{ "schemaVersion": 1, "generatedAt": "2026-11-03T13:12:51.616Z", "initializedAt": "2026-10-30T17:00:19.721Z", "pollIntervalSeconds": 900, "coverage": "Reviewed GitHub Security Advisories and CISA Known Exploited Vulnerabilities that affect watchlisted AI packages, frameworks, agents, MCP servers and model tooling, or whose text describes AI systems; plus incidents without a CVE from vendor notices, release notes, status pages, security research feeds and OSV malicious-package records that name a watchlisted product together with a security signal. Watchlist matching is conservative; this is not exhaustive coverage of every vulnerability.", "sources": [ { "id": "ghsa", "name": "GitHub Advisory Database", "kind": "advisory-database", "url": "https://github.com/advisories", "required": true, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T17:00:19.721Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 99 }, { "id": "cisa-kev", "name": "CISA Known Exploited Vulnerabilities", "kind": "exploited-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "required": true, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T17:00:19.721Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 13 }, { "id": "claude-status", "name": "Claude status history", "kind": "vendor-notice", "url": "https://status.claude.com/history", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "claude-code-releases", "name": "Claude Code release notes", "kind": "vendor-notice", "url": "https://github.com/anthropics/claude-code/releases", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "codex-releases", "name": "OpenAI Codex release notes", "kind": "vendor-notice", "url": "https://github.com/openai/codex/releases", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "gemini-cli-releases", "name": "Gemini CLI release notes", "kind": "vendor-notice", "url": "https://github.com/google-gemini/gemini-cli/releases", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "openai-status", "name": "OpenAI status history", "kind": "vendor-notice", "url": "https://status.openai.com/history", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "openai-news", "name": "OpenAI news", "kind": "vendor-notice", "url": "https://openai.com/news", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 9 }, { "id": "cursor-changelog", "name": "Cursor changelog", "kind": "vendor-notice", "url": "https://cursor.com/changelog", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 1 }, { "id": "ollama-blog", "name": "Ollama blog", "kind": "vendor-notice", "url": "https://ollama.com/blog", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "huggingface-blog", "name": "Hugging Face blog", "kind": "vendor-notice", "url": "https://huggingface.co/blog", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "github-changelog", "name": "GitHub changelog", "kind": "vendor-notice", "url": "https://github.blog/changelog/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "github-security-blog", "name": "GitHub security blog", "kind": "vendor-notice", "url": "https://github.blog/security/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 1 }, { "id": "google-security-blog", "name": "Google security blog", "kind": "vendor-notice", "url": "https://security.googleblog.com/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "aws-security-bulletins", "name": "AWS security bulletins", "kind": "vendor-notice", "url": "https://aws.amazon.com/security/security-bulletins/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 7 }, { "id": "the-hacker-news", "name": "The Hacker News", "kind": "security-research", "url": "https://thehackernews.com/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 6 }, { "id": "bleepingcomputer", "name": "BleepingComputer", "kind": "security-research", "url": "https://www.bleepingcomputer.com/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "the-register-security", "name": "The Register security", "kind": "security-research", "url": "https://www.theregister.com/security/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 6 }, { "id": "dark-reading", "name": "Dark Reading", "kind": "security-research", "url": "https://www.darkreading.com/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 1 }, { "id": "the-record", "name": "The Record", "kind": "security-research", "url": "https://therecord.media/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "krebs-on-security", "name": "Krebs on Security", "kind": "security-research", "url": "https://krebsonsecurity.com/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "cisa-news", "name": "CISA news", "kind": "security-research", "url": "https://www.cisa.gov/news-events/news", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "ox-security", "name": "OX Security research", "kind": "security-research", "url": "https://www.ox.security/blog/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 2 }, { "id": "stepsecurity", "name": "StepSecurity blog", "kind": "security-research", "url": "https://www.stepsecurity.io/blog", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 3 }, { "id": "embrace-the-red", "name": "Embrace The Red", "kind": "security-research", "url": "https://embracethered.com/blog/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 59 }, { "id": "trail-of-bits", "name": "Trail of Bits blog", "kind": "security-research", "url": "https://blog.trailofbits.com/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 2 }, { "id": "wiz-research", "name": "Wiz blog", "kind": "security-research", "url": "https://www.wiz.io/blog", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 8 }, { "id": "snyk-blog", "name": "Snyk blog", "kind": "security-research", "url": "https://snyk.io/blog/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 11 }, { "id": "gitguardian-blog", "name": "GitGuardian blog", "kind": "security-research", "url": "https://blog.gitguardian.com/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "reversinglabs-blog", "name": "ReversingLabs blog", "kind": "security-research", "url": "https://www.reversinglabs.com/blog", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 3 }, { "id": "checkpoint-research", "name": "Check Point Research", "kind": "security-research", "url": "https://research.checkpoint.com/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 3 }, { "id": "unit42", "name": "Palo Alto Unit 42", "kind": "security-research", "url": "https://unit42.paloaltonetworks.com/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "securelist", "name": "Kaspersky Securelist", "kind": "security-research", "url": "https://securelist.com/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "mend-blog", "name": "Mend.io blog", "kind": "security-research", "url": "https://www.mend.io/blog/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 1 }, { "id": "checkmarx-blog", "name": "Checkmarx blog", "kind": "security-research", "url": "https://checkmarx.com/blog/", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 0 }, { "id": "osv-malicious", "name": "OSV malicious packages (OpenSSF)", "kind": "malicious-packages", "url": "https://osv.dev/list?q=MAL-", "required": false, "lastAttemptAt": "2026-11-03T13:12:51.616Z", "baselineAt": "2026-10-30T18:48:04.802Z", "status": "ok", "lastSuccessAt": "2026-11-03T13:12:51.616Z", "error": null, "recognized": 3 } ], "events": [ { "id": "ghsa:GHSA-j656-3hf2-fvjc", "type": "advisory", "advisoryId": "GHSA-j656-3hf2-fvjc", "cveId": null, "title": "DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation", "summary": "Medium severity advisory GHSA-j656-3hf2-fvjc affecting @bytebase/dbhub. Patched in @bytebase/dbhub 0.22.6.", "severity": "medium", "cvssScore": 6.1, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "epssPercentile": null, "cwes": [ "CWE-436", "CWE-863" ], "affected": [ { "ecosystem": "npm", "name": "@bytebase/dbhub", "vulnerableVersionRange": "< 0.22.6", "firstPatchedVersion": "0.22.6" } ], "matchedTerms": [ "prompt injection", "ai agent", "AI" ], "disclosedAt": "2026-11-02", "sourceUpdatedAt": "2026-11-02T17:57:52Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-j656-3hf2-fvjc", "references": [ "https://github.com/bytebase/dbhub/security/advisories/GHSA-j656-3hf2-fvjc", "https://github.com/bytebase/dbhub/pull/342", "https://github.com/bytebase/dbhub/commit/872bb338f7d31f6afe517a076ac3e3edafaaaf08", "https://github.com/bytebase/dbhub/releases/tag/v0.22.6", "https://github.com/advisories/GHSA-j656-3hf2-fvjc" ], "evidence": "The read-only mode can be bypassed on the MySQL and MariaDB connectors. In read-only mode a caller can still execute arbitrary write and DDL statements (for example DROP TABLE), which defeats the protection that read-only mode is meant to provide when a database is exposed to an AI agent. Root cause The problem is a mismatch between how DBHub's SQL parser handles single-line comments and how MySQL and MariaDB actuall", "firstSeenAt": "2026-11-02T18:12:51.590Z", "publishedAt": "2026-11-02T18:12:51.590Z", "updatedAt": "2026-11-02T18:12:51.590Z", "revision": 1, "baseline": false }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:38b92803", "type": "incident", "advisoryId": "incident:38b92803", "cveId": null, "title": "Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers", "summary": "The Hacker News reported a security matter involving Langflow on 2026-11-02 (vulnerability, flaw, flaws). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Langflow", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Langflow", "AI" ], "signals": [ "vulnerability", "flaw", "flaws" ], "disclosedAt": "2026-11-02", "sourceUpdatedAt": "2026-11-02T11:50:00.000Z", "sourceId": "the-hacker-news", "sourceUrl": "https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html", "references": [], "evidence": "Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said last week. Langflow is an open-source tool for building AI agents and workflows, and its vulnerability reports go to IBM. Every release from 1.0.0 through 1.12.8 has the flaws, and the only fix is version 1.13.0. Neither flaw is in CISA's Known", "firstSeenAt": "2026-11-02T13:27:51.580Z", "publishedAt": "2026-11-02T13:27:51.580Z", "updatedAt": "2026-11-02T13:27:51.580Z", "revision": 1, "baseline": false }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:c5c227ed", "type": "incident", "advisoryId": "incident:c5c227ed", "cveId": null, "title": "New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value", "summary": "The Hacker News reported a security matter involving Claude, Gemini, Kimi on 2026-11-02 (malware, infostealer). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Claude", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Gemini", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Kimi", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Claude", "Gemini", "Kimi", "large language model", "LLM", "AI" ], "signals": [ "malware", "infostealer" ], "disclosedAt": "2026-11-02", "sourceUpdatedAt": "2026-11-02T05:51:07.000Z", "sourceId": "the-hacker-news", "sourceUrl": "https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html", "references": [], "evidence": "Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces;", "firstSeenAt": "2026-11-02T06:12:51.522Z", "publishedAt": "2026-11-02T06:12:51.522Z", "updatedAt": "2026-11-02T06:12:51.522Z", "revision": 1, "baseline": false }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:CVE-2026-105811", "type": "incident", "advisoryId": "CVE-2026-105811", "cveId": "CVE-2026-105811", "title": "CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS", "summary": "AWS security bulletins reported a security matter involving Amazon Q on 2026-11-02 (security bulletin). Tracks CVE-2026-105811.", "affected": [ { "ecosystem": "product", "name": "Amazon Q", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Amazon Q" ], "signals": [ "security bulletin" ], "disclosedAt": "2026-11-02", "sourceUpdatedAt": "2026-11-02T21:40:44.000Z", "sourceId": "aws-security-bulletins", "sourceUrl": "https://aws.amazon.com/security/security-bulletins/rss/2026-126-aws", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-105811" ], "evidence": "Read this article Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:CVE-2026-116635", "type": "incident", "advisoryId": "CVE-2026-116635", "cveId": "CVE-2026-116635", "title": "CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server", "summary": "AWS security bulletins reported a security matter on 2026-11-02 (security bulletin). Tracks CVE-2026-116635.", "affected": [], "matchedTerms": [ "mcp server" ], "signals": [ "security bulletin" ], "disclosedAt": "2026-11-02", "sourceUpdatedAt": "2026-11-02T21:43:24.000Z", "sourceId": "aws-security-bulletins", "sourceUrl": "https://aws.amazon.com/security/security-bulletins/rss/2026-164-aws", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-116635" ], "evidence": "Bulletin ID: 2026-164-AWS Publication Date: 11/02/2026 13:30 PM PST Description: We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in the deployment status component of the MCP server might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been ena", "firstSeenAt": "2026-11-02T21:57:51.579Z", "publishedAt": "2026-11-02T21:57:51.579Z", "updatedAt": "2026-11-02T21:57:51.579Z", "revision": 1, "baseline": false }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:CVE-2026-98432", "type": "incident", "advisoryId": "CVE-2026-98432", "cveId": "CVE-2026-98432", "title": "Backporting security fixes at scale with Codex", "summary": "Trail of Bits blog reported a security matter involving Codex, OpenAI on 2026-11-02 (vulnerability, vulnerabilities, flaw). Tracks CVE-2026-98432.", "affected": [ { "ecosystem": "product", "name": "Codex", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "OpenAI", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Codex", "OpenAI" ], "signals": [ "vulnerability", "vulnerabilities", "flaw", "flaws", "exploited", "exploitable", "sandbox escape" ], "disclosedAt": "2026-11-02", "sourceUpdatedAt": "2026-11-02T12:00:00.000Z", "sourceId": "trail-of-bits", "sourceUrl": "https://blog.trailofbits.com/2026/11/02/backporting-security-fixes-at-scale-with-codex", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-98432" ], "evidence": "Stable Linux releases lack existing security fixes because backporting them is time-consuming and often thankless work. We’re using Codex to reduce the backporting process time from days to hours per fix, empowering human patch reviewers to rapidly submit fixes for critical software like Ubuntu Long Term Support, Fedora, and the Linux kernel. By October 29, our project helped deliver fixes for 149 distinct CVEs into ", "firstSeenAt": "2026-11-02T12:12:51.486Z", "publishedAt": "2026-11-02T12:12:51.486Z", "updatedAt": "2026-11-02T12:12:51.486Z", "revision": 1, "baseline": false }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:dbc90a46", "type": "incident", "advisoryId": "incident:dbc90a46", "cveId": null, "title": "Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines", "summary": "StepSecurity blog reported a security matter involving Claude Code, Cursor on 2026-11-01 (backdoor). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Claude Code", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Cursor", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Claude Code", "Cursor" ], "signals": [ "backdoor" ], "disclosedAt": "2026-11-01", "sourceUpdatedAt": "2026-11-01T07:22:46.000Z", "sourceId": "stepsecurity", "sourceUrl": "https://www.stepsecurity.io/blog/claude-code-extension-trojanized", "references": [], "evidence": "On October 29, 2026, trojanized builds (2.1.312 and 2.1.313) of the official Claude Code VS Code extension were published to Cursor's VS Code Extension Marketplace for macOS and Windows.", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:40a14f1c", "type": "incident", "advisoryId": "incident:40a14f1c", "cveId": null, "title": "A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats", "summary": "The Hacker News reported a security matter involving ChatGPT, OpenAI on 2026-10-31 (flaw, malicious). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "ChatGPT", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "OpenAI", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "ChatGPT", "OpenAI" ], "signals": [ "flaw", "malicious" ], "disclosedAt": "2026-10-31", "sourceUpdatedAt": "2026-10-31T05:33:41.000Z", "sourceId": "the-hacker-news", "sourceUrl": "https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html", "references": [], "evidence": "A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed. The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category.", "firstSeenAt": "2026-10-31T05:57:51.399Z", "publishedAt": "2026-10-31T05:57:51.399Z", "updatedAt": "2026-10-31T05:57:51.399Z", "revision": 1, "baseline": false }, { "id": "ghsa:GHSA-j63v-mwhm-56jx", "type": "advisory", "advisoryId": "GHSA-j63v-mwhm-56jx", "cveId": "CVE-2026-118763", "title": "@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location", "summary": "High severity advisory GHSA-j63v-mwhm-56jx (CVE-2026-118763) affecting @sigstore/oci. Patched in @sigstore/oci 0.7.2.", "severity": "high", "cvssScore": 7.4, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "epssPercentile": 0.22718, "cwes": [ "CWE-522" ], "affected": [ { "ecosystem": "npm", "name": "@sigstore/oci", "vulnerableVersionRange": "<= 0.7.1", "firstPatchedVersion": "0.7.2" } ], "matchedTerms": [ "AI" ], "disclosedAt": "2026-10-30", "sourceUpdatedAt": "2026-10-30T23:00:19Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-j63v-mwhm-56jx", "references": [ "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-j63v-mwhm-56jx", "https://nvd.nist.gov/vuln/detail/CVE-2026-118763", "https://github.com/sigstore/sigstore-js/pull/1762", "https://github.com/sigstore/sigstore-js/commit/b855f46cfe81f26481c6d3f4b333dfd00f2fd1b1", "https://github.com/sigstore/sigstore-js/commit/e4ca65c3ab3c675456ab9b0bd04217ceccad3558", "https://github.com/sigstore/sigstore-js/releases/tag/@sigstore/oci@0.7.2", "https://github.com/advisories/GHSA-j63v-mwhm-56jx" ], "evidence": "### Summary @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location ## Affected versions and vulnerable location - Confirmed on sigstore-js at 3a83271 (current HEAD). - File: packages/oci/src/registry.ts. - signIn() installs the credential as a DEFAULT header on the shared client: this.#fetch = this.#fetch.defaults({ headers: { [HEADER_AUTHORIZATION]: 'Basic ' + basicAuth } }) (:126", "firstSeenAt": "2026-10-30T23:12:51.713Z", "publishedAt": "2026-10-30T23:12:51.713Z", "updatedAt": "2026-10-30T23:12:51.713Z", "revision": 1, "baseline": false }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:17174e35", "type": "incident", "advisoryId": "incident:17174e35", "cveId": null, "title": "Anthropic: That Claude Code extension compromise… couldn't be us", "summary": "The Register security reported a security matter involving Claude Code, Anthropic, Cursor on 2026-10-30 (flaw, backdoor, malicious). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Claude Code", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Anthropic", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Cursor", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Claude Code", "Anthropic", "Cursor" ], "signals": [ "flaw", "backdoor", "malicious", "compromised", "compromise", "tampered", "breach", "rotated" ], "disclosedAt": "2026-10-30", "sourceUpdatedAt": "2026-10-30T16:27:00.000Z", "sourceId": "the-register-security", "sourceUrl": "https://www.theregister.com/cyber-crime/2026/10/30/anthropic-that-claude-code-extension-compromise-couldnt-be-us/5306682", "references": [], "evidence": "Anthropic has denied allegations that a malicious version of the official Claude Code extension published to Cursor’s marketplace was linked to any kind of compromise of its own systems. The company was forced to issue a statement after prominent figures in the cybersecurity industry alleged that the extension, which infected up to 5,000 developers, was uploaded to Cursor’s marketplace following a breach at Claudemak", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:3a3d44de", "type": "incident", "advisoryId": "incident:3a3d44de", "cveId": null, "title": "Malicious Claude Code extension on Cursor planted SSH backdoors", "summary": "BleepingComputer reported a security matter involving Claude Code, Cursor, Anthropic on 2026-10-30 (malicious, malware). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Claude Code", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Cursor", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Anthropic", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Claude Code", "Cursor", "Anthropic" ], "signals": [ "malicious", "malware" ], "disclosedAt": "2026-10-30", "sourceUpdatedAt": "2026-10-30T14:36:54.000Z", "sourceId": "bleepingcomputer", "sourceUrl": "https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors", "references": [], "evidence": "A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors. [...]", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:8466af95", "type": "incident", "advisoryId": "incident:8466af95", "cveId": null, "title": "Compromised Claude Code extensions (versions 2.1.312 & 2.1.313) in Cursor try to install a backdoor", "summary": "OX Security research reported a security matter involving Claude Code, Cursor, Anthropic on 2026-10-30 (vulnerability, backdoor, malicious). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Claude Code", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Cursor", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Anthropic", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Claude Code", "Cursor", "Anthropic", "AI" ], "signals": [ "vulnerability", "backdoor", "malicious", "compromised", "compromise", "supply chain", "tampered", "rotated" ], "disclosedAt": "2026-10-30", "sourceUpdatedAt": "2026-10-30T13:20:40.000Z", "sourceId": "ox-security", "sourceUrl": "https://www.ox.security/blog/malicious-claude-code-extension-cursor-ssh-backdoor", "references": [], "evidence": "Maliciously modified versions 2.1.312 and 2.1.313 of Anthropic’s Claude Code extension run malicious code that attempts to install a persistent SSH backdoor. Overview On October 29, 2026, maliciously modified versions of the Anthropic.claude-code extension, 2.1.312 and 2.1.313 for Windows and macOS, were available in the Cursor VS Code Extension Marketplace between about 2:27 AM and 1:35 PM PT . The malicious version", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:ea6ac210", "type": "incident", "advisoryId": "incident:ea6ac210", "cveId": null, "title": "Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor", "summary": "The Hacker News reported a security matter involving Claude Code, Cursor, Anthropic on 2026-10-30 (backdoor, malicious). