GitLab AI Gateway RCE, called critical by BleepingComputer
|
| Sep 29, 2026 | AG2/AutoGen SandboxShellTool newline injection bypasses allowed/readonly shell filters (host RCE)
|
| Unknown | Langflow authenticated RCE exploitation, called critical by The Hacker News (mid-October; day not recorded)
|
AI Security Guru