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Claude Code", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Cursor", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Anthropic", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Claude Code", "Cursor", "Anthropic" ], "signals": [ "backdoor", "malicious" ], "disclosedAt": "2026-10-30", "sourceUpdatedAt": "2026-10-30T08:55:47.000Z", "sourceId": "the-hacker-news", "sourceUrl": "https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html", "references": [], "evidence": "Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. The malicious update, version 2.1.313, was distributed under the extension's legitimate publisher identity, prompting Cursor to temporarily shut", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-26mh-57q7-jfvr", "type": "advisory", "advisoryId": "GHSA-26mh-57q7-jfvr", "cveId": "CVE-2026-61438", "title": "PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox", "summary": "High severity advisory GHSA-26mh-57q7-jfvr (CVE-2026-61438) affecting praisonai. Patched in praisonai 4.6.78.", "severity": "high", "cvssScore": 7.3, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "epssPercentile": 0.23661, "cwes": [ "CWE-78", "CWE-184", "CWE-693" ], "affected": [ { "ecosystem": "pip", "name": "praisonai", "vulnerableVersionRange": "< 4.6.78", "firstPatchedVersion": "4.6.78" } ], "matchedTerms": [ "AI" ], "disclosedAt": "2026-10-29", "sourceUpdatedAt": "2026-10-29T16:34:28Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-26mh-57q7-jfvr", "references": [ "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-26mh-57q7-jfvr", "https://nvd.nist.gov/vuln/detail/CVE-2026-61438", "https://nvd.nist.gov/vuln/detail/CVE-2026-62248", "https://www.vulncheck.com/advisories/praisonai-before-remote-code-execution-via-broken-ast-sandbox", "https://github.com/advisories/GHSA-26mh-57q7-jfvr" ], "evidence": "### Summary JobWorkflowExecutor._exec_inline_python() is designed to safely execute inline Python expressions from YAML workflow script: steps using AST validation. The function claims to block dangerous operations by (a) checking all AST nodes against an allowlist, and (b) providing a __builtins__ whitelist that omits __import__, exec, eval, and open. The sandbox is broken. The module import allowlist (allowed_modul", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-w9x9-j56r-h98r", "type": "advisory", "advisoryId": "GHSA-w9x9-j56r-h98r", "cveId": null, "title": "@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy", "summary": "High severity advisory GHSA-w9x9-j56r-h98r affecting @eeacms/volto-chatbot. Patched in @eeacms/volto-chatbot 2.0.4.", "severity": "high", "cvssScore": 8.2, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "epssPercentile": null, "cwes": [ "CWE-862" ], "affected": [ { "ecosystem": "npm", "name": "@eeacms/volto-chatbot", "vulnerableVersionRange": "<= 2.0.3", "firstPatchedVersion": "2.0.4" } ], "matchedTerms": [ "chatbot" ], "disclosedAt": "2026-10-29", "sourceUpdatedAt": "2026-10-29T16:35:49Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-w9x9-j56r-h98r", "references": [ "https://github.com/eea/volto-chatbot/security/advisories/GHSA-w9x9-j56r-h98r", "https://github.com/eea/volto-chatbot/commit/eaf18b7c0f23560086b300bf0c5e62f9f76ad7b0", "https://github.com/eea/volto-chatbot/releases/tag/2.0.4", "https://github.com/advisories/GHSA-w9x9-j56r-h98r" ], "evidence": "## Unauthenticated Danswer API Confused Deputy Proxy in @eeacms/volto-chatbot ### Summary @eeacms/volto-chatbot exposes an Express middleware route (/_v1_da/) that accepts unauthenticated HTTP requests from any network client and proxies them to the configured upstream Danswer API, automatically attaching the server-side service credentials (DANSWER_API_KEY or session cookie). Because no authorization check, path all", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:250ac89f", "type": "incident", "advisoryId": "incident:250ac89f", "cveId": null, "title": "Claude Model Builds Exploits Across Major Browsers & OSes", "summary": "Dark Reading reported a security matter involving Claude on 2026-10-29 (exploits). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Claude", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Claude" ], "signals": [ "exploits" ], "disclosedAt": "2026-10-29", "sourceUpdatedAt": "2026-10-29T18:15:59.000Z", "sourceId": "dark-reading", "sourceUrl": "https://www.darkreading.com/application-security/claude-model-exploits-major-browsers-oses", "references": [], "evidence": "anthropic_Algi_Febri_Sugita_shutterstock.jpg", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:71f9eb62", "type": "incident", "advisoryId": "incident:71f9eb62", "cveId": null, "title": "Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners", "summary": "The Hacker News reported a security matter involving Claude, ChatGPT, Anthropic, OpenAI and 1 more on 2026-10-29 (malicious, malware). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Claude", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "ChatGPT", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Anthropic", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "OpenAI", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "GPT-5", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Claude", "ChatGPT", "Anthropic", "OpenAI", "GPT-5" ], "signals": [ "malicious", "malware" ], "disclosedAt": "2026-10-29", "sourceUpdatedAt": "2026-10-29T15:20:29.000Z", "sourceId": "the-hacker-news", "sourceUrl": "https://thehackernews.com/2026/10/fake-chatgpt-and-claude-apps-abuse.html", "references": [], "evidence": "Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver a malware family called", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:81725f5f", "type": "incident", "advisoryId": "incident:81725f5f", "cveId": null, "title": "Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched", "summary": "The Register security reported a security matter involving OpenAI, Claude Desktop, Anthropic, Codex and 2 more on 2026-10-29 (vulnerability, vulnerabilities, flaw). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "OpenAI", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Claude Desktop", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Anthropic", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Codex", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "GitHub Copilot", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Cursor", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "OpenAI", "Claude Desktop", "Anthropic", "Codex", "GitHub Copilot", "Cursor", "prompt injection" ], "signals": [ "vulnerability", "vulnerabilities", "flaw", "flaws", "arbitrary code execution", "code execution", "prompt injection", "security advisory" ], "disclosedAt": "2026-10-29", "sourceUpdatedAt": "2026-10-29T23:12:26.000Z", "sourceId": "the-register-security", "sourceUrl": "https://www.theregister.com/security/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched/5306508", "references": [], "evidence": "Multiple vulnerabilities in five popular AI developer tools could allow attackers to execute code on a host machine, read and steal files, or spoof browser address bars. Researchers say flaws in OpenAI's Codex and Microsoft's VS Code remain unpatched, potentially putting developers who use affected configurations at risk. AI security startup Forever Security discovered vulnerabilities in Cursor, GitHub Copilot, Anthr", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:e9e91cfc", "type": "incident", "advisoryId": "incident:e9e91cfc", "cveId": null, "title": "Cohere’s Qwen Story: Looks More Like Model Jaggedness", "summary": "Check Point Research reported a security matter involving Qwen, vLLM on 2026-10-29 (backdoor). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Qwen", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "vLLM", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Qwen", "vLLM", "AI" ], "signals": [ "backdoor" ], "disclosedAt": "2026-10-29", "sourceUpdatedAt": "2026-10-29T14:08:46.000Z", "sourceId": "checkpoint-research", "sourceUrl": "https://research.checkpoint.com/2026/coheres-qwen-story-looks-more-like-model-jaggedness", "references": [], "evidence": "Key findings Re-sampling URLs from the trace shared by Cohere yields 52 different destination hosts, many of which are local or do not exist, and one is an invalid top-level domain. Swapping the order of two program names in a check for available tools made the model much less likely to continue with a network call. Model jaggedness (inconsistent behavior that changes with small differences in context) seems like a m", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:f3663a8f", "type": "incident", "advisoryId": "incident:f3663a8f", "cveId": null, "title": "Hugging Face malware campaign returns to hijack GPUs for crypto mining", "summary": "BleepingComputer reported a security matter involving Hugging Face on 2026-10-29 (malware, hijack). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Hugging Face", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Hugging Face", "AI" ], "signals": [ "malware", "hijack" ], "disclosedAt": "2026-10-29", "sourceUpdatedAt": "2026-10-29T22:09:24.000Z", "sourceId": "bleepingcomputer", "sourceUrl": "https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining", "references": [], "evidence": "A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. [...]", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:fde2c075", "type": "incident", "advisoryId": "incident:fde2c075", "cveId": null, "title": "Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities", "summary": "The Hacker News reported a security matter involving Gemini on 2026-10-29 (vulnerabilities, exploitation). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Gemini", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Gemini", "agentic" ], "signals": [ "vulnerabilities", "exploitation" ], "disclosedAt": "2026-10-29", "sourceUpdatedAt": "2026-10-29T13:42:40.000Z", "sourceId": "the-hacker-news", "sourceUrl": "https://thehackernews.com/2026/10/googles-gemini-4-carbon-leads.html", "references": [], "evidence": "Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities. \"It shows significant gains across coding and agentic tasks as well as across key capabilities critical for cybersecurity defense, landing a firm lead in SEC-bench Pro (88.2%) for finding vulnerabilities, ExploitGym (54.8%) for exploitation, and", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "osv:MAL-2026-2144", "type": "incident", "advisoryId": "MAL-2026-2144", "cveId": null, "title": "Malicious code in litellm (PyPI)", "summary": "OSV lists litellm (pypi) as malicious in MAL-2026-2144, versions 1.82.7, 1.82.8, 1.107.0. Remove or pin away from the affected versions.", "affected": [ { "ecosystem": "pypi", "name": "litellm", "vulnerableVersionRange": "1.82.7, 1.82.8, 1.107.0", "firstPatchedVersion": null } ], "matchedTerms": [ "litellm" ], "signals": [ "malicious" ], "disclosedAt": "2026-10-29", "sourceUpdatedAt": "2026-10-29T14:30:33.719516315Z", "sourceId": "osv-malicious", "sourceUrl": "https://osv.dev/vulnerability/MAL-2026-2144", "references": [ "https://github.com/BerriAI/litellm/issues/24518", "https://github.com/BerriAI/litellm/issues/24512", "https://news.ycombinator.com/item?id=47501729", "https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign", "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/", "https://github.com/BerriAI/litellm/issues/47826", "https://pypi.org/project/litellm/1.107.0/" ], "evidence": "litellm 1.107.0, uploaded to PyPI on 2026-10-21 between 11:39 and 11:40 UTC, contains a credential stealer and a remote code execution backdoor that are not in the upstream source (the v1.107.0 git tag of BerriAI/litellm does not contain them): they were injected at build or upload time. Every wheel ships three extra files under litellm-1.107.0.data/purelib/, which pip installs at the site-packages root, so the paylo", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-3fx2-cqw9-xr3c", "type": "advisory", "advisoryId": "GHSA-3fx2-cqw9-xr3c", "cveId": "CVE-2026-118667", "title": "LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests", "summary": "Medium severity advisory GHSA-3fx2-cqw9-xr3c (CVE-2026-118667) affecting langgraph-sdk, langgraph. Patched in langgraph-sdk 0.4.6.", "severity": "medium", "cvssScore": 4.3, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "epssPercentile": 0.33545, "cwes": [ "CWE-22" ], "affected": [ { "ecosystem": "pip", "name": "langgraph-sdk", "vulnerableVersionRange": ">= 0.4.0, < 0.4.6", "firstPatchedVersion": "0.4.6" }, { "ecosystem": "pip", "name": "langgraph", "vulnerableVersionRange": ">= 1.2.3, < 1.2.14", "firstPatchedVersion": "1.2.14" } ], "matchedTerms": [ "langgraph" ], "disclosedAt": "2026-10-28", "sourceUpdatedAt": "2026-10-28T21:05:48Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-3fx2-cqw9-xr3c", "references": [ "https://github.com/langchain-ai/langgraph/security/advisories/GHSA-3fx2-cqw9-xr3c", "https://github.com/langchain-ai/langgraph/pull/9213", "https://github.com/langchain-ai/langgraph/commit/d89c7e100ec6fc1512544d23b0a7c5169699ef3e", "https://github.com/langchain-ai/langgraph/releases/tag/1.2.14", "https://github.com/langchain-ai/langgraph/releases/tag/sdk%3D%3D0.4.6", "https://github.com/advisories/GHSA-3fx2-cqw9-xr3c" ], "evidence": "### Summary The LangGraph Python SDK v3 streaming client interpolates caller-supplied thread_id and assistant_id values into request paths without encoding them at four synchronous and asynchronous call sites. Relative path segments can therefore redirect an authenticated GET request to another path on the same configured server. ### Details The affected get_tree and _fetch_state implementations build request paths f", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-48m4-24cq-37qf", "type": "advisory", "advisoryId": "GHSA-48m4-24cq-37qf", "cveId": "CVE-2026-115919", "title": "ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)", "summary": "Medium severity advisory GHSA-48m4-24cq-37qf (CVE-2026-115919) affecting onnx. Patched in onnx 1.22.0.", "severity": "medium", "cvssScore": 6.2, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.07353, "cwes": [ "CWE-125" ], "affected": [ { "ecosystem": "pip", "name": "onnx", "vulnerableVersionRange": "<= 1.21.0", "firstPatchedVersion": "1.22.0" } ], "matchedTerms": [ "onnx" ], "disclosedAt": "2026-10-28", "sourceUpdatedAt": "2026-10-28T21:16:24Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-48m4-24cq-37qf", "references": [ "https://github.com/onnx/onnx/security/advisories/GHSA-48m4-24cq-37qf", "https://nvd.nist.gov/vuln/detail/CVE-2026-115919", "https://github.com/onnx/onnx/pull/7879", "https://github.com/onnx/onnx/commit/92e541266af5dd38cfa48aeb92206f4268a066cd", "https://github.com/onnx/onnx/releases/tag/v1.22.0", "https://github.com/advisories/GHSA-48m4-24cq-37qf" ], "evidence": "## Summary ONNX shape inference performed an out-of-bounds read when processing a malformed RNN, GRU, or LSTM node from opsets 1–6 whose first input had a rank other than three. RNNShapeInference_opset1_to_6() checked whether the input shape was present but accessed dim(0) and dim(1) without first checking its rank. A crafted model could therefore terminate a process that called onnx.shape_inference.infer_shapes(). T", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-5324-3w58-qpp2", "type": "advisory", "advisoryId": "GHSA-5324-3w58-qpp2", "cveId": "CVE-2026-116575", "title": "Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)", "summary": "Medium severity advisory GHSA-5324-3w58-qpp2 (CVE-2026-116575) affecting mem0ai. Patched in mem0ai 2.0.18.", "severity": "medium", "cvssScore": 6.3, "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "epssPercentile": 0.01187, "cwes": [ "CWE-200", "CWE-863" ], "affected": [ { "ecosystem": "pip", "name": "mem0ai", "vulnerableVersionRange": "< 2.0.18", "firstPatchedVersion": "2.0.18" }, { "ecosystem": "npm", "name": "mem0ai", "vulnerableVersionRange": "< 3.1.6", "firstPatchedVersion": "3.1.6" } ], "matchedTerms": [ "mem0ai", "LLM" ], "disclosedAt": "2026-10-28", "sourceUpdatedAt": "2026-10-28T21:17:08Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-5324-3w58-qpp2", "references": [ "https://github.com/mem0ai/mem0/security/advisories/GHSA-5324-3w58-qpp2", "https://nvd.nist.gov/vuln/detail/CVE-2026-116575", "https://github.com/mem0ai/mem0/pull/6892", "https://github.com/mem0ai/mem0/commit/71f2ebefa3494da21550fb525216818776cde67f", "https://github.com/mem0ai/mem0/releases/tag/ts-v3.1.6", "https://github.com/mem0ai/mem0/releases/tag/v2.0.18", "https://github.com/advisories/GHSA-5324-3w58-qpp2" ], "evidence": "Summary _build_session_scope() in mem0/memory/main.py builds the conversation-history scope key used to fetch/store the last N raw messages by naively joining caller-supplied user_id/agent_id/run_id values with unescaped & and = delimiters: def _build_session_scope(filters): parts = [] for key in sorted([\"user_id\", \"agent_id\", \"run_id\"]): val = filters.get(key) if val: parts.append(f\"{key}={val}\") return \"&\".join(par", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-542m-9234-8gvf", "type": "advisory", "advisoryId": "GHSA-542m-9234-8gvf", "cveId": "CVE-2026-115911", "title": "vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool", "summary": "Medium severity advisory GHSA-542m-9234-8gvf (CVE-2026-115911) affecting vllm. Patched in vllm 0.32.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.24041, "cwes": [ "CWE-400", "CWE-770", "CWE-834" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": ">= 0.19.0, < 0.32.0", "firstPatchedVersion": "0.32.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-10-28", "sourceUpdatedAt": "2026-10-28T21:14:54Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-542m-9234-8gvf", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-542m-9234-8gvf", "https://nvd.nist.gov/vuln/detail/CVE-2026-115911", "https://github.com/vllm-project/vllm/pull/50300", "https://github.com/vllm-project/vllm/commit/cff08b461e086523cee8bba5bd3c66d302625134", "https://github.com/vllm-project/vllm/releases/tag/v0.32.0", "https://github.com/advisories/GHSA-542m-9234-8gvf" ], "evidence": "### Summary vLLM renders chat templates by passing the resolved Jinja2 source to tokenizer.apply_chat_template(), which compiles and .render()s it in an ImmutableSandboxedEnvironment. The sandbox prevents code-execution escapes but imposes no wall-clock timeout, no output-size cap, and no nested-loop or binop limit. The render runs in a ThreadPoolExecutor whose max_workers defaults to 1, and CPython worker threads ca", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-6757-hggm-hp2w", "type": "advisory", "advisoryId": "GHSA-6757-hggm-hp2w", "cveId": "CVE-2026-115912", "title": "vLLM: Public multimodal SHM handle forgery reaches worker-side pickle.loads() with insecure serialization disabled", "summary": "High severity advisory GHSA-6757-hggm-hp2w (CVE-2026-115912) affecting vllm. Patched in vllm 0.32.0.", "severity": "high", "cvssScore": 7.5, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "epssPercentile": 0.43527, "cwes": [ "CWE-502" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": "< 0.32.0", "firstPatchedVersion": "0.32.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-10-28", "sourceUpdatedAt": "2026-10-28T21:15:16Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-6757-hggm-hp2w", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-6757-hggm-hp2w", "https://nvd.nist.gov/vuln/detail/CVE-2026-115912", "https://github.com/vllm-project/vllm/pull/59357", "https://github.com/vllm-project/vllm/commit/3d5625cc3c2474994107047d7a6ecb8e4008f9b0", "https://github.com/vllm-project/vllm/releases/tag/v0.32.0", "https://github.com/advisories/GHSA-6757-hggm-hp2w" ], "evidence": "## Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM MultiModalKwargsItem: assert mm_item is not None, f\"Expected an address item for {mm_hash=}\" if \"address\" in mm_item: address = cast(int, mm_item[\"address\"].data) monotonic_id = cast(int, mm_item[\"monotonic_id\"].data) return self._shm_cache.get(address, monotonic_id) return mm_item The dereference lands in the SHM deserializer, which pickle.loads", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-6pwm-x34p-fvj2", "type": "advisory", "advisoryId": "GHSA-6pwm-x34p-fvj2", "cveId": "CVE-2026-115920", "title": "ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank", "summary": "Medium severity advisory GHSA-6pwm-x34p-fvj2 (CVE-2026-115920) affecting onnx. Patched in onnx 1.22.0.", "severity": "medium", "cvssScore": 6.2, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.07353, "cwes": [ "CWE-125" ], "affected": [ { "ecosystem": "pip", "name": "onnx", "vulnerableVersionRange": ">= 1.2.1, <= 1.21.0", "firstPatchedVersion": "1.22.0" } ], "matchedTerms": [ "onnx" ], "disclosedAt": "2026-10-28", "sourceUpdatedAt": "2026-10-28T21:16:43Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-6pwm-x34p-fvj2", "references": [ "https://github.com/onnx/onnx/security/advisories/GHSA-6pwm-x34p-fvj2", "https://nvd.nist.gov/vuln/detail/CVE-2026-115920", "https://github.com/onnx/onnx/pull/7997", "https://github.com/onnx/onnx/commit/2ec288908952eea9dcf48d4b197915e1f72c6abf", "https://github.com/onnx/onnx/releases/tag/v1.22.0", "https://github.com/advisories/GHSA-6pwm-x34p-fvj2" ], "evidence": "## Summary ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did not provide a kernel_shape attribute. The inference function derived an empty effective_kernel_shape vector from the undersized weight tensor, then indexed that vector once for each spatial dimension of the input tensor. A crafted model passed onnx.checker.check_model(", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-8397-8qf6-f2gm", "type": "advisory", "advisoryId": "GHSA-8397-8qf6-f2gm", "cveId": "CVE-2026-115913", "title": "vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine", "summary": "Medium severity advisory GHSA-8397-8qf6-f2gm (CVE-2026-115913) affecting vllm. Patched in vllm 0.32.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.26054, "cwes": [ "CWE-770" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": "< 0.32.0", "firstPatchedVersion": "0.32.0" } ], "matchedTerms": [ "vllm", "pytorch" ], "disclosedAt": "2026-10-28", "sourceUpdatedAt": "2026-10-28T21:15:42Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-8397-8qf6-f2gm", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-8397-8qf6-f2gm", "https://nvd.nist.gov/vuln/detail/CVE-2026-115913", "https://github.com/vllm-project/vllm/pull/60614", "https://github.com/vllm-project/vllm/commit/3d52578e13454de0bb8352cac988347cdcc89928", "https://github.com/vllm-project/vllm/releases/tag/v0.32.0", "https://github.com/advisories/GHSA-8397-8qf6-f2gm" ], "evidence": "### Summary The Phi-4 multimodal audio encoder (phi4mm_audio.py / phi4mm_utils.py) runs its conformer attention in eager mode by default: the official HF config of microsoft/Phi-4-multimodal-instruct does not set use_pt_scaled_dot_product_attention, so the default False applies (phi4mm_audio.py:166, :876; phi4mm_utils.py:1669). The eager path fully materializes the attention probability matrix of shape [n_chunks, 16,", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-gq5q-89c7-vhvx", "type": "advisory", "advisoryId": "GHSA-gq5q-89c7-vhvx", "cveId": "CVE-2026-115914", "title": "vLLM DeepSeek-OCR image processing vulnerable to denial of service", "summary": "Medium severity advisory GHSA-gq5q-89c7-vhvx (CVE-2026-115914) affecting vllm. Patched in vllm 0.32.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.33882, "cwes": [ "CWE-617" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": ">= 0.11.1, < 0.32.0", "firstPatchedVersion": "0.32.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-10-28", "sourceUpdatedAt": "2026-10-28T21:15:36Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-gq5q-89c7-vhvx", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-gq5q-89c7-vhvx", "https://nvd.nist.gov/vuln/detail/CVE-2026-115914", "https://github.com/vllm-project/vllm/pull/59417", "https://github.com/vllm-project/vllm/commit/c15672cfb49152ebf65cfd188e71b84593ec5686", "https://github.com/vllm-project/vllm/releases/tag/v0.32.0", "https://github.com/advisories/GHSA-gq5q-89c7-vhvx" ], "evidence": "## Summary Any vLLM deployment serving a model of the DeepSeek-OCR family — deepseek-ai/DeepSeek-OCR, deepseek-ai/DeepSeek-OCR-2, or baidu/Unlimited-OCR (whose UnlimitedOCRForCausalLM subclasses DeepseekOCRForCausalLM) — can be killed by a single unauthenticated chat request carrying an ordinary, schema-valid PNG image, under completely default server configuration. The image model's input validation contains a guard", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-h3rc-j82p-2c3h", "type": "advisory", "advisoryId": "GHSA-h3rc-j82p-2c3h", "cveId": "CVE-2026-115915", "title": "vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE", "summary": "High severity advisory GHSA-h3rc-j82p-2c3h (CVE-2026-115915) affecting vllm. Patched in vllm 0.32.0.", "severity": "high", "cvssScore": 8.1, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "epssPercentile": 0.51532, "cwes": [ "CWE-20", "CWE-183" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": "< 0.32.0", "firstPatchedVersion": "0.32.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-10-28", "sourceUpdatedAt": "2026-10-28T21:15:30Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-h3rc-j82p-2c3h", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-j82p-2c3h", "https://nvd.nist.gov/vuln/detail/CVE-2026-115915", "https://github.com/vllm-project/vllm/pull/60022", "https://github.com/vllm-project/vllm/commit/710ac56e691d4713feca50a43e6c440f07d373fd", "https://github.com/vllm-project/vllm/releases/tag/v0.32.0", "https://github.com/advisories/GHSA-h3rc-j82p-2c3h" ], "evidence": "### Summary In vLLM 0.30.0, ImageMediaIO passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted formats; the request's MIME label does not constrain decoder selection. An EPS payload labeled image/png reached the host's Ghostscript executable. On a host with Ghostscript affected by CVE-2024-29510, this exposes the known Ghostscript sandbox escape through vLLM's image-", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-m4pr-6v3c-6fgr", "type": "advisory", "advisoryId": "GHSA-m4pr-6v3c-6fgr", "cveId": "CVE-2026-115921", "title": "ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute", "summary": "Medium severity advisory GHSA-m4pr-6v3c-6fgr (CVE-2026-115921) affecting onnx. Patched in onnx 1.22.0.", "severity": "medium", "cvssScore": 6.2, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.02674, "cwes": [ "CWE-195", "CWE-476" ], "affected": [ { "ecosystem": "pip", "name": "onnx", "vulnerableVersionRange": ">= 1.4.0, <= 1.21.0", "firstPatchedVersion": "1.22.0" } ], "matchedTerms": [ "onnx" ], "disclosedAt": "2026-10-28", "sourceUpdatedAt": "2026-10-28T21:16:32Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-m4pr-6v3c-6fgr", "references": [ "https://github.com/onnx/onnx/security/advisories/GHSA-m4pr-6v3c-6fgr", "https://nvd.nist.gov/vuln/detail/CVE-2026-115921", "https://github.com/onnx/onnx/pull/7916", "https://github.com/onnx/onnx/commit/dd6bc92ea39fd2274fd671f0734b0b8b558356f5", "https://github.com/onnx/onnx/releases/tag/v1.22.0", "https://github.com/advisories/GHSA-m4pr-6v3c-6fgr" ], "evidence": "## Summary ONNX shape inference did not safely validate the required Scan num_scan_inputs attribute. Two malformed values could terminate or disrupt the process: 1. If the attribute was missing, ctx.getAttribute(\"num_scan_inputs\") returned null and was dereferenced. 2. If the attribute was negative, conversion to size_t produced a very large value that reached a vector allocation and raised std::length_error. The neg", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-q69g-f4f5-v8m7", "type": "advisory", "advisoryId": "GHSA-q69g-f4f5-v8m7", "cveId": "CVE-2026-115922", "title": "ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs", "summary": "Medium severity advisory GHSA-q69g-f4f5-v8m7 (CVE-2026-115922) affecting onnx. Patched in onnx 1.22.0.", "severity": "medium", "cvssScore": 6.2, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.02674, "cwes": [ "CWE-789" ], "affected": [ { "ecosystem": "pip", "name": "onnx", "vulnerableVersionRange": "<= 1.21.0", "firstPatchedVersion": "1.22.0" } ], "matchedTerms": [ "onnx" ], "disclosedAt": "2026-10-28", "sourceUpdatedAt": "2026-10-28T21:16:39Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-q69g-f4f5-v8m7", "references": [ "https://github.com/onnx/onnx/security/advisories/GHSA-q69g-f4f5-v8m7", "https://nvd.nist.gov/vuln/detail/CVE-2026-115922", "https://github.com/onnx/onnx/pull/8033", "https://github.com/onnx/onnx/pull/8038", "https://github.com/onnx/onnx/pull/8066", "https://github.com/onnx/onnx/commit/05c1bc3bceceb8d3cf11e9e7fc7f19f971c44988", "https://github.com/onnx/onnx/commit/8de2cf6aa47928e6515ac6d9e1a8b4758886a7df", "https://github.com/onnx/onnx/commit/dce5876d6cc6cc30157af7d26a752ef44976da8e" ], "evidence": "## Summary ONNX's Python tensor-materialization helpers could allocate memory according to attacker-controlled tensor dimensions without verifying that a packed sub-byte payload contained the declared number of elements. A very small model could therefore cause a disproportionately large allocation when an application called onnx.numpy_helper.to_array() or constructed onnx.reference.ReferenceEvaluator with the model.", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-q97c-p368-75c4", "type": "advisory", "advisoryId": "GHSA-q97c-p368-75c4", "cveId": "CVE-2026-115916", "title": "vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)", "summary": "Medium severity advisory GHSA-q97c-p368-75c4 (CVE-2026-115916) affecting vllm. Patched in vllm 0.32.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.24041, "cwes": [ "CWE-129", "CWE-193" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": "< 0.32.0", "firstPatchedVersion": "0.32.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-10-28", "sourceUpdatedAt": "2026-10-28T21:15:09Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-q97c-p368-75c4", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-q97c-p368-75c4", "https://nvd.nist.gov/vuln/detail/CVE-2026-115916", "https://github.com/vllm-project/vllm/pull/59491", "https://github.com/vllm-project/vllm/commit/37cecc8141e2dcba9dd534897a164d4baaf27229", "https://github.com/vllm-project/vllm/releases/tag/v0.32.0", "https://github.com/advisories/GHSA-q97c-p368-75c4" ], "evidence": "For a model whose vocabulary size is an exact multiple of the embedding padding size (64) — e.g. any Llama-2-family model, vocab 32000 — a single request carrying a pre-tokenized prompt with token id equal to the vocab size (32000) passes vLLM's input-id validation but is one past the last embedding row. At tensor-parallel size 1 the embedding lookup does not mask indices, so the id reaches F.embedding out of range a", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-vvpg-rrww-wpmh", "type": "advisory", "advisoryId": "GHSA-vvpg-rrww-wpmh", "cveId": "CVE-2026-115917", "title": "vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server", "summary": "Low severity advisory GHSA-vvpg-rrww-wpmh (CVE-2026-115917) affecting vllm. Patched in vllm 0.32.0.", "severity": "low", "cvssScore": 3.4, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N", "epssPercentile": 0.15178, "cwes": [ "CWE-942" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": "< 0.32.0", "firstPatchedVersion": "0.32.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-10-28", "sourceUpdatedAt": "2026-10-28T21:15:50Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-vvpg-rrww-wpmh", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-vvpg-rrww-wpmh", "https://nvd.nist.gov/vuln/detail/CVE-2026-115917", "https://github.com/vllm-project/vllm/pull/61009", "https://github.com/vllm-project/vllm/commit/fcae5c98870ff2c20659731dce7ba3a3ff0d48aa", "https://github.com/vllm-project/vllm/releases/tag/v0.32.0", "https://github.com/advisories/GHSA-vvpg-rrww-wpmh" ], "evidence": "### Summary The OpenAI-compatible server registers Starlette CORSMiddleware with allowed_origins defaulting to [\"\"], and performs no authentication unless --api-key (or VLLM_API_KEY) is configured. A web page on any origin can send requests to a vLLM server that the victim's browser can reach (for example localhost or an internal/VPN address) and read the responses. The default allow_credentials=False blocks cookie-b", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-x567-49g5-p4cf", "type": "advisory", "advisoryId": "GHSA-x567-49g5-p4cf", "cveId": "CVE-2026-115918", "title": "vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs", "summary": "Medium severity advisory GHSA-x567-49g5-p4cf (CVE-2026-115918) affecting vllm. Patched in vllm 0.32.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.28639, "cwes": [ "CWE-400", "CWE-770" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": ">= 0.16.0, < 0.32.0", "firstPatchedVersion": "0.32.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-10-28", "sourceUpdatedAt": "2026-10-28T21:15:00Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-x567-49g5-p4cf", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-x567-49g5-p4cf", "https://nvd.nist.gov/vuln/detail/CVE-2026-115918", "https://github.com/vllm-project/vllm/pull/50300", "https://github.com/vllm-project/vllm/commit/cff08b461e086523cee8bba5bd3c66d302625134", "https://github.com/vllm-project/vllm/releases/tag/v0.32.0", "https://github.com/advisories/GHSA-x567-49g5-p4cf" ], "evidence": "## Summary vLLM's /v1/responses endpoint accepts request-level chat_template_kwargs, but does not apply the --trust-request-chat-template gate that protects Chat Completions, render, tokenize, and pooling paths. When the server is run with the documented default trust_request_chat_template=False and no explicit --chat-template, a Responses request can pass: json {\"chat_template_kwargs\": {\"chat_template\": \" \"}} That k", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:386fae52", "type": "incident", "advisoryId": "incident:386fae52", "cveId": null, "title": "Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits", "summary": "The Hacker News reported a security matter involving Anthropic on 2026-10-28 (flaw, flaws, exploits). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Anthropic", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Anthropic", "AI" ], "signals": [ "flaw", "flaws", "exploits" ], "disclosedAt": "2026-10-28", "sourceUpdatedAt": "2026-10-28T08:15:07.000Z", "sourceId": "the-hacker-news", "sourceUrl": "https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html", "references": [], "evidence": "An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report. The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched. One proof of", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-26p8-2jq9-3vq9", "type": "advisory", "advisoryId": "GHSA-26p8-2jq9-3vq9", "cveId": "CVE-2026-116692", "title": "MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules", "summary": "Critical severity advisory GHSA-26p8-2jq9-3vq9 (CVE-2026-116692) affecting mlflow. Patched in mlflow 3.17.0.", "severity": "critical", "cvssScore": 9.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "epssPercentile": 0.53178, "cwes": [ "CWE-94", "CWE-470" ], "affected": [ { "ecosystem": "pip", "name": "mlflow", "vulnerableVersionRange": ">= 3.12.0rc0, < 3.17.0", "firstPatchedVersion": "3.17.0" } ], "matchedTerms": [ "mlflow" ], "disclosedAt": "2026-10-27", "sourceUpdatedAt": "2026-10-27T21:26:34Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-26p8-2jq9-3vq9", "references": [ "https://github.com/mlflow/mlflow/security/advisories/GHSA-26p8-2jq9-3vq9", "https://github.com/mlflow/mlflow/pull/25906", "https://github.com/mlflow/mlflow/commit/a732443e695c3c677680c54320efc394c81654ab", "https://github.com/mlflow/mlflow/releases/tag/v3.17.0", "https://github.com/advisories/GHSA-26p8-2jq9-3vq9" ], "evidence": "## Summary MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a request-controlled class, and instantiates it synchronously. An HTTP caller can combine this behavior with MLflow's built-in experiment, ", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-5h93-6whr-6q8j", "type": "advisory", "advisoryId": "GHSA-5h93-6whr-6q8j", "cveId": "CVE-2026-116685", "title": "Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies", "summary": "Medium severity advisory GHSA-5h93-6whr-6q8j (CVE-2026-116685) affecting mcp. Patched in mcp 2.2.0.", "severity": "medium", "cvssScore": 5.9, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "epssPercentile": 0.34039, "cwes": [ "CWE-200" ], "affected": [ { "ecosystem": "pip", "name": "mcp", "vulnerableVersionRange": ">= 2.0.0, < 2.2.0", "firstPatchedVersion": "2.2.0" }, { "ecosystem": "pip", "name": "mcp", "vulnerableVersionRange": ">= 1.8.0, < 1.30.0", "firstPatchedVersion": "1.30.0" } ], "matchedTerms": [ "mcp", "model context protocol", "MCP" ], "disclosedAt": "2026-10-27", "sourceUpdatedAt": "2026-10-27T21:05:36Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-5h93-6whr-6q8j", "references": [ "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-5h93-6whr-6q8j", "https://github.com/modelcontextprotocol/python-sdk/pull/3397", "https://github.com/modelcontextprotocol/python-sdk/pull/3448", "https://github.com/modelcontextprotocol/python-sdk/commit/2106335745563b2321b8c73fef2c12903d00aa6e", "https://github.com/modelcontextprotocol/python-sdk/commit/c6762e821c527925f0b617db216d00fbd1d0bf99", "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0", "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0", "https://github.com/advisories/GHSA-5h93-6whr-6q8j" ], "evidence": "### Summary In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host. If the configured MCP endpoint answered with a redirect to a different origin: - custom headers set on the client (for example an X-API-Key credential) were sent to that origin, and - on a 307 or 308 redirect the request body was re-sent there too. The SDK's OAuth client providers followed redire", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-7hp6-4w63-5g45", "type": "advisory", "advisoryId": "GHSA-7hp6-4w63-5g45", "cveId": "CVE-2026-114612", "title": "LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key", "summary": "High severity advisory GHSA-7hp6-4w63-5g45 (CVE-2026-114612) affecting litellm. Patched in litellm 1.100.4.", "severity": "high", "cvssScore": 7.7, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "epssPercentile": 0.24638, "cwes": [ "CWE-269", "CWE-345", "CWE-441" ], "affected": [ { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": ">= 1.91.0, < 1.100.4", "firstPatchedVersion": "1.100.4" }, { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": ">= 1.101.0, < 1.101.3", "firstPatchedVersion": "1.101.3" }, { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": ">= 1.102.0, < 1.102.2", "firstPatchedVersion": "1.102.2" }, { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": ">= 1.103.0, < 1.103.1", "firstPatchedVersion": "1.103.1" }, { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": ">= 1.104.0rc1, < 1.104.0rc2", "firstPatchedVersion": "1.104.0rc2" } ], "matchedTerms": [ "litellm", "MCP" ], "disclosedAt": "2026-10-27", "sourceUpdatedAt": "2026-10-27T15:04:15Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-7hp6-4w63-5g45", "references": [ "https://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45", "https://nvd.nist.gov/vuln/detail/CVE-2026-114612", "https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0", "https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b", "https://github.com/BerriAI/litellm/commit/9fa1a641119dd0d4fe43e93622eae5f482ceb63f", "https://github.com/BerriAI/litellm/commit/a80eacacee118fbed54e3d98f239d17a63fac818", "https://github.com/BerriAI/litellm/commit/f7cd90f09e9716652b38daec9f0640cdf49d582b", "https://github.com/BerriAI/litellm/releases/tag/v1.100.4" ], "evidence": "### Summary An authenticated user with internal_user privileges can escalate to proxy_admin and achieve remote code execution. The proxy uses one encryption key for two purposes: sealing secrets at rest and minting session tokens. An attacker exploits this by requesting a new API key with a crafted metadata field containing a forged admin credential as the \"secret\" value. The proxy encrypts and returns this payload. ", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-f897-62hf-6gxq", "type": "advisory", "advisoryId": "GHSA-f897-62hf-6gxq", "cveId": null, "title": "MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length", "summary": "High severity advisory GHSA-f897-62hf-6gxq affecting @modelcontextprotocol/sdk, @modelcontextprotocol/server, @modelcontextprotocol/node, @modelcontextprotocol/hono. Patched in @modelcontextprotocol/sdk 1.30.1.", "severity": "high", "cvssScore": 7.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": null, "cwes": [ "CWE-770" ], "affected": [ { "ecosystem": "npm", "name": "@modelcontextprotocol/sdk", "vulnerableVersionRange": ">= 1.10.0, < 1.30.1", "firstPatchedVersion": "1.30.1" }, { "ecosystem": "npm", "name": "@modelcontextprotocol/server", "vulnerableVersionRange": ">= 2.0.0, < 2.1.0", "firstPatchedVersion": "2.1.0" }, { "ecosystem": "npm", "name": "@modelcontextprotocol/node", "vulnerableVersionRange": ">= 2.0.0, < 2.1.0", "firstPatchedVersion": "2.1.0" }, { "ecosystem": "npm", "name": "@modelcontextprotocol/hono", "vulnerableVersionRange": ">= 2.0.0, < 2.0.1", "firstPatchedVersion": "2.0.1" } ], "matchedTerms": [ "@modelcontextprotocol/sdk", "MCP" ], "disclosedAt": "2026-10-27", "sourceUpdatedAt": "2026-10-27T19:02:02Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-f897-62hf-6gxq", "references": [ "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-f897-62hf-6gxq", "https://github.com/modelcontextprotocol/typescript-sdk/pull/2698", "https://github.com/modelcontextprotocol/typescript-sdk/pull/2717", "https://github.com/modelcontextprotocol/typescript-sdk/commit/7b781ed4e25355a25d15974f3c76de81299694ed", "https://github.com/modelcontextprotocol/typescript-sdk/commit/a9f6eb709b85459d01e8f2a9e881fef2621756c1", "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.30.1", "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/hono@2.0.1", "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/node@2.1.0" ], "evidence": "### Summary In affected versions, MCP servers reachable over HTTP put no limit on the size of a POST body or on the number of messages in a JSON-RPC batch. Large requests could exhaust the server's memory, and one long batch could block it from serving anyone else. No credentials were needed, unless your application authenticates requests before they reach the SDK. ### Am I affected? Yes, if clients you do not fully ", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-frvg-qw88-hww9", "type": "advisory", "advisoryId": "GHSA-frvg-qw88-hww9", "cveId": "CVE-2026-94624", "title": "vllm p2p never connected zmq_exhaustion", "summary": "Medium severity advisory GHSA-frvg-qw88-hww9 (CVE-2026-94624) affecting vllm. Patched in vllm 0.32.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.37545, "cwes": [ "CWE-770" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": "< 0.32.0", "firstPatchedVersion": "0.32.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-10-27", "sourceUpdatedAt": "2026-10-27T14:45:54Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-frvg-qw88-hww9", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-frvg-qw88-hww9", "https://nvd.nist.gov/vuln/detail/CVE-2026-94624", "https://github.com/vllm-project/vllm/pull/51504", "https://github.com/vllm-project/vllm/commit/93d2cab35e8ae66bbaa1dea1c077986d5a79eb80", "https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-4006.yaml", "https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/kv_offload/tiering/p2p/control/zmq.py#L240-L260", "https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/kv_offload/tiering/p2p/manager.py#L667-L677", "https://github.com/vllm-project/vllm/releases/tag/v0.32.0" ], "evidence": "### Summary When the OffloadingConnector uses TieringOffloadingSpec with a P2P secondary tier, an API client can submit many unique non-listening peer addresses through kv_transfer_params.prefill. vLLM keeps every never-established P2P session and its ZeroMQ sockets after the request finishes. On vLLM 0.26.0, 340 such peers filled the default ZeroMQ context socket quota; creating the next peer raised an uncaught ZMQE", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-g5ff-637f-6q2m", "type": "advisory", "advisoryId": "GHSA-g5ff-637f-6q2m", "cveId": null, "title": "LiteLLM: internal_user_viewer arbitrary local file read via vertex_ai_credentials", "summary": "High severity advisory GHSA-g5ff-637f-6q2m affecting litellm. Patched in litellm 1.95.0.", "severity": "high", "cvssScore": 8.1, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "epssPercentile": null, "cwes": [ "CWE-20", "CWE-22" ], "affected": [ { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": "< 1.95.0", "firstPatchedVersion": "1.95.0" } ], "matchedTerms": [ "litellm", "AI" ], "disclosedAt": "2026-10-27", "sourceUpdatedAt": "2026-10-27T15:32:37Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-g5ff-637f-6q2m", "references": [ "https://github.com/BerriAI/litellm/security/advisories/GHSA-g5ff-637f-6q2m", "https://github.com/BerriAI/litellm/pull/34189", "https://github.com/BerriAI/litellm/commit/065faf6e695be64a1a367601271839914e4a6621", "https://github.com/BerriAI/litellm/releases/tag/v1.95.0", "https://github.com/advisories/GHSA-g5ff-637f-6q2m" ], "evidence": "## Summary An authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted vertex_ai_credentials value to /utils/transform_request. The request-body safety blocklist rejected vertex_credentials but missed its alias vertex_ai_credentials, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL. ## Impa", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-h3rc-6mm3-gc2m", "type": "advisory", "advisoryId": "GHSA-h3rc-6mm3-gc2m", "cveId": "CVE-2026-114053", "title": "vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution", "summary": "High severity advisory GHSA-h3rc-6mm3-gc2m (CVE-2026-114053) affecting vllm. Patched in vllm 0.31.0.", "severity": "high", "cvssScore": 8.1, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "epssPercentile": 0.39752, "cwes": [ "CWE-94", "CWE-829" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": ">= 0.7.3, < 0.31.0", "firstPatchedVersion": "0.31.0" } ], "matchedTerms": [ "vllm", "hugging face" ], "disclosedAt": "2026-10-27", "sourceUpdatedAt": "2026-10-27T15:36:19Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-h3rc-6mm3-gc2m", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-6mm3-gc2m", "https://github.com/vllm-project/vllm/pull/58830", "https://github.com/vllm-project/vllm/commit/31f2e70cd3e403aaa471fb7fe3d33a7207aaf3cc", "https://github.com/vllm-project/vllm/releases/tag/v0.31.0", "https://nvd.nist.gov/vuln/detail/cve-2026-114053", "https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-rce-via-mm-processor-kwargs-code-revision", "https://github.com/advisories/GHSA-h3rc-6mm3-gc2m" ], "evidence": "## Summary An untrusted multimodal request can set mm_processor_kwargs.code_revision. When vLLM serves a model whose Hugging Face processor uses dynamic auto_map code and the operator enabled --trust-remote-code, this request value reaches AutoProcessor.from_pretrained and selects the Python revision imported by Transformers. This lets a client replace the operator-reviewed processor module with code from another rev", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-hhww-mrg2-969h", "type": "advisory", "advisoryId": "GHSA-hhww-mrg2-969h", "cveId": null, "title": "LiteLLM vulnerable to reflected XSS in /sso/debug/callback", "summary": "Medium severity advisory GHSA-hhww-mrg2-969h affecting litellm. Patched in litellm 1.85.0.", "severity": "medium", "cvssScore": 6.8, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "epssPercentile": null, "cwes": [ "CWE-79" ], "affected": [ { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": ">= 1.65.5, < 1.85.0", "firstPatchedVersion": "1.85.0" } ], "matchedTerms": [ "litellm" ], "disclosedAt": "2026-10-27", "sourceUpdatedAt": "2026-10-27T15:31:58Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-hhww-mrg2-969h", "references": [ "https://github.com/BerriAI/litellm/security/advisories/GHSA-hhww-mrg2-969h", "https://github.com/BerriAI/litellm/pull/27498", "https://github.com/BerriAI/litellm/commit/13a193367f0ae2e7e8b29913e0d23a32d3bb0457", "https://github.com/BerriAI/litellm/releases/tag/v1.85.0", "https://github.com/advisories/GHSA-hhww-mrg2-969h" ], "evidence": "### Summary The /sso/debug/callback endpoint reflected identity-provider-controlled fields into an inline . An IdP-returned string field containing (for example a user-editable display name) closed the script block and executed attacker JavaScript in the proxy's origin. ### Impact Reflected XSS on the LiteLLM proxy origin. The route required no authentication, so an attacker with an account on the configured IdP whos", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-j7qq-vr8c-xvw3", "type": "advisory", "advisoryId": "GHSA-j7qq-vr8c-xvw3", "cveId": "CVE-2026-116691", "title": "MLflow CrewAI autologging records LLM provider API keys in logged trace spans", "summary": "Medium severity advisory GHSA-j7qq-vr8c-xvw3 (CVE-2026-116691) affecting mlflow. Patched in mlflow 3.17.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "epssPercentile": 0.10822, "cwes": [ "CWE-200", "CWE-312", "CWE-532" ], "affected": [ { "ecosystem": "pip", "name": "mlflow", "vulnerableVersionRange": ">= 2.19.0, < 3.17.0", "firstPatchedVersion": "3.17.0" } ], "matchedTerms": [ "mlflow", "LLM" ], "disclosedAt": "2026-10-27", "sourceUpdatedAt": "2026-10-27T21:26:40Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-j7qq-vr8c-xvw3", "references": [ "https://github.com/mlflow/mlflow/security/advisories/GHSA-j7qq-vr8c-xvw3", "https://github.com/mlflow/mlflow/pull/25845", "https://github.com/mlflow/mlflow/commit/20927930d27f0072fcfeb7f024f24ad8c5e77c47", "https://github.com/mlflow/mlflow/releases/tag/v3.17.0", "https://github.com/advisories/GHSA-j7qq-vr8c-xvw3" ], "evidence": "### Summary mlflow.crewai.autolog() leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI Agent is instrumented with MLflow autologging, MLflow serializes the agent's __dict__ and converts its fields to strings. The llm field contains the CrewAI LLM object, whose string representation includes its api_key in plaintext. As a result, an application that calls mlflow.crewai.autolog() can unintent", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-m4w4-3r8h-jw98", "type": "advisory", "advisoryId": "GHSA-m4w4-3r8h-jw98", "cveId": "CVE-2026-35002", "title": "Agno: Arbitrary code execution via eval() on field_type in FunctionCall", "summary": "Critical severity advisory GHSA-m4w4-3r8h-jw98 (CVE-2026-35002) affecting agno. Patched in agno 2.3.24.", "severity": "critical", "cvssScore": 9.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "epssPercentile": 0.58379, "cwes": [ "CWE-95" ], "affected": [ { "ecosystem": "pip", "name": "agno", "vulnerableVersionRange": "< 2.3.24", "firstPatchedVersion": "2.3.24" } ], "matchedTerms": [ "agno" ], "disclosedAt": "2026-10-27", "sourceUpdatedAt": "2026-10-27T13:30:42Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-m4w4-3r8h-jw98", "references": [ "https://github.com/agno-agi/agno/security/advisories/GHSA-m4w4-3r8h-jw98", "https://nvd.nist.gov/vuln/detail/CVE-2026-35002", "https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416", "https://github.com/agno-agi/agno/releases/tag/v2.3.24", "https://github.com/pypa/advisory-database/tree/main/vulns/agno/PYSEC-2026-256.yaml", "https://pypi.org/project/agno", "https://www.vulncheck.com/advisories/agno-field-type-eval-injection-arbitrary-code-execution", "https://github.com/advisories/GHSA-m4w4-3r8h-jw98" ], "evidence": "### Impact Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The field_type parameter on a FunctionCall input field was passed to Python's built-in eval(), allowing an attacker who could influence that value to execute arbitrary Python code in the Agno process. This is a code injection flaw (CWE-95) with full impact to confidentiality, integrity, and ava", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-m65p-9j7q-6w33", "type": "advisory", "advisoryId": "GHSA-m65p-9j7q-6w33", "cveId": "CVE-2026-116690", "title": "MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source", "summary": "High severity advisory GHSA-m65p-9j7q-6w33 (CVE-2026-116690) affecting mlflow. Patched in mlflow 3.17.0.", "severity": "high", "cvssScore": 7.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "epssPercentile": 0.46555, "cwes": [ "CWE-22" ], "affected": [ { "ecosystem": "pip", "name": "mlflow", "vulnerableVersionRange": ">= 3.10.0, < 3.17.0", "firstPatchedVersion": "3.17.0" } ], "matchedTerms": [ "mlflow" ], "disclosedAt": "2026-10-27", "sourceUpdatedAt": "2026-10-27T21:26:56Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-m65p-9j7q-6w33", "references": [ "https://github.com/mlflow/mlflow/security/advisories/GHSA-m65p-9j7q-6w33", "https://github.com/mlflow/mlflow/pull/25870", "https://github.com/mlflow/mlflow/commit/81730a2ce4ebcd60d5d18f68c96f422ad7e30772", "https://github.com/mlflow/mlflow/releases/tag/v3.17.0", "https://github.com/advisories/GHSA-m65p-9j7q-6w33" ], "evidence": "### Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in 3.10.0 added a prompt-specific branch to the CreateModelVersion handler that rejects file:// URIs and absolute paths but", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-rwrf-2pqf-9j8j", "type": "advisory", "advisoryId": "GHSA-rwrf-2pqf-9j8j", "cveId": "CVE-2026-116686", "title": "Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas", "summary": "Medium severity advisory GHSA-rwrf-2pqf-9j8j (CVE-2026-116686) affecting mcp. Patched in mcp 2.2.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "epssPercentile": 0.27008, "cwes": [ "CWE-918" ], "affected": [ { "ecosystem": "pip", "name": "mcp", "vulnerableVersionRange": ">= 2.0.0, < 2.2.0", "firstPatchedVersion": "2.2.0" }, { "ecosystem": "pip", "name": "mcp", "vulnerableVersionRange": ">= 1.10.0, < 1.30.0", "firstPatchedVersion": "1.30.0" } ], "matchedTerms": [ "mcp", "model context protocol", "mcp server", "MCP" ], "disclosedAt": "2026-10-27", "sourceUpdatedAt": "2026-10-27T21:05:30Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-rwrf-2pqf-9j8j", "references": [ "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-rwrf-2pqf-9j8j", "https://github.com/modelcontextprotocol/python-sdk/pull/3394", "https://github.com/modelcontextprotocol/python-sdk/pull/3396", "https://github.com/modelcontextprotocol/python-sdk/commit/5ebdfed4060d8e5b11b8e2348f86bad4d1fb8836", "https://github.com/modelcontextprotocol/python-sdk/commit/6705402e246dc4eb1fcdf4d9902b78d3c9c36e1b", "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0", "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0", "https://github.com/advisories/GHSA-rwrf-2pqf-9j8j" ], "evidence": "### Summary In affected versions, when a connected MCP server declared an outputSchema for a tool, the SDK's client validated each call_tool result with jsonschema's default resolver, which fetches any $ref it cannot resolve locally by opening the URL. A server could therefore put an http://, https:// or file:// reference in a tool's output schema and make the client: - request that URL, or read that local file, from", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-w4fh-qvv9-3v23", "type": "advisory", "advisoryId": "GHSA-w4fh-qvv9-3v23", "cveId": "CVE-2026-116684", "title": "Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server", "summary": "Medium severity advisory GHSA-w4fh-qvv9-3v23 (CVE-2026-116684) affecting mcp. Patched in mcp 2.2.0.", "severity": "medium", "cvssScore": 6.8, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "epssPercentile": 0.30247, "cwes": [ "CWE-863" ], "affected": [ { "ecosystem": "pip", "name": "mcp", "vulnerableVersionRange": ">= 2.0.0, < 2.2.0", "firstPatchedVersion": "2.2.0" }, { "ecosystem": "pip", "name": "mcp", "vulnerableVersionRange": ">= 1.10.0, < 1.30.0", "firstPatchedVersion": "1.30.0" } ], "matchedTerms": [ "mcp", "model context protocol", "mcp server", "MCP" ], "disclosedAt": "2026-10-27", "sourceUpdatedAt": "2026-10-27T21:07:01Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-w4fh-qvv9-3v23", "references": [ "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23", "https://github.com/modelcontextprotocol/python-sdk/pull/3447", "https://github.com/modelcontextprotocol/python-sdk/pull/3451", "https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40", "https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512", "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0", "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0", "https://github.com/advisories/GHSA-w4fh-qvv9-3v23" ], "evidence": "### Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. ### Am I affected? Yes, if your HTTP server uses the SDK's bearer authentication (auth=AuthSettings(...) with token_verifier=),", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:074fa37e", "type": "incident", "advisoryId": "incident:074fa37e", "cveId": null, "title": "Tricks from the Past deployed via signed ChatGPT and Claude binaries", "summary": "Check Point Research reported a security matter involving Claude, ChatGPT, Anthropic, OpenAI and 1 more on 2026-10-27 (malicious, malware, poisoning). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Claude", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "ChatGPT", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Anthropic", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "OpenAI", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "GPT-5", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Claude", "ChatGPT", "Anthropic", "OpenAI", "GPT-5" ], "signals": [ "malicious", "malware", "poisoning" ], "disclosedAt": "2026-10-27", "sourceUpdatedAt": "2026-10-27T13:03:27.000Z", "sourceId": "checkpoint-research", "sourceUrl": "https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries", "references": [], "evidence": "Key Points Check Point Research discovered a campaign we track as Yoba where attackers abuse the popularity of AI tools such as ChatGPT and Claude, creating fake GitHub projects that pretend to be desktop applications like GPT-5.6 Sol , GPT-6 Astra , and Claude Opus . The malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DL", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:b9817f53", "type": "incident", "advisoryId": "incident:b9817f53", "cveId": null, "title": "OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections", "summary": "The Hacker News reported a security matter involving OpenAI on 2026-10-27 (flaw). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "OpenAI", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "OpenAI" ], "signals": [ "flaw" ], "disclosedAt": "2026-10-27", "sourceUpdatedAt": "2026-10-27T08:22:43.000Z", "sourceId": "the-hacker-news", "sourceUrl": "https://thehackernews.com/2026/10/openai-compaction-flaw-let-researchers.html", "references": [], "evidence": "OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:0185fd74", "type": "incident", "advisoryId": "incident:0185fd74", "cveId": null, "title": "LiteLLM supply chain attack started with an exposed master key", "summary": "The Register security reported a security matter involving LiteLLM, Anthropic, OpenAI on 2026-10-26 (malicious, trojan, infostealer). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "LiteLLM", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Anthropic", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "OpenAI", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "LiteLLM", "Anthropic", "OpenAI" ], "signals": [ "malicious", "trojan", "infostealer", "compromised", "supply chain", "exfiltrate", "poisoned" ], "disclosedAt": "2026-10-26", "sourceUpdatedAt": "2026-10-26T20:30:53.000Z", "sourceId": "the-register-security", "sourceUrl": "https://www.theregister.com/security/2026/10/26/litellm-supply-chain-attack-started-with-an-exposed-master-key/5305544", "references": [], "evidence": "LiteLLM has traced last week’s supply chain attack to a master key it accidentally committed to a public GitHub repository in May. The cloud and AI model secret-stealing part of the incident began when someone uploaded a poisoned version (1.107.0) of the popular open source AI gateway to PyPI and its container registries last Wednesday. This compromised version contained an infostealer and a remote access trojan capa", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:620f18d4", "type": "incident", "advisoryId": "incident:620f18d4", "cveId": null, "title": "Alibaba's Qwen AI caught trying to contact server in China", "summary": "The Register security reported a security matter involving Qwen on 2026-10-26 (malicious, exfiltrate, poisoning). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Qwen", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Qwen", "AI" ], "signals": [ "malicious", "exfiltrate", "poisoning" ], "disclosedAt": "2026-10-26", "sourceUpdatedAt": "2026-10-26T21:27:37.000Z", "sourceId": "the-register-security", "sourceUrl": "https://www.theregister.com/ai-and-ml/2026/10/26/alibabas-qwen-ai-caught-trying-to-contact-server-in-china/5305561", "references": [], "evidence": "Open-weight models from China have become very popular, but they've also raised some security suspicions. Cohere, a Canada-based biz that offers AI models to enterprises, says that when it was testing Alibaba's Qwen3.8-Flash-Next in its evaluation sandbox, the model attempted to send data to China. \"Asked to write a defensive detection rule, Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was r", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:84f42b91", "type": "incident", "advisoryId": "incident:84f42b91", "cveId": null, "title": "Trumpets blare and skies part as AI hypefest culminates in Anthropic IPO filing", "summary": "The Register security reported a security matter involving Anthropic, Claude on 2026-10-26 (vulnerabilities, malicious). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Anthropic", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Claude", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Anthropic", "Claude", "AI" ], "signals": [ "vulnerabilities", "malicious" ], "disclosedAt": "2026-10-26", "sourceUpdatedAt": "2026-10-26T15:47:05.000Z", "sourceId": "the-register-security", "sourceUrl": "https://www.theregister.com/ai-and-ml/2026/10/26/trumpets-blare-and-skies-part-as-ai-hypefest-culminates-in-anthropic-ipo-filing/5305456", "references": [], "evidence": "Anthropic has filed for an IPO that could rank among Wall Street's biggest ever, revealing an $80.7 billion half-year loss, a startlingly complex governance structure, and warnings that its AI models could blackmail humans, resist shutdown, or create \"existential risks\" to society. The Claude maker filed its S-1 registration statement with the US Securities and Exchange Commission on Monday as it prepares to list on ", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-2wqp-q3c6-ccj5", "type": "advisory", "advisoryId": "GHSA-2wqp-q3c6-ccj5", "cveId": "CVE-2026-115886", "title": "MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints", "summary": "Medium severity advisory GHSA-2wqp-q3c6-ccj5 (CVE-2026-115886) affecting mlflow. Patched in mlflow 3.17.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "epssPercentile": 0.52148, "cwes": [ "CWE-470", "CWE-918" ], "affected": [ { "ecosystem": "pip", "name": "mlflow", "vulnerableVersionRange": ">= 3.12.0rc0, < 3.17.0", "firstPatchedVersion": "3.17.0" } ], "matchedTerms": [ "mlflow", "LLM", "GenAI" ], "disclosedAt": "2026-10-23", "sourceUpdatedAt": "2026-10-23T22:07:27Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-2wqp-q3c6-ccj5", "references": [ "https://github.com/mlflow/mlflow/security/advisories/GHSA-2wqp-q3c6-ccj5", "https://github.com/mlflow/mlflow/pull/25890", "https://github.com/mlflow/mlflow/commit/bac30b4148c4f40045b4d4db07ae60ab3838803f", "https://github.com/mlflow/mlflow/releases/tag/v3.17.0", "https://github.com/advisories/GHSA-2wqp-q3c6-ccj5" ], "evidence": "### Summary MLflow's tracking server exposes POST /ajax-api/3.0/mlflow/scorer/invoke with no authentication, and the handler reflectively instantiates an attacker-named class from attacker-supplied JSON with unconstrained constructor kwargs. With the optional trulens + trulens-providers-litellm packages installed, an unauthenticated attacker can force the server to make an outbound HTTP request to an arbitrary host o", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-7xgj-8392-5q4r", "type": "advisory", "advisoryId": "GHSA-7xgj-8392-5q4r", "cveId": null, "title": "FastMCP: Post-transform component authorization is skipped on direct calls", "summary": "Medium severity advisory GHSA-7xgj-8392-5q4r affecting fastmcp, fastmcp-slim. Patched in fastmcp 3.4.10.", "severity": "medium", "cvssScore": 6.8, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "epssPercentile": null, "cwes": [ "CWE-862" ], "affected": [ { "ecosystem": "pip", "name": "fastmcp", "vulnerableVersionRange": ">= 3.0.0, < 3.4.10", "firstPatchedVersion": "3.4.10" }, { "ecosystem": "pip", "name": "fastmcp", "vulnerableVersionRange": ">= 4.0.0, < 4.1.2", "firstPatchedVersion": "4.1.2" }, { "ecosystem": "pip", "name": "fastmcp-slim", "vulnerableVersionRange": ">= 3.0.0, < 3.4.10", "firstPatchedVersion": "3.4.10" }, { "ecosystem": "pip", "name": "fastmcp-slim", "vulnerableVersionRange": ">= 4.0.0, < 4.1.2", "firstPatchedVersion": "4.1.2" } ], "matchedTerms": [ "fastmcp", "MCP", "AI" ], "disclosedAt": "2026-10-23", "sourceUpdatedAt": "2026-10-23T21:32:07Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-7xgj-8392-5q4r", "references": [ "https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-7xgj-8392-5q4r", "https://github.com/PrefectHQ/fastmcp/pull/5933", "https://github.com/PrefectHQ/fastmcp/pull/5934", "https://github.com/PrefectHQ/fastmcp/commit/85df42fbf2aa631cc81e0f986718b314128e91df", "https://github.com/PrefectHQ/fastmcp/commit/8649ba5fc91a68568a69729497edeb804a064332", "https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.10", "https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2", "https://github.com/advisories/GHSA-7xgj-8392-5q4r" ], "evidence": "## Maintainer assessment and remediation This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retr", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-gx7p-2j49-hfq4", "type": "advisory", "advisoryId": "GHSA-gx7p-2j49-hfq4", "cveId": "CVE-2026-114055", "title": "vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)", "summary": "High severity advisory GHSA-gx7p-2j49-hfq4 (CVE-2026-114055) affecting vllm. Patched in vllm 0.31.0.", "severity": "high", "cvssScore": 7.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.36011, "cwes": [ "CWE-400" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": ">= 0.7.3, < 0.31.0", "firstPatchedVersion": "0.31.0" } ], "matchedTerms": [ "vllm", "hugging face", "LLM" ], "disclosedAt": "2026-10-23", "sourceUpdatedAt": "2026-10-23T20:58:38Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-gx7p-2j49-hfq4", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-gx7p-2j49-hfq4", "https://nvd.nist.gov/vuln/detail/CVE-2026-114055", "https://github.com/vllm-project/vllm/pull/58830", "https://github.com/vllm-project/vllm/commit/31f2e70cd3e403aaa471fb7fe3d33a7207aaf3cc", "https://github.com/vllm-project/vllm/releases/tag/v0.31.0", "https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-dos-via-unvalidated-mm-processor-kwargs", "https://github.com/advisories/GHSA-gx7p-2j49-hfq4" ], "evidence": "## Summary API clients can supply arbitrary mm_processor_kwargs per request. vLLM forwards these values through the multimodal rendering and processing pipeline to Hugging Face and custom image/video processor constructors and calls. Resource-sensitive values such as image size, patch size, patch count, crop count, or frame count can therefore be controlled by a remote client. For processors that upscale inputs, a si", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-p92p-rxj5-7p2x", "type": "advisory", "advisoryId": "GHSA-p92p-rxj5-7p2x", "cveId": "CVE-2026-114050", "title": "vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine", "summary": "Medium severity advisory GHSA-p92p-rxj5-7p2x (CVE-2026-114050) affecting vllm. Patched in vllm 0.31.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.10124, "cwes": [ "CWE-345" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": "< 0.31.0", "firstPatchedVersion": "0.31.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-10-23", "sourceUpdatedAt": "2026-10-23T20:43:45Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-p92p-rxj5-7p2x", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-p92p-rxj5-7p2x", "https://github.com/vllm-project/vllm/pull/57833", "https://github.com/vllm-project/vllm/commit/7268f6e38ebbb3d61700f16c638c6eba0c88bb0c", "https://github.com/vllm-project/vllm/releases/tag/v0.31.0", "https://nvd.nist.gov/vuln/detail/cve-2026-114050", "https://www.vulncheck.com/advisories/vllm-before-0.31.0-remote-engine-crash-via-forged-multimodal-uuid", "https://github.com/advisories/GHSA-p92p-rxj5-7p2x" ], "evidence": "## Summary Multimodal content parts (image_url, video_url, input_audio, ...) accept a user-supplied uuid field that vLLM uses verbatim as the item's cache identity (mm_hash). The two frontend/engine processor caches (P0 \"sender\" cache in the API process, P1 \"receiver\" cache in the EngineCore process) are independent LRU caches whose evictions are not synchronized, and the P1 hit path performs zero consistency validat", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-vqqp-x5qm-5qp4", "type": "advisory", "advisoryId": "GHSA-vqqp-x5qm-5qp4", "cveId": null, "title": "FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server", "summary": "Medium severity advisory GHSA-vqqp-x5qm-5qp4 affecting fastmcp, fastmcp-slim. Patched in fastmcp 4.1.2.", "severity": "medium", "cvssScore": 5.9, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "epssPercentile": null, "cwes": [ "CWE-287", "CWE-522" ], "affected": [ { "ecosystem": "pip", "name": "fastmcp", "vulnerableVersionRange": ">= 4.0.0a1, < 4.1.2", "firstPatchedVersion": "4.1.2" }, { "ecosystem": "pip", "name": "fastmcp-slim", "vulnerableVersionRange": ">= 4.0.0a1, < 4.1.2", "firstPatchedVersion": "4.1.2" } ], "matchedTerms": [ "fastmcp", "mcp server", "MCP" ], "disclosedAt": "2026-10-23", "sourceUpdatedAt": "2026-10-23T21:31:31Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-vqqp-x5qm-5qp4", "references": [ "https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-vqqp-x5qm-5qp4", "https://github.com/PrefectHQ/fastmcp/pull/5933", "https://github.com/PrefectHQ/fastmcp/commit/85df42fbf2aa631cc81e0f986718b314128e91df", "https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2", "https://github.com/advisories/GHSA-vqqp-x5qm-5qp4" ], "evidence": "## Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can therefore advertise a different authorization server and receive the client secret or a signed assertion. Signing keys th", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:075d4931", "type": "incident", "advisoryId": "incident:075d4931", "cveId": null, "title": "Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack", "summary": "The Register security reported a security matter involving OpenAI, Hugging Face, Codex on 2026-10-23 (vulnerabilities, exploit, exploited). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "OpenAI", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Hugging Face", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Codex", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "OpenAI", "Hugging Face", "Codex", "ai agent", "agentic" ], "signals": [ "vulnerabilities", "exploit", "exploited", "leaked" ], "disclosedAt": "2026-10-23", "sourceUpdatedAt": "2026-10-23T19:14:57.000Z", "sourceId": "the-register-security", "sourceUrl": "https://www.theregister.com/ai-and-ml/2026/10/23/red-team-report-found-openai-utterly-failed-to-monitor-its-agents-during-hugging-face-attack/5305200", "references": [], "evidence": "An independent evaluation of OpenAI's internal misalignment monitoring system revealed that the system was not fit for purpose during a period when the company's bots were breaking into model-hosting platform Hugging Face. The safeguards weren't nearly strong enough. \"The METR and Redwood employees discovered a number of novel vulnerabilities in the asynchronous internal misalignment monitoring system as it existed o", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:CVE-2026-115845", "type": "incident", "advisoryId": "CVE-2026-115845", "cveId": "CVE-2026-115845", "title": "CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server", "summary": "AWS security bulletins reported a security matter involving Model Context Protocol on 2026-10-23 (security bulletin). Tracks CVE-2026-115845.", "affected": [], "matchedTerms": [ "mcp server", "Model Context Protocol", "AI" ], "signals": [ "security bulletin" ], "disclosedAt": "2026-10-23", "sourceUpdatedAt": "2026-10-23T19:09:22.000Z", "sourceId": "aws-security-bulletins", "sourceUrl": "https://aws.amazon.com/security/security-bulletins/rss/2026-149-aws", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-115845" ], "evidence": "Bulletin ID: 2026-149-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 12:00 PM PDT Description: AWS MCP Server is a managed server that gives AI agents access to AWS through the Model Context Protocol (MCP), including a run_script tool that runs Python scripts in a sandboxed environment. We identified CVE-2026-115845, an issue in the Python code validator of the run_script too", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-354v-3q48-cv69", "type": "advisory", "advisoryId": "GHSA-354v-3q48-cv69", "cveId": "CVE-2026-114135", "title": "Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization", "summary": "High severity advisory GHSA-354v-3q48-cv69 (CVE-2026-114135) affecting jupyter-server. Patched in jupyter-server 2.6.0.", "severity": "high", "cvssScore": 8.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "epssPercentile": 0.41503, "cwes": [ "CWE-862" ], "affected": [ { "ecosystem": "pip", "name": "jupyter-server", "vulnerableVersionRange": ">= 2.0.0, < 2.6.0", "firstPatchedVersion": "2.6.0" } ], "matchedTerms": [ "jupyter-server", "jupyter" ], "disclosedAt": "2026-10-22", "sourceUpdatedAt": "2026-10-22T15:46:32Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-354v-3q48-cv69", "references": [ "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-354v-3q48-cv69", "https://nvd.nist.gov/vuln/detail/CVE-2026-114135", "https://github.com/jupyter-server/jupyter_server/pull/1261", "https://github.com/jupyter-server/jupyter_server/commit/35ffe5d435682128da16dc144a8e9e9f8fa85dd8", "https://github.com/jupyter-server/jupyter_server/releases/tag/v2.6.0", "https://github.com/advisories/GHSA-354v-3q48-cv69" ], "evidence": "### Summary Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels. In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler with this gateway-specific handler. An authenticated user who is denied the execute action on the kernels resource can t", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-7587-9684-52r6", "type": "advisory", "advisoryId": "GHSA-7587-9684-52r6", "cveId": "CVE-2026-115324", "title": "mem0ai Databricks vector store vulnerable to SQL injection", "summary": "Critical severity advisory GHSA-7587-9684-52r6 (CVE-2026-115324) affecting mem0ai. Patched in mem0ai 1.0.8.", "severity": "critical", "cvssScore": 9.2, "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "epssPercentile": 0.24979, "cwes": [ "CWE-89" ], "affected": [ { "ecosystem": "pip", "name": "mem0ai", "vulnerableVersionRange": ">= 0.1.117, < 1.0.8", "firstPatchedVersion": "1.0.8" } ], "matchedTerms": [ "mem0ai" ], "disclosedAt": "2026-10-22", "sourceUpdatedAt": "2026-10-23T20:52:53Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-7587-9684-52r6", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-115324", "https://github.com/mem0ai/mem0/issues/4073", "https://github.com/mem0ai/mem0/pull/4558", "https://github.com/mem0ai/mem0/commit/a2ffca32660537b7b304305f36774ae2a13452cb", "https://github.com/mem0ai/mem0", "https://github.com/mem0ai/mem0/blob/v1.0.7/mem0/vector_stores/databricks.py", "https://github.com/mem0ai/mem0/releases/tag/v1.0.8", "https://www.vulncheck.com/advisories/mem0-0.1.117-before-1.0.8-sql-injection-via-databricks-vector-store" ], "evidence": "mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-pjvx-prjx-h659", "type": "advisory", "advisoryId": "GHSA-pjvx-prjx-h659", "cveId": "CVE-2026-114140", "title": "nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc", "summary": "High severity advisory GHSA-pjvx-prjx-h659 (CVE-2026-114140) affecting nbconvert. Patched in nbconvert 7.17.2.", "severity": "high", "cvssScore": 8.8, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "epssPercentile": 0.39463, "cwes": [ "CWE-22" ], "affected": [ { "ecosystem": "pip", "name": "nbconvert", "vulnerableVersionRange": ">= 5.4.0, <= 7.17.1", "firstPatchedVersion": "7.17.2" } ], "matchedTerms": [ "nbconvert", "jupyter" ], "disclosedAt": "2026-10-22", "sourceUpdatedAt": "2026-10-22T16:23:29Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-pjvx-prjx-h659", "references": [ "https://github.com/jupyter/nbconvert/security/advisories/GHSA-pjvx-prjx-h659", "https://nvd.nist.gov/vuln/detail/CVE-2026-114140", "https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f", "https://github.com/jupyter/nbconvert/releases/tag/v7.17.2", "https://github.com/advisories/GHSA-pjvx-prjx-h659" ], "evidence": "### Summary nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute. Vulnerable converters : --to markdown, --to latex, --to rst, --to asciidoc. In ExtractOutputPreprocessor, extractoutput.py:116-119 joins attacker-controlled path to output_files_dir with no canonicalization check, enabling arbitrary file write. ", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:0fc839c7", "type": "incident", "advisoryId": "incident:0fc839c7", "cveId": null, "title": "LiteLLM Compromised, Steals Credentials", "summary": "Wiz blog reported a security matter involving LiteLLM on 2026-10-21 (malicious, compromised). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "LiteLLM", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "LiteLLM", "AI" ], "signals": [ "malicious", "compromised" ], "disclosedAt": "2026-10-21", "sourceUpdatedAt": "2026-10-21T13:44:12.000Z", "sourceId": "wiz-research", "sourceUrl": "https://www.wiz.io/blog/litellm-compromised-steals-credentials", "references": [], "evidence": "In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a credential stealer targeting browser, cloud and AI secrets as well as a dormant C2 capability.", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:286205e5", "type": "incident", "advisoryId": "incident:286205e5", "cveId": null, "title": "Compromised LiteLLM 1.107.0 on PyPI Ships a Credential Stealer and Code Loader", "summary": "Mend.io blog reported a security matter involving LiteLLM, Claude, Codex, Copilot and 3 more on 2026-10-21 (malicious, compromised). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "LiteLLM", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Claude", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Codex", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Copilot", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Cursor", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Windsurf", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Gemini", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "LiteLLM", "Claude", "Codex", "Copilot", "Cursor", "Windsurf", "Gemini", "AI" ], "signals": [ "malicious", "compromised" ], "disclosedAt": "2026-10-21", "sourceUpdatedAt": "2026-10-21T16:40:20.000Z", "sourceId": "mend-blog", "sourceUrl": "https://www.mend.io/blog/litellm-1-107-0-compromised", "references": [], "evidence": "On October 21, 2026, a malicious release of litellm , the Python library and proxy for calling LLM provider APIs, was published to PyPI as version 1.107.0 . All seven compiled wheels carried three extra files that install straight into the root of site-packages : a .pth hook that runs a credential stealer every time Python starts, and a sitecustomize.py that starts a background loader built to fetch and run remote Py", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:624a988f", "type": "incident", "advisoryId": "incident:624a988f", "cveId": null, "title": "LiteLLM supply chain attack hoovers up passwords and secrets", "summary": "The Register security reported a security matter involving LiteLLM, Anthropic, OpenAI, Gemini on 2026-10-21 (malicious, malware, trojan). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "LiteLLM", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Anthropic", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "OpenAI", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Gemini", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "LiteLLM", "Anthropic", "OpenAI", "Gemini" ], "signals": [ "malicious", "malware", "trojan", "infostealer", "compromised", "compromise", "supply chain", "supply-chain" ], "disclosedAt": "2026-10-21", "sourceUpdatedAt": "2026-10-21T18:22:20.000Z", "sourceId": "the-register-security", "sourceUrl": "https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548", "references": [], "evidence": "Unknown crims compromised LiteLLM's release process on Wednesday, distributing a malicious version (1.107.0) containing malware designed to steal cloud and AI credentials and a remote access trojan (RAT) capable of executing arbitrary code on infected machines through PyPI and Docker registries. PyPI quarantined the trojanized version of the popular open source AI gateway within hours, and the Docker image (litellm/l", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:b8c4b632", "type": "incident", "advisoryId": "incident:b8c4b632", "cveId": null, "title": "LiteLLM 1.107.0 Compromised With A RAT InfoStealer", "summary": "OX Security research reported a security matter involving LiteLLM, Claude Code, GitHub Copilot, Cursor on 2026-10-21 (malicious, malware, trojan). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "LiteLLM", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Claude Code", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "GitHub Copilot", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Cursor", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "LiteLLM", "Claude Code", "GitHub Copilot", "Cursor", "AI" ], "signals": [ "malicious", "malware", "trojan", "infostealer", "compromised", "supply chain", "hijacked" ], "disclosedAt": "2026-10-21", "sourceUpdatedAt": "2026-10-21T15:32:36.000Z", "sourceId": "ox-security", "sourceUrl": "https://www.ox.security/blog/litellm-1-107-0-compromised-with-a-rat-infostealer", "references": [], "evidence": "LiteLLM got hijacked again: the AI gateway used to route traffic to dozens of LLM providers shipped a credential stealer with remote access built in Overview On October 21, 2026, a malicious version of LiteLLM (version 1.107.0) was published to PyPI. LiteLLM is one of the most popular open source gateways for routing requests to LLM providers, which means it usually sits right next to an organization’s most valuable ", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:CVE-2026-112408", "type": "incident", "advisoryId": "CVE-2026-112408", "cveId": "CVE-2026-112408", "title": "CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()", "summary": "AWS security bulletins reported a security matter involving SageMaker on 2026-10-21 (code execution, security bulletin). Tracks CVE-2026-112408.", "affected": [ { "ecosystem": "product", "name": "SageMaker", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "SageMaker" ], "signals": [ "code execution", "security bulletin" ], "disclosedAt": "2026-10-21", "sourceUpdatedAt": "2026-10-21T21:32:10.000Z", "sourceId": "aws-security-bulletins", "sourceUrl": "https://aws.amazon.com/security/security-bulletins/rss/2026-142-aws", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-112408" ], "evidence": "Bulletin ID: 2026-142-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 12:30 PM PDT Description: The Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. We identified CVE-2026-112408, an issue in the default_bucket() function. The SDK uses a predictably named Amazon S3 bucket and does not check that the c", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:e17b69ca", "type": "incident", "advisoryId": "incident:e17b69ca", "cveId": null, "title": "Cloudflare links vulnerability discovery to defense with OpenAI", "summary": "OpenAI news reported a security matter involving OpenAI, Codex on 2026-10-21 (vulnerability, vulnerabilities). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "OpenAI", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Codex", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "OpenAI", "Codex" ], "signals": [ "vulnerability", "vulnerabilities" ], "disclosedAt": "2026-10-21", "sourceUpdatedAt": "2026-10-21T00:00:00.000Z", "sourceId": "openai-news", "sourceUrl": "https://openai.com/index/cloudflare-cyber", "references": [], "evidence": "Cloudflare uses OpenAI Daybreak to investigate vulnerabilities and propose fixes for review. Its developers use Codex to build faster and improve code quality.", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-22jm-h49p-29qw", "type": "advisory", "advisoryId": "GHSA-22jm-h49p-29qw", "cveId": "CVE-2026-111767", "title": "MCP TypeScript SDK: Experimental tasks were not tied to the session that created them", "summary": "High severity advisory GHSA-22jm-h49p-29qw (CVE-2026-111767) affecting @modelcontextprotocol/sdk. Patched in @modelcontextprotocol/sdk 1.32.0.", "severity": "high", "cvssScore": 8.6, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "epssPercentile": 0.2775, "cwes": [ "CWE-639", "CWE-862" ], "affected": [ { "ecosystem": "npm", "name": "@modelcontextprotocol/sdk", "vulnerableVersionRange": ">= 1.24.0, < 1.32.0", "firstPatchedVersion": "1.32.0" } ], "matchedTerms": [ "@modelcontextprotocol/sdk", "MCP" ], "disclosedAt": "2026-10-20", "sourceUpdatedAt": "2026-10-20T18:26:55Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-22jm-h49p-29qw", "references": [ "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw", "https://github.com/modelcontextprotocol/typescript-sdk/pull/2925", "https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa", "https://github.com/advisories/GHSA-22jm-h49p-29qw" ], "evidence": "### Summary In affected versions, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned extension. The best course of action is to stop using them. ### Am I affected? Only if your HTTP server passes taskSt", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-46jr-4wx8-v453", "type": "advisory", "advisoryId": "GHSA-46jr-4wx8-v453", "cveId": "CVE-2026-111768", "title": "MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation", "summary": "High severity advisory GHSA-46jr-4wx8-v453 (CVE-2026-111768) affecting @modelcontextprotocol/sdk, @modelcontextprotocol/server. Patched in @modelcontextprotocol/sdk 1.32.0.", "severity": "high", "cvssScore": 7.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": null, "cwes": [ "CWE-770" ], "affected": [ { "ecosystem": "npm", "name": "@modelcontextprotocol/sdk", "vulnerableVersionRange": ">= 1.3.0, < 1.32.0", "firstPatchedVersion": "1.32.0" }, { "ecosystem": "npm", "name": "@modelcontextprotocol/server", "vulnerableVersionRange": ">= 2.0.0, < 2.3.0", "firstPatchedVersion": "2.3.0" } ], "matchedTerms": [ "@modelcontextprotocol/sdk", "MCP" ], "disclosedAt": "2026-10-20", "sourceUpdatedAt": "2026-10-20T20:06:38Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-46jr-4wx8-v453", "references": [ "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453", "https://github.com/modelcontextprotocol/typescript-sdk/pull/2926", "https://github.com/modelcontextprotocol/typescript-sdk/pull/2927", "https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37", "https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f", "https://github.com/advisories/GHSA-46jr-4wx8-v453" ], "evidence": "### Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with JavaScript heap out of memory. No credentials are needed, unless you authenticate requests before they reach the SDK. ### Am I affected? Yes, if clients you do not fully trus", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-6prh-2h8m-c8cw", "type": "advisory", "advisoryId": "GHSA-6prh-2h8m-c8cw", "cveId": "CVE-2026-111769", "title": "MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies", "summary": "Medium severity advisory GHSA-6prh-2h8m-c8cw (CVE-2026-111769) affecting @modelcontextprotocol/sdk, @modelcontextprotocol/client. Patched in @modelcontextprotocol/sdk 1.32.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "epssPercentile": null, "cwes": [ "CWE-200" ], "affected": [ { "ecosystem": "npm", "name": "@modelcontextprotocol/sdk", "vulnerableVersionRange": "< 1.32.0", "firstPatchedVersion": "1.32.0" }, { "ecosystem": "npm", "name": "@modelcontextprotocol/client", "vulnerableVersionRange": ">= 2.0.0, < 2.3.0", "firstPatchedVersion": "2.3.0" } ], "matchedTerms": [ "@modelcontextprotocol/sdk", "mcp server", "MCP" ], "disclosedAt": "2026-10-20", "sourceUpdatedAt": "2026-10-20T18:26:32Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-6prh-2h8m-c8cw", "references": [ "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw", "https://github.com/modelcontextprotocol/typescript-sdk/pull/2901", "https://github.com/modelcontextprotocol/typescript-sdk/pull/2902", "https://github.com/modelcontextprotocol/typescript-sdk/commit/30bfe5139f4b0825c90cd725f9a7e3f9af5e120d", "https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0", "https://github.com/advisories/GHSA-6prh-2h8m-c8cw" ], "evidence": "### Summary In affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin. If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers (such as an X-API-Key set in requestInit.headers) and the mcp-session-id header. On a 307 or 308 it also received the request body, including OAuth token requests with their r", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-rvq5-wwqv-78pq", "type": "advisory", "advisoryId": "GHSA-rvq5-wwqv-78pq", "cveId": "CVE-2026-111771", "title": "MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service", "summary": "Medium severity advisory GHSA-rvq5-wwqv-78pq (CVE-2026-111771) affecting @modelcontextprotocol/sdk, @modelcontextprotocol/server, @modelcontextprotocol/express, @modelcontextprotocol/server-legacy. Patched in @modelcontextprotocol/sdk 1.32.0.", "severity": "medium", "cvssScore": 6.8, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "epssPercentile": null, "cwes": [ "CWE-863" ], "affected": [ { "ecosystem": "npm", "name": "@modelcontextprotocol/sdk", "vulnerableVersionRange": ">= 1.6.0, < 1.32.0", "firstPatchedVersion": "1.32.0" }, { "ecosystem": "npm", "name": "@modelcontextprotocol/server", "vulnerableVersionRange": ">= 2.0.0, < 2.3.0", "firstPatchedVersion": "2.3.0" }, { "ecosystem": "npm", "name": "@modelcontextprotocol/express", "vulnerableVersionRange": ">= 2.0.0, < 2.0.2", "firstPatchedVersion": "2.0.2" }, { "ecosystem": "npm", "name": "@modelcontextprotocol/server-legacy", "vulnerableVersionRange": ">= 2.0.0, < 2.3.1", "firstPatchedVersion": "2.3.1" } ], "matchedTerms": [ "@modelcontextprotocol/sdk", "mcp server", "MCP" ], "disclosedAt": "2026-10-20", "sourceUpdatedAt": "2026-10-20T19:43:37Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-rvq5-wwqv-78pq", "references": [ "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq", "https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a", "https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f", "https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325", "https://github.com/advisories/GHSA-rvq5-wwqv-78pq" ], "evidence": "### Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. ### Am I affected? Yes, if your HTTP server uses requireBearerAuth() or verifyBearerToken(), its authorization server also issu", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-wqmh-qccw-pqwf", "type": "advisory", "advisoryId": "GHSA-wqmh-qccw-pqwf", "cveId": "CVE-2026-53995", "title": "MLflow FileStore trace IDs allow path traversal and arbitrary file writes", "summary": "High severity advisory GHSA-wqmh-qccw-pqwf (CVE-2026-53995) affecting mlflow. Patched in mlflow 3.17.2.", "severity": "high", "cvssScore": 8.8, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "epssPercentile": 0.48608, "cwes": [ "CWE-22" ], "affected": [ { "ecosystem": "pip", "name": "mlflow", "vulnerableVersionRange": "<= 3.17.1", "firstPatchedVersion": "3.17.2" } ], "matchedTerms": [ "mlflow" ], "disclosedAt": "2026-10-20", "sourceUpdatedAt": "2026-10-23T21:34:10Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-wqmh-qccw-pqwf", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-53995", "https://github.com/mlflow/mlflow/pull/26842", "https://github.com/SaiTeja-Erukude/CVE-2026-53995-mlflow-path-traversal", "https://www.vulncheck.com/advisories/mlflow-path-traversal-via-trace-id-api", "https://github.com/mlflow/mlflow/issues/26979", "https://github.com/mlflow/mlflow/commit/31ff9e56f5038d61ec75344518912945f60dffec", "https://github.com/mlflow/mlflow/releases/tag/v3.17.2", "https://github.com/advisories/GHSA-wqmh-qccw-pqwf" ], "evidence": "MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:CVE-2026-112380", "type": "incident", "advisoryId": "CVE-2026-112380", "cveId": "CVE-2026-112380", "title": "CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew", "summary": "AWS security bulletins reported a security matter involving Kiro on 2026-10-20 (security bulletin). Tracks CVE-2026-112380.", "affected": [ { "ecosystem": "product", "name": "Kiro", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Kiro", "ai agent" ], "signals": [ "security bulletin" ], "disclosedAt": "2026-10-20", "sourceUpdatedAt": "2026-10-20T20:19:42.000Z", "sourceId": "aws-security-bulletins", "sourceUrl": "https://aws.amazon.com/security/security-bulletins/rss/2026-140-aws", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-112380" ], "evidence": "Bulletin ID: 2026-140-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/20/2026 13:00 PM PDT Description: Kiro Crew is an open-source personal AI agent that can be reached from a web dashboard, a CLI, or messaging channels such as WhatsApp, and that runs tools on the operator's machine. We identified CVE-2026-112380, an authorization issue in the WhatsApp channel and the internal subage", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-84m7-p3x7-pcfv", "type": "advisory", "advisoryId": "GHSA-84m7-p3x7-pcfv", "cveId": "CVE-2026-59951", "title": "MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion", "summary": "Medium severity advisory GHSA-84m7-p3x7-pcfv (CVE-2026-59951) affecting mcp. Patched in mcp 1.30.0.", "severity": "medium", "cvssScore": 6.9, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "epssPercentile": 0.39539, "cwes": [ "CWE-400", "CWE-770", "CWE-772" ], "affected": [ { "ecosystem": "pip", "name": "mcp", "vulnerableVersionRange": ">= 1.8.0, < 1.30.0", "firstPatchedVersion": "1.30.0" }, { "ecosystem": "pip", "name": "mcp", "vulnerableVersionRange": ">= 2.0.0, < 2.2.0", "firstPatchedVersion": "2.2.0" } ], "matchedTerms": [ "mcp", "MCP" ], "disclosedAt": "2026-10-15", "sourceUpdatedAt": "2026-10-15T20:13:14Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-84m7-p3x7-pcfv", "references": [ "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-84m7-p3x7-pcfv", "https://nvd.nist.gov/vuln/detail/CVE-2026-59951", "https://github.com/modelcontextprotocol/python-sdk/pull/3395", "https://github.com/modelcontextprotocol/python-sdk/pull/3426", "https://github.com/modelcontextprotocol/python-sdk/commit/92120b4b0f50385af096592d7cee932fc1d994e7", "https://github.com/modelcontextprotocol/python-sdk/commit/d2290ca3434731b68ea3e2270bc06a6e6575931b", "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0", "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0" ], "evidence": "### Summary In affected versions, a Streamable HTTP server in stateful mode (the default) never reclaimed session state: - sessions did not expire; - a client DELETE ended the session but left its entry registered; - a session whose first request was refused stayed registered with a running task. Each session also kept its parsed initialize parameters, and the number of sessions was unlimited. A client that could rea", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-jwrc-gm9j-263p", "type": "advisory", "advisoryId": "GHSA-jwrc-gm9j-263p", "cveId": "CVE-2026-102832", "title": "JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked", "summary": "Medium severity advisory GHSA-jwrc-gm9j-263p (CVE-2026-102832) affecting jupyterlab, notebook, jupyterlite-core. Patched in jupyterlab 4.6.4.", "severity": "medium", "cvssScore": 4.2, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "epssPercentile": 0.03556, "cwes": [ "CWE-367", "CWE-863" ], "affected": [ { "ecosystem": "pip", "name": "jupyterlab", "vulnerableVersionRange": ">= 4.6.0, <= 4.6.3", "firstPatchedVersion": "4.6.4" }, { "ecosystem": "pip", "name": "jupyterlab", "vulnerableVersionRange": ">= 4.5.7, <= 4.5.10", "firstPatchedVersion": "4.5.11" }, { "ecosystem": "pip", "name": "notebook", "vulnerableVersionRange": ">= 7.5.6, <= 7.6.2", "firstPatchedVersion": "7.6.3" }, { "ecosystem": "pip", "name": "jupyterlite-core", "vulnerableVersionRange": ">= 0.7.5, <= 0.8.3", "firstPatchedVersion": "0.8.4" } ], "matchedTerms": [ "jupyterlab", "notebook" ], "disclosedAt": "2026-10-15", "sourceUpdatedAt": "2026-10-15T20:22:14Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-jwrc-gm9j-263p", "references": [ "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-jwrc-gm9j-263p", "https://nvd.nist.gov/vuln/detail/CVE-2026-102832", "https://github.com/jupyterlab/jupyterlab/commit/0fc18ab4ef67e431a8f6560e387193baf786c70a", "https://github.com/jupyterlab/jupyterlab/commit/b64bc88b8ca034cf158604a5cc48ca9170ea453b", "https://github.com/jupyterlab/jupyterlab/commit/f7e5f9803fdf2aaaa0e9bfb9cc73386a8cc5f0b2", "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11", "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4", "https://github.com/advisories/GHSA-jwrc-gm9j-263p" ], "evidence": "## Description A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the first click on such a button opens a prompt naming the command, with Cancel, Run Once and Trust. Choosing Trust runs the command and marks the document trusted, so its later buttons run without a prompt. Which document gets marked is decided when the user answers, not when they click. Both trust comm", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-pq7j-f95f-qfcv", "type": "advisory", "advisoryId": "GHSA-pq7j-f95f-qfcv", "cveId": "CVE-2026-86063", "title": "Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning", "summary": "High severity advisory GHSA-pq7j-f95f-qfcv (CVE-2026-86063) affecting @anthropic-ai/claude-code. Patched in @anthropic-ai/claude-code 2.1.179.", "severity": "high", "cvssScore": 7.5, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "epssPercentile": 0.06502, "cwes": [ "CWE-494", "CWE-829" ], "affected": [ { "ecosystem": "npm", "name": "@anthropic-ai/claude-code", "vulnerableVersionRange": "< 2.1.179", "firstPatchedVersion": "2.1.179" } ], "matchedTerms": [ "@anthropic-ai/claude-code" ], "disclosedAt": "2026-10-15", "sourceUpdatedAt": "2026-10-15T20:22:08Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-pq7j-f95f-qfcv", "references": [ "https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv", "https://nvd.nist.gov/vuln/detail/CVE-2026-86063", "https://github.com/anthropics/claude-code/releases/tag/v2.1.179", "https://github.com/advisories/GHSA-pq7j-f95f-qfcv" ], "evidence": "The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, re", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:CVE-2026-110248", "type": "incident", "advisoryId": "CVE-2026-110248", "cveId": "CVE-2026-110248", "title": "CVE-2026-110248 - Insertion of sensitive information into log files in Amazon SageMaker Python SDK", "summary": "AWS security bulletins reported a security matter involving SageMaker on 2026-10-14 (security bulletin). Tracks CVE-2026-110248.", "affected": [ { "ecosystem": "product", "name": "SageMaker", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "SageMaker" ], "signals": [ "security bulletin" ], "disclosedAt": "2026-10-14", "sourceUpdatedAt": "2026-10-14T18:38:55.000Z", "sourceId": "aws-security-bulletins", "sourceUrl": "https://aws.amazon.com/security/security-bulletins/rss/2026-134-aws", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-110248" ], "evidence": "Bulletin ID: 2026-134-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/14/2026 11:30 AM PDT Description: Amazon SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. We identified CVE-2026-110248, an issue in the git_utils.py component of Amazon SageMaker Python SDK. When a Git clone operation fails, repository credential", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:cf8ca01f", "type": "incident", "advisoryId": "CVE-2026-35029", "cveId": "CVE-2026-35029", "title": "When LLM Gateways Go Wrong: Findings from LiteLLM", "summary": "Check Point Research reported a security matter involving LiteLLM on 2026-10-13 (vulnerability, vulnerabilities, flaw). Tracks CVE-2026-35029, CVE-2026-59823.", "affected": [ { "ecosystem": "product", "name": "LiteLLM", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "LiteLLM", "AI" ], "signals": [ "vulnerability", "vulnerabilities", "flaw", "remote code execution", "code execution", "malicious", "exfiltrate", "SSRF" ], "disclosedAt": "2026-10-13", "sourceUpdatedAt": "2026-10-13T14:30:26.000Z", "sourceId": "checkpoint-research", "sourceUrl": "https://research.checkpoint.com/2026/when-llm-gateways-go-wrong-findings-from-litellm", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-35029", "https://nvd.nist.gov/vuln/detail/CVE-2026-59823" ], "evidence": "TL;DR; Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029 , CVE-2026-59823) which have been resolved as of LiteLLM version 1.83.9. The most significant issues stemmed from a missing authorization check on the /config/update endpoint, which allowed any authenticated user (including low-privileged accounts) to mo", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:CVE-2026-103572", "type": "incident", "advisoryId": "CVE-2026-103572", "cveId": "CVE-2026-103572", "title": "Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)", "summary": "Embrace The Red reported a security matter involving Copilot on 2026-10-13 (vulnerability, remote code execution, code execution). Tracks CVE-2026-103572.", "affected": [ { "ecosystem": "product", "name": "Copilot", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Copilot" ], "signals": [ "vulnerability", "remote code execution", "code execution" ], "disclosedAt": "2026-10-13", "sourceUpdatedAt": "2026-10-13T22:00:40.000Z", "sourceId": "embrace-the-red", "sourceUrl": "https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-103572" ], "evidence": "A . is all you need! Today Microsoft shipped the patch for a vulnerability in Visual Studio Copilot that I reported in August. Microsoft classified it as Important severity Remote Code Execution vulnerability. At the root cause it allows Copilot in Visual Studio or SQL Server Management Studio to bypass a path validation check and write to its own settings and configuration files . This allows Copilot to escape conta", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-3gh4-cghq-f8v4", "type": "advisory", "advisoryId": "GHSA-3gh4-cghq-f8v4", "cveId": "CVE-2026-107293", "title": "Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when include_content=False", "summary": "Low severity advisory GHSA-3gh4-cghq-f8v4 (CVE-2026-107293) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.4.", "severity": "low", "cvssScore": 2.3, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "epssPercentile": 0.22129, "cwes": [ "CWE-212", "CWE-532" ], "affected": [ { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 0.3.4, < 1.107.4", "firstPatchedVersion": "1.107.4" }, { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 2.0.0b1, < 2.27.1", "firstPatchedVersion": "2.27.1" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 0.3.4, < 1.107.4", "firstPatchedVersion": "1.107.4" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 2.0.0b1, < 2.27.1", "firstPatchedVersion": "2.27.1" } ], "matchedTerms": [ "pydantic-ai", "AI" ], "disclosedAt": "2026-10-08", "sourceUpdatedAt": "2026-10-08T17:16:33Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-3gh4-cghq-f8v4", "references": [ "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-3gh4-cghq-f8v4", "https://github.com/pydantic/pydantic-ai/pull/7357", "https://github.com/pydantic/pydantic-ai/commit/fe9dbed7b7ccf7e7128b5786886e4441f6f5594f", "https://github.com/pydantic/pydantic-ai/releases/tag/v2.27.1", "https://github.com/advisories/GHSA-3gh4-cghq-f8v4" ], "evidence": "### Summary Pydantic AI's OpenTelemetry instrumentation supports InstrumentationSettings(include_content=False) to exclude message content — user prompts, model completions, tool call arguments and responses — from exported telemetry, so that agents can be monitored without sending sensitive content to the observability backend. Retry prompts — the feedback messages Pydantic AI sends back to the model when its output", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-4x9p-g9wm-8q7f", "type": "advisory", "advisoryId": "GHSA-4x9p-g9wm-8q7f", "cveId": "CVE-2026-107291", "title": "Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when include_content=False", "summary": "Low severity advisory GHSA-4x9p-g9wm-8q7f (CVE-2026-107291) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.6.", "severity": "low", "cvssScore": 2.3, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "epssPercentile": 0.495, "cwes": [ "CWE-212", "CWE-532" ], "affected": [ { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 0.3.4, < 1.107.6", "firstPatchedVersion": "1.107.6" }, { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 2.0.0b1, < 2.44.0", "firstPatchedVersion": "2.44.0" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 0.3.4, < 1.107.6", "firstPatchedVersion": "1.107.6" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 2.0.0b1, < 2.44.0", "firstPatchedVersion": "2.44.0" } ], "matchedTerms": [ "pydantic-ai", "AI" ], "disclosedAt": "2026-10-08", "sourceUpdatedAt": "2026-10-08T16:48:17Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-4x9p-g9wm-8q7f", "references": [ "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-4x9p-g9wm-8q7f", "https://github.com/pydantic/pydantic-ai/pull/8403", "https://github.com/pydantic/pydantic-ai/pull/8404", "https://github.com/pydantic/pydantic-ai/pull/8408", "https://github.com/pydantic/pydantic-ai/pull/8428", "https://github.com/pydantic/pydantic-ai/pull/8429", "https://github.com/pydantic/pydantic-ai/commit/4e013c51a50659aba2adf7853bfb22bb77f6a518", "https://github.com/pydantic/pydantic-ai/commit/6b14c74cb281f899a2ae4fae5327111e33f60771" ], "evidence": "### Summary Pydantic AI's OpenTelemetry instrumentation supports InstrumentationSettings(include_content=False) to exclude message content — user prompts, model completions, tool call arguments and responses, and any other message content — from exported telemetry, so that agents can be monitored without sending sensitive content to the observability backend. The message attributes honoured the setting. Several other", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-6fqq-452j-qhrp", "type": "advisory", "advisoryId": "GHSA-6fqq-452j-qhrp", "cveId": "CVE-2026-107286", "title": "Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early", "summary": "High severity advisory GHSA-6fqq-452j-qhrp (CVE-2026-107286) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 2.53.0.", "severity": "high", "cvssScore": 7.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.38808, "cwes": [ "CWE-772" ], "affected": [ { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 2.10.0, < 2.53.0", "firstPatchedVersion": "2.53.0" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 2.10.0, < 2.53.0", "firstPatchedVersion": "2.53.0" } ], "matchedTerms": [ "pydantic-ai", "AI" ], "disclosedAt": "2026-10-08", "sourceUpdatedAt": "2026-10-08T19:42:56Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-6fqq-452j-qhrp", "references": [ "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-6fqq-452j-qhrp", "https://nvd.nist.gov/vuln/detail/CVE-2026-107286", "https://github.com/pydantic/pydantic-ai/pull/9478", "https://github.com/pydantic/pydantic-ai/commit/453f19feeb7ab1d789f9393b1723c6a73b3d77b2", "https://github.com/pydantic/pydantic-ai/releases/tag/v2.53.0", "https://github.com/advisories/GHSA-6fqq-452j-qhrp" ], "evidence": "> This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. ### Summary Applications that wrap a model with ConcurrencyLimitedModel or limit_model_concurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one that acquired it. This can happen when a stream ends early, and also when a stream is fully consumed using the defau", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-fpf4-vwcp-v4hp", "type": "advisory", "advisoryId": "GHSA-fpf4-vwcp-v4hp", "cveId": "CVE-2026-107290", "title": "Pydantic AI: Event loop blocked by quadratic title extraction in web_fetch", "summary": "Medium severity advisory GHSA-fpf4-vwcp-v4hp (CVE-2026-107290) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.6.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.43521, "cwes": [ "CWE-407", "CWE-1333" ], "affected": [ { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 1.77.0, < 1.107.6", "firstPatchedVersion": "1.107.6" }, { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 2.0.0b1, < 2.44.0", "firstPatchedVersion": "2.44.0" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 1.77.0, < 1.107.6", "firstPatchedVersion": "1.107.6" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 2.0.0b1, < 2.44.0", "firstPatchedVersion": "2.44.0" } ], "matchedTerms": [ "pydantic-ai", "AI" ], "disclosedAt": "2026-10-08", "sourceUpdatedAt": "2026-10-08T16:48:27Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-fpf4-vwcp-v4hp", "references": [ "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-fpf4-vwcp-v4hp", "https://github.com/pydantic/pydantic-ai/pull/8397", "https://github.com/pydantic/pydantic-ai/pull/8399", "https://github.com/pydantic/pydantic-ai/pull/8418", "https://github.com/pydantic/pydantic-ai/pull/8433", "https://github.com/pydantic/pydantic-ai/pull/8434", "https://github.com/pydantic/pydantic-ai/commit/2faa6181d8a17d83bc9516d035c5270db8730fa0", "https://github.com/pydantic/pydantic-ai/commit/9cdc952e4c3319e85a3e04f2de49fbbb765bd38b" ], "evidence": "### Summary The local web-fetch tool (web_fetch_tool, also used as the WebFetch capability's local fallback) processed responses with several steps whose running time grows quadratically with the size of certain server-controlled inputs, and ran them on the event loop: decoding the body with whichever charset the server declared, extracting the page title with a backtracking regular expression, and converting the HTM", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-h4xc-3qfq-jf93", "type": "advisory", "advisoryId": "GHSA-h4xc-3qfq-jf93", "cveId": "CVE-2026-107295", "title": "Pydantic AI Web chat UI (Agent.to_web(), clai web): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat e", "summary": "High severity advisory GHSA-h4xc-3qfq-jf93 (CVE-2026-107295) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.4.", "severity": "high", "cvssScore": 7.6, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L", "epssPercentile": 0.04515, "cwes": [ "CWE-346", "CWE-352" ], "affected": [ { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 1.34.0, < 1.107.4", "firstPatchedVersion": "1.107.4" }, { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 2.0.0b1, < 2.28.0", "firstPatchedVersion": "2.28.0" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 1.34.0, < 1.107.4", "firstPatchedVersion": "1.107.4" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 2.0.0b1, < 2.28.0", "firstPatchedVersion": "2.28.0" } ], "matchedTerms": [ "pydantic-ai", "AI" ], "disclosedAt": "2026-10-08", "sourceUpdatedAt": "2026-10-08T17:16:37Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-h4xc-3qfq-jf93", "references": [ "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h4xc-3qfq-jf93", "https://github.com/pydantic/pydantic-ai/pull/7382", "https://github.com/pydantic/pydantic-ai/pull/7383", "https://github.com/pydantic/pydantic-ai/commit/d2690201a1834005d382dbf5c47e0ed94ef8bf46", "https://github.com/pydantic/pydantic-ai/commit/dd2abbdfa029c9ad138e7cc0edd2eaeaf9ed69c0", "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.4", "https://github.com/pydantic/pydantic-ai/releases/tag/v2.28.0", "https://github.com/advisories/GHSA-h4xc-3qfq-jf93" ], "evidence": "### Summary The Pydantic AI development web chat UI (Agent.to_web(), clai web) did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer's machine, causing the served agent to run and to execute its tools with the privileges and credentials of the local process. Binding the web UI to localhost — the default", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-q2xc-rrxj-58x9", "type": "advisory", "advisoryId": "GHSA-q2xc-rrxj-58x9", "cveId": "CVE-2026-107292", "title": "Pydantic AI Web chat UI (Agent.to_web(), clai web): the local chat endpoint does not validate the Host header", "summary": "Medium severity advisory GHSA-q2xc-rrxj-58x9 (CVE-2026-107292) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.5.", "severity": "medium", "cvssScore": 6.4, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L", "epssPercentile": 0.02501, "cwes": [ "CWE-346", "CWE-350" ], "affected": [ { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 1.34.0, < 1.107.5", "firstPatchedVersion": "1.107.5" }, { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 2.0.0b1, < 2.30.0", "firstPatchedVersion": "2.30.0" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 1.34.0, < 1.107.5", "firstPatchedVersion": "1.107.5" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 2.0.0b1, < 2.30.0", "firstPatchedVersion": "2.30.0" } ], "matchedTerms": [ "pydantic-ai", "AI" ], "disclosedAt": "2026-10-08", "sourceUpdatedAt": "2026-10-08T17:16:42Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-q2xc-rrxj-58x9", "references": [ "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-q2xc-rrxj-58x9", "https://github.com/pydantic/pydantic-ai/pull/7437", "https://github.com/pydantic/pydantic-ai/pull/7438", "https://github.com/pydantic/pydantic-ai/commit/394cc1d31656620704a703a2daed752afa5135fe", "https://github.com/pydantic/pydantic-ai/commit/871c7aeec5dfed2138655ccbccbf15c6d763bae7", "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.5", "https://github.com/pydantic/pydantic-ai/releases/tag/v2.30.0", "https://github.com/advisories/GHSA-q2xc-rrxj-58x9" ], "evidence": "### Summary The Pydantic AI development web chat UI (Agent.to_web(), clai web) does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served agent to run and to execute its tools with the privileges and credentials of the local process. ### Details Once a", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-v2xh-2vp8-57h8", "type": "advisory", "advisoryId": "GHSA-v2xh-2vp8-57h8", "cveId": "CVE-2026-107294", "title": "Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl", "summary": "Medium severity advisory GHSA-v2xh-2vp8-57h8 (CVE-2026-107294) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.2.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.37694, "cwes": [ "CWE-400", "CWE-770" ], "affected": [ { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 1.77.0, < 1.107.2", "firstPatchedVersion": "1.107.2" }, { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 2.0.0b1, <= 2.23.0", "firstPatchedVersion": "2.24.0" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 1.77.0, < 1.107.2", "firstPatchedVersion": "1.107.2" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 2.0.0b1, <= 2.23.0", "firstPatchedVersion": "2.24.0" } ], "matchedTerms": [ "pydantic-ai", "AI" ], "disclosedAt": "2026-10-08", "sourceUpdatedAt": "2026-10-08T17:16:28Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-v2xh-2vp8-57h8", "references": [ "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8", "https://github.com/pydantic/pydantic-ai/pull/7141", "https://github.com/pydantic/pydantic-ai/pull/7308", "https://github.com/pydantic/pydantic-ai/commit/7a64d049c3f5271a975cd1d64b2fa876d83ede1d", "https://github.com/pydantic/pydantic-ai/commit/e3824a58c82864ed26afb2887619834a4eb86cc8", "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.2", "https://github.com/pydantic/pydantic-ai/releases/tag/v2.24.0", "https://github.com/advisories/GHSA-v2xh-2vp8-57h8" ], "evidence": "### Summary Several remote-content download paths in Pydantic AI buffered the entire HTTP response body into memory before enforcing any size limit. An application that exposes the local web-fetch tool (web_fetch_tool, or the WebFetch capability's local fallback) to untrusted prompts can be driven to fetch an attacker-chosen URL that streams a very large body, exhausting process memory and crashing the worker. The sa", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-v36g-jcw9-x7cw", "type": "advisory", "advisoryId": "GHSA-v36g-jcw9-x7cw", "cveId": "CVE-2026-107287", "title": "Pydantic AI: Excessive resource use when local web fetching converts nested HTML", "summary": "Medium severity advisory GHSA-v36g-jcw9-x7cw (CVE-2026-107287) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.7.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "epssPercentile": 0.19913, "cwes": [ "CWE-400", "CWE-407" ], "affected": [ { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 1.77.0, < 1.107.7", "firstPatchedVersion": "1.107.7" }, { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 2.0.0b1, < 2.52.0", "firstPatchedVersion": "2.52.0" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 1.77.0, < 1.107.7", "firstPatchedVersion": "1.107.7" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 2.0.0b1, < 2.52.0", "firstPatchedVersion": "2.52.0" } ], "matchedTerms": [ "pydantic-ai", "AI" ], "disclosedAt": "2026-10-08", "sourceUpdatedAt": "2026-10-08T17:40:52Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-v36g-jcw9-x7cw", "references": [ "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v36g-jcw9-x7cw", "https://github.com/pydantic/pydantic-ai/pull/8984", "https://github.com/pydantic/pydantic-ai/pull/8985", "https://github.com/pydantic/pydantic-ai/commit/2b247add4950bef61d352e7ca8aefbd20539180c", "https://github.com/pydantic/pydantic-ai/commit/2fd38792693da00a3ca5412aeffb436787af3545", "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.7", "https://github.com/pydantic/pydantic-ai/releases/tag/v2.52.0", "https://github.com/advisories/GHSA-v36g-jcw9-x7cw" ], "evidence": "### Summary Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. ### Details Nested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limi", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-vmxc-h2x2-jmf3", "type": "advisory", "advisoryId": "GHSA-vmxc-h2x2-jmf3", "cveId": "CVE-2026-107289", "title": "Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers", "summary": "Medium severity advisory GHSA-vmxc-h2x2-jmf3 (CVE-2026-107289) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.6.", "severity": "medium", "cvssScore": 6.8, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "epssPercentile": 0.32848, "cwes": [ "CWE-918", "CWE-1289" ], "affected": [ { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 1.56.0, < 1.107.6", "firstPatchedVersion": "1.107.6" }, { "ecosystem": "pip", "name": "pydantic-ai", "vulnerableVersionRange": ">= 2.0.0b1, < 2.44.0", "firstPatchedVersion": "2.44.0" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 1.56.0, < 1.107.6", "firstPatchedVersion": "1.107.6" }, { "ecosystem": "pip", "name": "pydantic-ai-slim", "vulnerableVersionRange": ">= 2.0.0b1, < 2.44.0", "firstPatchedVersion": "2.44.0" } ], "matchedTerms": [ "pydantic-ai", "AI" ], "disclosedAt": "2026-10-08", "sourceUpdatedAt": "2026-10-08T16:48:07Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-vmxc-h2x2-jmf3", "references": [ "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-vmxc-h2x2-jmf3", "https://github.com/pydantic/pydantic-ai/pull/8401", "https://github.com/pydantic/pydantic-ai/pull/8402", "https://github.com/pydantic/pydantic-ai/commit/02157e1b87bd45d3f2e111ce07afdf89f9fb0e5b", "https://github.com/pydantic/pydantic-ai/commit/4da70591460f51a8c4f128eaeef70a33340dbd55", "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6", "https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0", "https://github.com/advisories/GHSA-vmxc-h2x2-jmf3" ], "evidence": "### Summary When an application using Pydantic AI opts a URL into local network access — either a FileUrl with force_download='allow-local', or web_fetch_tool(allow_local_urls=True) — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address (for example fd00:ec2::254%251). The host ignores the zone identifier on a destination that is not link-local and delivers the req", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:fa950d38", "type": "incident", "advisoryId": "incident:fa950d38", "cveId": null, "title": "What RL Found Before Anthropic’s Midnight Blizzard Report", "summary": "ReversingLabs blog reported a security matter involving Anthropic on 2026-10-08 (malware). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Anthropic", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Anthropic", "AI" ], "signals": [ "malware" ], "disclosedAt": "2026-10-08", "sourceUpdatedAt": "2026-10-08T16:30:00.000Z", "sourceId": "reversinglabs-blog", "sourceUrl": "https://www.reversinglabs.com/blog/anthropic-midnight-blizzard-what-reversinglabs-found-first", "references": [], "evidence": "ReversingLabs identified and classified the malware weeks before the report was published — showing why behavioral intelligence and historical telemetry matter in the AI age.", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-4f6c-2vvp-gw82", "type": "advisory", "advisoryId": "GHSA-4f6c-2vvp-gw82", "cveId": "CVE-2026-105741", "title": "Langflow: IP Spoofing Bypass via X-Forwarded-For Allowing Remote Configuration Write", "summary": "High severity advisory GHSA-4f6c-2vvp-gw82 (CVE-2026-105741) affecting langflow. Patched in langflow 1.10.3.", "severity": "high", "cvssScore": 7.1, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "epssPercentile": 0.15512, "cwes": [ "CWE-290", "CWE-345" ], "affected": [ { "ecosystem": "pip", "name": "langflow", "vulnerableVersionRange": ">= 1.5.0, < 1.10.3", "firstPatchedVersion": "1.10.3" } ], "matchedTerms": [ "langflow", "model context protocol", "mcp server", "MCP" ], "disclosedAt": "2026-10-07", "sourceUpdatedAt": "2026-10-07T16:18:25Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-4f6c-2vvp-gw82", "references": [ "https://github.com/langflow-ai/langflow/security/advisories/GHSA-4f6c-2vvp-gw82", "https://nvd.nist.gov/vuln/detail/CVE-2026-105741", "https://github.com/langflow-ai/langflow/pull/13915", "https://github.com/langflow-ai/langflow/commit/1f39a4b9d62c9dfa1b21fa7f85e23a180c351b72", "https://github.com/langflow-ai/langflow/commit/94859df33acd70b2a1f816e26d68f5e89a7e5639", "https://github.com/langflow-ai/langflow/releases/tag/v1.10.3", "https://github.com/advisories/GHSA-4f6c-2vvp-gw82" ], "evidence": "Description: ### Summary An IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the \"local-only\" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1 header, an attacker could make the server treat the request as originating from localhost, letting them write/ov", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-4hmc-cfm3-w43c", "type": "advisory", "advisoryId": "GHSA-4hmc-cfm3-w43c", "cveId": "CVE-2026-105699", "title": "Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers", "summary": "High severity advisory GHSA-4hmc-cfm3-w43c (CVE-2026-105699) affecting langflow. Patched in langflow 1.9.1.", "severity": "high", "cvssScore": 7.1, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "epssPercentile": 0.23942, "cwes": [ "CWE-639" ], "affected": [ { "ecosystem": "pip", "name": "langflow", "vulnerableVersionRange": ">= 1.6.8, <= 1.9.0", "firstPatchedVersion": "1.9.1" } ], "matchedTerms": [ "langflow", "mcp server", "MCP" ], "disclosedAt": "2026-10-07", "sourceUpdatedAt": "2026-10-07T20:35:13Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-4hmc-cfm3-w43c", "references": [ "https://github.com/langflow-ai/langflow/security/advisories/GHSA-4hmc-cfm3-w43c", "https://nvd.nist.gov/vuln/detail/CVE-2026-105699", "https://github.com/langflow-ai/langflow/pull/12818", "https://github.com/langflow-ai/langflow/commit/b8fe970493fd5fb2e1fc71dfccc79f90b76058fa", "https://github.com/langflow-ai/langflow/commit/f0fd436fe9829192ee550e6cb46961a01dd37032", "https://github.com/langflow-ai/langflow/releases/tag/v1.9.1", "https://github.com/advisories/GHSA-4hmc-cfm3-w43c" ], "evidence": "### Summary Langflow's project-scoped MCP transport authenticates the caller for the project_id in the connection URL, but the subsequent resources/read operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scoped MCP endpoint and supply a crafted file-download URI that points to another user's flow-backed file. The server then reads and returns the vict", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-9gvv-qjj3-2p6g", "type": "advisory", "advisoryId": "GHSA-9gvv-qjj3-2p6g", "cveId": "CVE-2026-73483", "title": "Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium", "summary": "Critical severity advisory GHSA-9gvv-qjj3-2p6g (CVE-2026-73483) affecting flowise, flowise-components. Patched in flowise 3.1.3.", "severity": "critical", "cvssScore": 9.4, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "epssPercentile": 0.49504, "cwes": [], "affected": [ { "ecosystem": "npm", "name": "flowise", "vulnerableVersionRange": "<= 3.1.2", "firstPatchedVersion": "3.1.3" }, { "ecosystem": "npm", "name": "flowise-components", "vulnerableVersionRange": "<= 3.1.2", "firstPatchedVersion": "3.1.3" } ], "matchedTerms": [ "flowise" ], "disclosedAt": "2026-10-07", "sourceUpdatedAt": "2026-10-07T16:17:03Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-9gvv-qjj3-2p6g", "references": [ "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9gvv-qjj3-2p6g", "https://nvd.nist.gov/vuln/detail/CVE-2026-73483", "https://www.vulncheck.com/advisories/flowise-before-sandbox-escape-via-puppeteer", "https://github.com/advisories/GHSA-9gvv-qjj3-2p6g" ], "evidence": "Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. This ", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-gh98-4phw-6fmw", "type": "advisory", "advisoryId": "GHSA-gh98-4phw-6fmw", "cveId": "CVE-2026-105698", "title": "Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints", "summary": "Medium severity advisory GHSA-gh98-4phw-6fmw (CVE-2026-105698) affecting langflow, langflow-base. Patched in langflow 1.10.1.", "severity": "medium", "cvssScore": 5.4, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "epssPercentile": 0.13108, "cwes": [ "CWE-639", "CWE-862" ], "affected": [ { "ecosystem": "pip", "name": "langflow", "vulnerableVersionRange": ">= 1.0.0, < 1.10.1", "firstPatchedVersion": "1.10.1" }, { "ecosystem": "pip", "name": "langflow-base", "vulnerableVersionRange": "< 0.10.1", "firstPatchedVersion": "0.10.1" } ], "matchedTerms": [ "langflow" ], "disclosedAt": "2026-10-07", "sourceUpdatedAt": "2026-10-07T20:36:26Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-gh98-4phw-6fmw", "references": [ "https://github.com/langflow-ai/langflow/security/advisories/GHSA-gh98-4phw-6fmw", "https://nvd.nist.gov/vuln/detail/CVE-2026-105698", "https://github.com/langflow-ai/langflow/pull/13153", "https://github.com/langflow-ai/langflow/commit/fb3d6ec90b1e4d52eaa40915a64b1f86b6542f55", "https://github.com/langflow-ai/langflow/releases/tag/v1.10.1", "https://github.com/advisories/GHSA-gh98-4phw-6fmw" ], "evidence": "### Summary Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path: - POST /api/v1/build/{flow_id}/vertices (retrieve_vertices_order) - POST /api/v1/build/{flow_id}/vertices/{vertex_id} (build_vertex) Any authenticated user who knows (or obtains) another user's flow_id could load that user's private flow gr", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-w794-rj3p-xv45", "type": "advisory", "advisoryId": "GHSA-w794-rj3p-xv45", "cveId": "CVE-2026-105697", "title": "Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration", "summary": "Critical severity advisory GHSA-w794-rj3p-xv45 (CVE-2026-105697) affecting langflow, langflow-base, lfx. Patched in langflow 1.10.3.", "severity": "critical", "cvssScore": 9.9, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "epssPercentile": 0.6117, "cwes": [ "CWE-78" ], "affected": [ { "ecosystem": "pip", "name": "langflow", "vulnerableVersionRange": ">= 1.1.2, < 1.10.3", "firstPatchedVersion": "1.10.3" }, { "ecosystem": "pip", "name": "langflow-base", "vulnerableVersionRange": ">= 0.1.2, < 0.10.3", "firstPatchedVersion": "0.10.3" }, { "ecosystem": "pip", "name": "lfx", "vulnerableVersionRange": "< 1.10.3", "firstPatchedVersion": "1.10.3" } ], "matchedTerms": [ "langflow", "mcp server", "MCP" ], "disclosedAt": "2026-10-07", "sourceUpdatedAt": "2026-10-09T19:57:02Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-w794-rj3p-xv45", "references": [ "https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45", "https://nvd.nist.gov/vuln/detail/CVE-2026-105697", "https://github.com/langflow-ai/langflow/pull/12290", "https://github.com/langflow-ai/langflow/pull/14036", "https://github.com/langflow-ai/langflow/commit/eba285edf1dd4a33bf23a9cb8113c991fcdf3d1d", "https://github.com/langflow-ai/langflow/commit/efbc4a16e639409d938a4883463d27ef0bc637a0", "https://github.com/langflow-ai/langflow/releases/tag/v1.10.3", "https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2" ], "evidence": "### Summary Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c \"exec {command} ...\". Any user able to reach the MCP server settings (\"Settings → MCP Servers → Add MCP Server\", POST/PATCH /api/v2/mcp/servers/{server_name}) or to build a flow with the MCP Tools component could add a \"server\"", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-w7x8-q2gp-5cgg", "type": "advisory", "advisoryId": "GHSA-w7x8-q2gp-5cgg", "cveId": "CVE-2026-73487", "title": "Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass", "summary": "Critical severity advisory GHSA-w7x8-q2gp-5cgg (CVE-2026-73487) affecting flowise, flowise-components. Patched in flowise 3.1.3.", "severity": "critical", "cvssScore": 9, "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N", "epssPercentile": 0.61528, "cwes": [ "CWE-94" ], "affected": [ { "ecosystem": "npm", "name": "flowise", "vulnerableVersionRange": "<= 3.1.2", "firstPatchedVersion": "3.1.3" }, { "ecosystem": "npm", "name": "flowise-components", "vulnerableVersionRange": "<= 3.1.2", "firstPatchedVersion": "3.1.3" } ], "matchedTerms": [ "flowise", "prompt injection", "LLM" ], "disclosedAt": "2026-10-07", "sourceUpdatedAt": "2026-10-07T16:17:22Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-w7x8-q2gp-5cgg", "references": [ "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-w7x8-q2gp-5cgg", "https://nvd.nist.gov/vuln/detail/CVE-2026-73487", "https://www.vulncheck.com/advisories/flowise-before-prompt-injection-rce-via-csv-agent", "https://github.com/advisories/GHSA-w7x8-q2gp-5cgg" ], "evidence": "## Summary Flowise <= 3.1.2 CSV Agent and Airtable Agent nodes use a regex-based blocklist (validatePythonCodeForDataFrame()) to sanitize LLM-generated Python code before execution in Pyodide. The validator has multiple structural bypasses that allow an attacker to exfiltrate all loaded data to an external server, perform SSRF against internal services, and potentially achieve further code execution -- all through pr", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-6qxp-vccf-f47h", "type": "advisory", "advisoryId": "GHSA-6qxp-vccf-f47h", "cveId": "CVE-2026-104850", "title": "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server", "summary": "High severity advisory GHSA-6qxp-vccf-f47h (CVE-2026-104850) affecting @modelcontextprotocol/sdk, @modelcontextprotocol/client. Patched in @modelcontextprotocol/sdk 1.31.0.", "severity": "high", "cvssScore": 7.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "epssPercentile": 0.13121, "cwes": [ "CWE-345", "CWE-522" ], "affected": [ { "ecosystem": "npm", "name": "@modelcontextprotocol/sdk", "vulnerableVersionRange": ">= 1.12.0, < 1.31.0", "firstPatchedVersion": "1.31.0" }, { "ecosystem": "npm", "name": "@modelcontextprotocol/client", "vulnerableVersionRange": ">= 2.0.0, < 2.2.0", "firstPatchedVersion": "2.2.0" } ], "matchedTerms": [ "@modelcontextprotocol/sdk", "mcp server", "MCP" ], "disclosedAt": "2026-10-06", "sourceUpdatedAt": "2026-10-06T15:35:44Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-6qxp-vccf-f47h", "references": [ "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h", "https://github.com/modelcontextprotocol/typescript-sdk/pull/2887", "https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd", "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0", "https://github.com/advisories/GHSA-6qxp-vccf-f47h" ], "evidence": "### Summary In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server. With no user interaction, the client would send it: - the refresh_token and client_secret stored from an earlier sign-in", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-8qpj-27x8-pwpq", "type": "advisory", "advisoryId": "GHSA-8qpj-27x8-pwpq", "cveId": "CVE-2026-10561", "title": "Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation", "summary": "Critical severity advisory GHSA-8qpj-27x8-pwpq (CVE-2026-10561) affecting langflow. Patched in langflow 1.10.1.", "severity": "critical", "cvssScore": 9.9, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "epssPercentile": 0.56534, "cwes": [ "CWE-94", "CWE-95", "CWE-266" ], "affected": [ { "ecosystem": "pip", "name": "langflow", "vulnerableVersionRange": "< 1.10.1", "firstPatchedVersion": "1.10.1" } ], "matchedTerms": [ "langflow" ], "disclosedAt": "2026-10-06", "sourceUpdatedAt": "2026-10-08T13:39:07Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-8qpj-27x8-pwpq", "references": [ "https://github.com/langflow-ai/langflow/security/advisories/GHSA-8qpj-27x8-pwpq", "https://nvd.nist.gov/vuln/detail/CVE-2026-10561", "https://github.com/langflow-ai/langflow/pull/13700", "https://github.com/langflow-ai/langflow/commit/2754c84aad1306f463db1c3bbb3e8ffbe85da77d", "https://github.com/langflow-ai/langflow/releases/tag/v1.10.1", "https://www.ibm.com/support/pages/node/7277242", "https://github.com/advisories/GHSA-8qpj-27x8-pwpq" ], "evidence": "### Summary Langflow's built-in Python interpreter components — PythonREPLComponent (Python Interpreter) and the legacy PythonREPLToolComponent (Python REPL Tool) — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the code ran in-process with the privileges of the Langflow service, any authenticated user who could edit and run a flow could achieve remote code e", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-935w-9g4m-p28p", "type": "advisory", "advisoryId": "GHSA-935w-9g4m-p28p", "cveId": "CVE-2026-105752", "title": "vLLM: Harmony tool continuations drop cache_salt — restoring a cross-tenant prefix-cache membership oracle", "summary": "Low severity advisory GHSA-935w-9g4m-p28p (CVE-2026-105752) affecting vllm. Patched in vllm 0.30.0.", "severity": "low", "cvssScore": 3.1, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "epssPercentile": 0.11502, "cwes": [ "CWE-200", "CWE-524" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": "< 0.30.0", "firstPatchedVersion": "0.30.0" } ], "matchedTerms": [ "vllm", "MCP" ], "disclosedAt": "2026-10-06", "sourceUpdatedAt": "2026-10-06T00:02:03Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-935w-9g4m-p28p", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-935w-9g4m-p28p", "https://github.com/vllm-project/vllm/pull/50195", "https://github.com/vllm-project/vllm/pull/51818", "https://github.com/vllm-project/vllm/commit/6a2a2bb02b563b83f946012959fd3927984d072a", "https://github.com/vllm-project/vllm/releases/tag/v0.30.0", "https://github.com/advisories/GHSA-935w-9g4m-p28p" ], "evidence": "## Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit 752a3a504485). The lower bound predates 0.25.1; maintainers can confirm how far back the tool-continuation re-submission has omitted the salt. ## Summary On the GPT-OSS \"Harmony\" path (POST /v1/responses), a request that uses a built-in or MCP tool runs as a multi-turn loop: after each tool call vLLM re-rende", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-j8f7-x8jm-wmm4", "type": "advisory", "advisoryId": "GHSA-j8f7-x8jm-wmm4", "cveId": null, "title": "Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)", "summary": "Medium severity advisory GHSA-j8f7-x8jm-wmm4 affecting langflow, langflow-base, lfx, lfx-docling. Patched in langflow 1.10.3.", "severity": "medium", "cvssScore": 6.3, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N", "epssPercentile": null, "cwes": [ "CWE-918" ], "affected": [ { "ecosystem": "pip", "name": "langflow", "vulnerableVersionRange": "< 1.10.3", "firstPatchedVersion": "1.10.3" }, { "ecosystem": "pip", "name": "langflow-base", "vulnerableVersionRange": "< 0.10.3", "firstPatchedVersion": "0.10.3" }, { "ecosystem": "pip", "name": "lfx", "vulnerableVersionRange": "< 1.10.3", "firstPatchedVersion": "1.10.3" }, { "ecosystem": "pip", "name": "lfx-docling", "vulnerableVersionRange": "< 0.1.2", "firstPatchedVersion": "0.1.2" } ], "matchedTerms": [ "langflow" ], "disclosedAt": "2026-10-06", "sourceUpdatedAt": "2026-10-06T13:39:59Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-j8f7-x8jm-wmm4", "references": [ "https://github.com/langflow-ai/langflow/security/advisories/GHSA-j8f7-x8jm-wmm4", "https://github.com/langflow-ai/langflow/pull/13016", "https://github.com/langflow-ai/langflow/pull/13395", "https://github.com/langflow-ai/langflow/pull/13643", "https://github.com/langflow-ai/langflow/pull/14033", "https://github.com/langflow-ai/langflow/pull/14071", "https://github.com/langflow-ai/langflow/commit/94859df33acd70b2a1f816e26d68f5e89a7e5639", "https://github.com/langflow-ai/langflow/releases/tag/v1.10.3" ], "evidence": "### Summary Before Langflow 1.10.3, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses and cloud metadata endpoints (for example http://169.254.169.254/latest/meta-data/), and in many cases read the respons", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-ph3r-5jfg-f84f", "type": "advisory", "advisoryId": "GHSA-ph3r-5jfg-f84f", "cveId": "CVE-2026-105753", "title": "vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core", "summary": "Medium severity advisory GHSA-ph3r-5jfg-f84f (CVE-2026-105753) affecting vllm. Patched in vllm 0.28.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.36708, "cwes": [ "CWE-617" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": "< 0.28.0", "firstPatchedVersion": "0.28.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-10-06", "sourceUpdatedAt": "2026-10-06T00:02:07Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-ph3r-5jfg-f84f", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-ph3r-5jfg-f84f", "https://github.com/vllm-project/vllm/pull/46747", "https://github.com/vllm-project/vllm/pull/51897", "https://github.com/vllm-project/vllm/commit/396204230423b7cc6798300926b8fa30190d26a9", "https://github.com/vllm-project/vllm/releases/tag/v0.28.0", "https://github.com/advisories/GHSA-ph3r-5jfg-f84f" ], "evidence": "## Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit 752a3a504485). The lower bound predates 0.25.1; maintainers can confirm how far back the mirrored sender/receiver cache protocol reaches. ## Summary vLLM's default multimodal cache (mm_processor_cache_type=\"lru\") mirrors state across two processes: the frontend (P0) holds only metadata (MultiModalProcessorSen", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:95ab3cee", "type": "incident", "advisoryId": "CVE-2026-105812", "cveId": "CVE-2026-105812", "title": "CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF", "summary": "AWS security bulletins reported a security matter involving Bedrock AgentCore on 2026-10-06 (SSRF, security bulletin). Tracks CVE-2026-105812, CVE-2026-106032.", "affected": [ { "ecosystem": "product", "name": "Bedrock AgentCore", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Bedrock AgentCore" ], "signals": [ "SSRF", "security bulletin" ], "disclosedAt": "2026-10-06", "sourceUpdatedAt": "2026-10-06T20:41:24.000Z", "sourceId": "aws-security-bulletins", "sourceUrl": "https://aws.amazon.com/security/security-bulletins/rss/2026-127-aws", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-105812", "https://nvd.nist.gov/vuln/detail/CVE-2026-106032" ], "evidence": "Read this article Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-11-02T21:57:51.579Z", "revision": 2, "baseline": true }, { "id": "ghsa:GHSA-2823-qmq8-rwvj", "type": "advisory", "advisoryId": "GHSA-2823-qmq8-rwvj", "cveId": "CVE-2026-105756", "title": "vLLM: Loose cache_salt validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream ValueError denial of service", "summary": "Medium severity advisory GHSA-2823-qmq8-rwvj (CVE-2026-105756) affecting vllm. Patched in vllm 0.30.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.2612, "cwes": [ "CWE-20", "CWE-248" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": "< 0.30.0", "firstPatchedVersion": "0.30.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-10-05", "sourceUpdatedAt": "2026-10-05T23:42:35Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-2823-qmq8-rwvj", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-2823-qmq8-rwvj", "https://github.com/vllm-project/vllm/pull/51444", "https://github.com/vllm-project/vllm/commit/e962733e08d10f7ca65dac4df99e116460b8b174", "https://github.com/vllm-project/vllm/releases/tag/v0.30.0", "https://github.com/advisories/GHSA-2823-qmq8-rwvj" ], "evidence": "## Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit 752a3a504485). The lower bound predates 0.25.1; maintainers can confirm how far back the loose cache_salt validator and unguarded scheduling-path lookup reach. ## Summary vLLM's OpenAI-compatible request models (Completions, Chat Completions, Responses) accept a client-supplied cache_salt field and validate i", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-2phq-3phc-84px", "type": "advisory", "advisoryId": "GHSA-2phq-3phc-84px", "cveId": "CVE-2026-105755", "title": "vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on /score a", "summary": "Medium severity advisory GHSA-2phq-3phc-84px (CVE-2026-105755) affecting vllm. Patched in vllm 0.30.0.", "severity": "medium", "cvssScore": 4.2, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "epssPercentile": 0.09583, "cwes": [ "CWE-639" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": "< 0.30.0", "firstPatchedVersion": "0.30.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-10-05", "sourceUpdatedAt": "2026-10-05T23:42:40Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-2phq-3phc-84px", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-2phq-3phc-84px", "https://github.com/vllm-project/vllm/pull/51445", "https://github.com/vllm-project/vllm/commit/ee17d0d869203ef9a35ad73358a4987bba14b1fc", "https://github.com/vllm-project/vllm/releases/tag/v0.30.0", "https://github.com/advisories/GHSA-2phq-3phc-84px" ], "evidence": "## Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit 752a3a504485). The lower bound predates 0.25.1; maintainers can confirm how far back the flash late-interaction query cache reaches. ## Summary On late-interaction /score and /rerank deployments with flash late interaction enabled (the default for supported models), the worker caches per-request query embeddi", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-58v5-2m8f-94pr", "type": "advisory", "advisoryId": "GHSA-58v5-2m8f-94pr", "cveId": "CVE-2026-105760", "title": "vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion", "summary": "Medium severity advisory GHSA-58v5-2m8f-94pr (CVE-2026-105760) affecting vllm. Patched in vllm 0.30.0.", "severity": "medium", "cvssScore": 5.3, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "epssPercentile": 0.22139, "cwes": [ "CWE-400" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": ">= 0.23.0rc2, < 0.30.0", "firstPatchedVersion": "0.30.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-10-05", "sourceUpdatedAt": "2026-10-05T23:42:55Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-58v5-2m8f-94pr", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-58v5-2m8f-94pr", "https://github.com/vllm-project/vllm/pull/54935", "https://github.com/vllm-project/vllm/commit/8b6de0eb9a09ef53f20cf06bd4d17ee264b9c2a7", "https://github.com/vllm-project/vllm/releases/tag/v0.30.0", "https://github.com/advisories/GHSA-58v5-2m8f-94pr" ], "evidence": "## Summary The OpenAI-compatible chat endpoint accepts request-level video loader options through media_io_kwargs. A caller can select the GLMGA sampler and provide large fps and max_frames values. GLMGA first constructs an attacker-sized Python index list and then deduplicates it, even when the supplied video contains only a few frames. This work occurs in the shared media-loading executor before frame reads, allowi", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-85xf-c7hm-whqw", "type": "advisory", "advisoryId": "GHSA-85xf-c7hm-whqw", "cveId": "CVE-2026-105757", "title": "vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)", "summary": "Medium severity advisory GHSA-85xf-c7hm-whqw (CVE-2026-105757) affecting vllm. Patched in vllm 0.30.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.24049, "cwes": [ "CWE-20", "CWE-248", "CWE-755" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": "< 0.30.0", "firstPatchedVersion": "0.30.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-10-05", "sourceUpdatedAt": "2026-10-05T23:42:45Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-85xf-c7hm-whqw", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-85xf-c7hm-whqw", "https://github.com/vllm-project/vllm/pull/51450", "https://github.com/vllm-project/vllm/commit/c55e15a44ec4127832d4a86928a356fdd9e68dbd", "https://github.com/vllm-project/vllm/releases/tag/v0.30.0", "https://github.com/advisories/GHSA-85xf-c7hm-whqw" ], "evidence": "## Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit 752a3a504485). The lower bound predates 0.25.1; maintainers can confirm how far back each path reaches. ## Summary Three structured-output request paths let an ordinary request reach a condition that raises an uncaught, engine-fatal exception instead of a per-request validation error. The failure is not confi", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-9fpm-3445-2vx4", "type": "advisory", "advisoryId": "GHSA-9fpm-3445-2vx4", "cveId": "CVE-2026-7700", "title": "Langflow: Prompt injection in Langflow Smart Transform can lead to code execution", "summary": "High severity advisory GHSA-9fpm-3445-2vx4 (CVE-2026-7700) affecting langflow. Patched in langflow 1.10.3.", "severity": "high", "cvssScore": 8.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "epssPercentile": 0.24083, "cwes": [ "CWE-94" ], "affected": [ { "ecosystem": "pip", "name": "langflow", "vulnerableVersionRange": ">= 1.3.0, < 1.10.3", "firstPatchedVersion": "1.10.3" } ], "matchedTerms": [ "langflow", "prompt injection", "LLM" ], "disclosedAt": "2026-10-05", "sourceUpdatedAt": "2026-10-05T22:30:42Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-9fpm-3445-2vx4", "references": [ "https://github.com/langflow-ai/langflow/security/advisories/GHSA-9fpm-3445-2vx4", "https://nvd.nist.gov/vuln/detail/CVE-2026-7700", "https://github.com/langflow-ai/langflow/pull/13530", "https://github.com/langflow-ai/langflow/commit/1641b28f33e2c47b9a0c6855922d44d1b8418b9d", "https://github.com/langflow-ai/langflow/commit/94859df33acd70b2a1f816e26d68f5e89a7e5639", "https://github.com/langflow-ai/langflow/releases/tag/v1.10.3", "https://vuldb.com/submit/804305", "https://vuldb.com/vuln/360869" ], "evidence": "## Summary Langflow versions 1.3.0 through 1.10.2 contain a code-injection vulnerability in the Smart Transform (LambdaFilterComponent) component. Smart Transform places flow-author instructions and a preview of its input data into a prompt asking an LLM to generate a Python lambda. It then extracts a one-line lambda from the model response, applies only syntactic format checks, evaluates it with Python's full builti", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-cf6m-vc3m-7cgm", "type": "advisory", "advisoryId": "GHSA-cf6m-vc3m-7cgm", "cveId": "CVE-2026-8505", "title": "Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass", "summary": "Critical severity advisory GHSA-cf6m-vc3m-7cgm (CVE-2026-8505) affecting langflow. Patched in langflow 1.9.1.", "severity": "critical", "cvssScore": 9.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "epssPercentile": 0.58788, "cwes": [ "CWE-306" ], "affected": [ { "ecosystem": "pip", "name": "langflow", "vulnerableVersionRange": ">= 1.7.0, <= 1.9.0", "firstPatchedVersion": "1.9.1" } ], "matchedTerms": [ "langflow" ], "disclosedAt": "2026-10-05", "sourceUpdatedAt": "2026-10-05T22:31:23Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-cf6m-vc3m-7cgm", "references": [ "https://github.com/langflow-ai/langflow/security/advisories/GHSA-cf6m-vc3m-7cgm", "https://nvd.nist.gov/vuln/detail/CVE-2026-8505", "https://github.com/langflow-ai/langflow/pull/12845", "https://github.com/langflow-ai/langflow/commit/cb6f7508dda83ead9c3e4417e96e4b5bd9a260c3", "https://github.com/langflow-ai/langflow/releases/tag/v1.9.1", "https://www.ibm.com/support/pages/node/7278921", "https://github.com/advisories/GHSA-cf6m-vc3m-7cgm" ], "evidence": "### Summary A vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False. This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner, potentially leading to Remote Code Execution (RCE) or Denial of Service (DoS", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-jxw3-mjmx-3pqm", "type": "advisory", "advisoryId": "GHSA-jxw3-mjmx-3pqm", "cveId": "CVE-2026-9205", "title": "Langflow: Weak Fernet Key via random.seed()", "summary": "Critical severity advisory GHSA-jxw3-mjmx-3pqm (CVE-2026-9205) affecting langflow. Patched in langflow 1.10.1.", "severity": "critical", "cvssScore": 9.1, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "epssPercentile": 0.22663, "cwes": [ "CWE-228" ], "affected": [ { "ecosystem": "pip", "name": "langflow", "vulnerableVersionRange": "<= 1.10.0", "firstPatchedVersion": "1.10.1" } ], "matchedTerms": [ "langflow", "LLM", "MCP" ], "disclosedAt": "2026-10-05", "sourceUpdatedAt": "2026-10-05T22:31:37Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-jxw3-mjmx-3pqm", "references": [ "https://github.com/langflow-ai/langflow/security/advisories/GHSA-jxw3-mjmx-3pqm", "https://nvd.nist.gov/vuln/detail/CVE-2026-9205", "https://github.com/langflow-ai/langflow/pull/13704", "https://github.com/langflow-ai/langflow/commit/094694d3f20c1da499f4d8dbac15c510609e3026", "https://www.ibm.com/support/pages/node/7282648", "https://github.com/advisories/GHSA-jxw3-mjmx-3pqm" ], "evidence": "### Summary Langflow uses Python's random module (Mersenne Twister, a non-cryptographic PRNG) seeded with the SECRET_KEY to derive the Fernet encryption key for all stored user credentials (API keys, LLM provider secrets, database passwords). When the SECRET_KEY is shorter than 32 characters — a common scenario for self-hosted deployments using simple/memorable secrets — the derived encryption key is fully determinis", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-ph72-cqr5-qpp7", "type": "advisory", "advisoryId": "GHSA-ph72-cqr5-qpp7", "cveId": "CVE-2026-105754", "title": "vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features", "summary": "Medium severity advisory GHSA-ph72-cqr5-qpp7 (CVE-2026-105754) affecting vllm. Patched in vllm 0.30.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.18888, "cwes": [ "CWE-20", "CWE-617", "CWE-639", "CWE-668", "CWE-704", "CWE-1284" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": "< 0.30.0", "firstPatchedVersion": "0.30.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-10-05", "sourceUpdatedAt": "2026-10-05T23:42:50Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-ph72-cqr5-qpp7", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-ph72-cqr5-qpp7", "https://github.com/vllm-project/vllm/pull/51898", "https://github.com/vllm-project/vllm/commit/1970f3ed4be7fa8620e4ddc4a12c36a8384cfc27", "https://github.com/vllm-project/vllm/releases/tag/v0.30.0", "https://github.com/advisories/GHSA-ph72-cqr5-qpp7" ], "evidence": "## Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit 752a3a504485). The lower bound predates 0.25.1; maintainers can confirm how far back the scale-out transport path reaches. ## Summary vLLM's disaggregated scale-out transport splits a multimodal request into a trusted render step (POST /v1/chat/completions/render) and a separate generate step (POST /inference", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-w584-2h2r-2hvf", "type": "advisory", "advisoryId": "GHSA-w584-2h2r-2hvf", "cveId": "CVE-2026-51886", "title": "Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description", "summary": "High severity advisory GHSA-w584-2h2r-2hvf (CVE-2026-51886) affecting langflow. Patched in langflow 1.10.1.", "severity": "high", "cvssScore": 8.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "epssPercentile": 0.48506, "cwes": [ "CWE-94" ], "affected": [ { "ecosystem": "pip", "name": "langflow", "vulnerableVersionRange": ">= 1.7.2, < 1.10.1", "firstPatchedVersion": "1.10.1" } ], "matchedTerms": [ "langflow" ], "disclosedAt": "2026-10-05", "sourceUpdatedAt": "2026-10-05T22:31:01Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-w584-2h2r-2hvf", "references": [ "https://github.com/langflow-ai/langflow/security/advisories/GHSA-w584-2h2r-2hvf", "https://nvd.nist.gov/vuln/detail/CVE-2026-51886", "https://github.com/langflow-ai/langflow/issues/13336", "https://github.com/langflow-ai/langflow/pull/13696", "https://github.com/langflow-ai/langflow/commit/e7c33dbaade20b5295c7fa26bf83cc1ff68fba02", "https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a", "https://github.com/langflow-ai/langflow/releases/tag/v1.10.1", "https://github.com/advisories/GHSA-w584-2h2r-2hvf" ], "evidence": "###Summary: A critical Authenticated Remote Code Execution (RCE) vulnerability exists in the validate_code function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec() function. While it attempts to restrict execution to function definitions, it fails to account for decorators, which are evaluated at definition time. This allows any authenticated user to ex", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-x6mc-67gf-chw4", "type": "advisory", "advisoryId": "GHSA-x6mc-67gf-chw4", "cveId": "CVE-2026-105758", "title": "vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach", "summary": "Medium severity advisory GHSA-x6mc-67gf-chw4 (CVE-2026-105758) affecting vllm. Patched in vllm 0.30.0.", "severity": "medium", "cvssScore": 5.3, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "epssPercentile": 0.22839, "cwes": [ "CWE-770" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": ">= 0.24.0, < 0.30.0", "firstPatchedVersion": "0.30.0" } ], "matchedTerms": [ "vllm", "AI" ], "disclosedAt": "2026-10-05", "sourceUpdatedAt": "2026-10-05T23:43:00Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-x6mc-67gf-chw4", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-x6mc-67gf-chw4", "https://github.com/vllm-project/vllm/pull/56729", "https://github.com/vllm-project/vllm/commit/ea723c81c3ea26425cb69503a5d5e90822a04a45", "https://github.com/vllm-project/vllm/releases/tag/v0.30.0", "https://github.com/advisories/GHSA-x6mc-67gf-chw4" ], "evidence": "### Summary An unauthenticated remote attacker can exhaust the memory of the vLLM API-server process by raising the request-level media_io_kwargs.video.max_frames and fps knobs on any deployment serving a Qwen2-VL or Qwen3-VL model. 74 extra bytes of JSON took the server's peak RSS from 2 271 MiB to 13 629 MiB over unauthenticated POST /tokenize. The num_frames ceiling reported in GHSA-vxqj-p4gw-9h4c and fixed by ope", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:CVE-2026-104019", "type": "incident", "advisoryId": "CVE-2026-104019", "cveId": "CVE-2026-104019", "title": "CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution", "summary": "AWS security bulletins reported a security matter involving SageMaker on 2026-10-02 (command injection, security bulletin). Tracks CVE-2026-104019.", "affected": [ { "ecosystem": "product", "name": "SageMaker", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "SageMaker", "AI" ], "signals": [ "command injection", "security bulletin" ], "disclosedAt": "2026-10-02", "sourceUpdatedAt": "2026-10-02T20:25:48.000Z", "sourceId": "aws-security-bulletins", "sourceUrl": "https://aws.amazon.com/security/security-bulletins/rss/2026-125-aws", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-104019" ], "evidence": "Bulletin ID: 2026-125-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/02/2026 13:00 PM PDT Description: Amazon SageMaker Unified Studio is an AWS service that unifies data, analytics, and AI development. It lets you find and access your organization's data and act on it with integrated, purpose-built tools. We identified CVE-2026-104019, an issue with the startup of SageMaker Spaces i", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-3325-v43h-43rv", "type": "advisory", "advisoryId": "GHSA-3325-v43h-43rv", "cveId": "CVE-2026-102904", "title": "JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs", "summary": "Medium severity advisory GHSA-3325-v43h-43rv (CVE-2026-102904) affecting jupyterlab. Patched in jupyterlab 4.6.4.", "severity": "medium", "cvssScore": 5.4, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "epssPercentile": 0.10552, "cwes": [ "CWE-88", "CWE-209", "CWE-918" ], "affected": [ { "ecosystem": "pip", "name": "jupyterlab", "vulnerableVersionRange": ">= 4.6.0, <= 4.6.3", "firstPatchedVersion": "4.6.4" }, { "ecosystem": "pip", "name": "jupyterlab", "vulnerableVersionRange": ">= 4.0.0, <= 4.5.10", "firstPatchedVersion": "4.5.11" } ], "matchedTerms": [ "jupyterlab" ], "disclosedAt": "2026-10-01", "sourceUpdatedAt": "2026-10-01T15:21:18Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-3325-v43h-43rv", "references": [ "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-3325-v43h-43rv", "https://nvd.nist.gov/vuln/detail/CVE-2026-102904", "https://github.com/jupyterlab/jupyterlab/commit/9e1951e57da499ca66ef5e0caf68e71ad2e3d1a5", "https://github.com/jupyterlab/jupyterlab/commit/a274a8276b9185d03efd4c3c20713d3137ac49e6", "https://github.com/jupyterlab/jupyterlab/commit/e277bc958e737130ac47b6c5078d08b29298828f", "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11", "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4", "https://github.com/advisories/GHSA-3325-v43h-43rv" ], "evidence": "JupyterLab's PyPI extension manager runs python -m pip uninstall with the extension name taken from the request body. ExtensionHandler.post validates the name for cmd=install but not for cmd=uninstall, so a name that begins with - reaches the command line and pip reads it as an option rather than as a package. python cmdline = [ sys.executable, \"-m\", \"pip\", \"uninstall\", \"--yes\", \"--no-input\", extension, ] An extensio", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-3jqq-pw4j-pqcj", "type": "advisory", "advisoryId": "GHSA-3jqq-pw4j-pqcj", "cveId": "CVE-2026-102830", "title": "JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)", "summary": "Medium severity advisory GHSA-3jqq-pw4j-pqcj (CVE-2026-102830) affecting jupyterlab, jupyterlite-core. Patched in jupyterlab 4.6.4.", "severity": "medium", "cvssScore": 6.8, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "epssPercentile": 0.17623, "cwes": [ "CWE-79", "CWE-94", "CWE-625" ], "affected": [ { "ecosystem": "pip", "name": "jupyterlab", "vulnerableVersionRange": ">= 4.6.0, <= 4.6.3", "firstPatchedVersion": "4.6.4" }, { "ecosystem": "pip", "name": "jupyterlab", "vulnerableVersionRange": ">= 3.0.0, <= 4.5.10", "firstPatchedVersion": "4.5.11" }, { "ecosystem": "pip", "name": "jupyterlite-core", "vulnerableVersionRange": "<= 0.8.3", "firstPatchedVersion": "0.8.4" } ], "matchedTerms": [ "jupyterlab", "jupyter" ], "disclosedAt": "2026-10-01", "sourceUpdatedAt": "2026-10-01T15:22:18Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-3jqq-pw4j-pqcj", "references": [ "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-3jqq-pw4j-pqcj", "https://nvd.nist.gov/vuln/detail/CVE-2026-102830", "https://github.com/jupyterlab/jupyterlab/commit/985a3223cd77fd4f991cd90066342a90711d70f6", "https://github.com/jupyterlab/jupyterlab/commit/de324ae91346c713c4f5e5485f97b6e914e0f774", "https://github.com/jupyterlab/jupyterlab/commit/f9de43dc565a1118120d466117f877a189a4ce90", "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11", "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4", "https://github.com/advisories/GHSA-3jqq-pw4j-pqcj" ], "evidence": "## Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=(n != 1);. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was anchored at the start but not at the end, so it accepted any string that began with a valid plural rule and ignored e", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-6966-vjj6-99xv", "type": "advisory", "advisoryId": "GHSA-6966-vjj6-99xv", "cveId": "CVE-2026-102831", "title": "JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard", "summary": "High severity advisory GHSA-6966-vjj6-99xv (CVE-2026-102831) affecting jupyterlab, notebook, jupyterlite, jupyterlite-core. Patched in jupyterlab 4.6.4.", "severity": "high", "cvssScore": 8.1, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "epssPercentile": 0.14657, "cwes": [ "CWE-79", "CWE-345" ], "affected": [ { "ecosystem": "pip", "name": "jupyterlab", "vulnerableVersionRange": ">= 4.6.0, <= 4.6.3", "firstPatchedVersion": "4.6.4" }, { "ecosystem": "pip", "name": "jupyterlab", "vulnerableVersionRange": ">= 4.5.0, <= 4.5.10", "firstPatchedVersion": "4.5.11" }, { "ecosystem": "pip", "name": "notebook", "vulnerableVersionRange": ">= 7.5.0, <= 7.6.2", "firstPatchedVersion": "7.6.3" }, { "ecosystem": "pip", "name": "jupyterlite", "vulnerableVersionRange": ">= 0.7.0, <= 0.8.3", "firstPatchedVersion": "0.8.4" }, { "ecosystem": "pip", "name": "jupyterlite-core", "vulnerableVersionRange": ">= 0.7.0, <= 0.8.3", "firstPatchedVersion": "0.8.4" } ], "matchedTerms": [ "jupyterlab", "notebook", "jupyter" ], "disclosedAt": "2026-10-01", "sourceUpdatedAt": "2026-10-01T15:20:42Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-6966-vjj6-99xv", "references": [ "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-6966-vjj6-99xv", "https://nvd.nist.gov/vuln/detail/CVE-2026-102831", "https://github.com/jupyterlab/jupyterlab/commit/1a10a7da5ff655849b21581c2633b46483ae0be9", "https://github.com/jupyterlab/jupyterlab/commit/7f9f29e29e0c83fb17b0f11da57d06b3c6a40d96", "https://github.com/jupyterlab/jupyterlab/commit/cf6e89a8d315c4134cefa50c220bca296da466a7", "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11", "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4", "https://github.com/advisories/GHSA-6966-vjj6-99xv" ], "evidence": "## Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output and evaluates the \" } } ] } ] Users are affected if all of the following are true: - they run JupyterLab 4.5.0 through 4", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-3cv6-jpf6-8222", "type": "advisory", "advisoryId": "GHSA-3cv6-jpf6-8222", "cveId": "CVE-2026-84377", "title": "LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters", "summary": "Medium severity advisory GHSA-3cv6-jpf6-8222 (CVE-2026-84377) affecting litellm. Patched in litellm 1.88.6.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "epssPercentile": 0.44557, "cwes": [ "CWE-918" ], "affected": [ { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": "< 1.88.6", "firstPatchedVersion": "1.88.6" }, { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": ">= 1.89.0, < 1.89.7", "firstPatchedVersion": "1.89.7" }, { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": ">= 1.90.0, < 1.90.7", "firstPatchedVersion": "1.90.7" }, { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": ">= 1.91.0, < 1.91.5", "firstPatchedVersion": "1.91.5" }, { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": ">= 1.92.0, < 1.92.2", "firstPatchedVersion": "1.92.2" }, { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": ">= 1.93.0, < 1.93.2", "firstPatchedVersion": "1.93.2" }, { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": ">= 1.94.0, < 1.94.3", "firstPatchedVersion": "1.94.3" }, { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": ">= 1.95.0, < 1.95.1", "firstPatchedVersion": "1.95.1" }, { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": ">= 1.96.0, < 1.96.2", "firstPatchedVersion": "1.96.2" } ], "matchedTerms": [ "litellm" ], "disclosedAt": "2026-09-30", "sourceUpdatedAt": "2026-09-30T21:11:28Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-3cv6-jpf6-8222", "references": [ "https://github.com/BerriAI/litellm/security/advisories/GHSA-3cv6-jpf6-8222", "https://nvd.nist.gov/vuln/detail/CVE-2026-84377", "https://github.com/BerriAI/litellm/pull/36011", "https://github.com/BerriAI/litellm/pull/36314", "https://github.com/BerriAI/litellm/pull/36494", "https://github.com/BerriAI/litellm/commit/473f72e63a9777d793fbbf57194d8ec4fb97bc1b", "https://github.com/BerriAI/litellm/commit/820f247a6abba55cd87d130bef7bba7be3b29d37", "https://github.com/BerriAI/litellm/commit/c898d341c02299cf2506d0d8e84cc67953043593" ], "evidence": "### Impact Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. The proxy's request-body validation was a denylist that did not cover every sensitive parameter and did not inspect parameters nested inside other request fields, so a caller could supply a routing or credential ", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:CVE-2026-65669", "type": "incident", "advisoryId": "CVE-2026-65669", "cveId": "CVE-2026-65669", "title": "From SELECT to SYSADMIN with SQL Copilot (CVE-2026-65669)", "summary": "Embrace The Red reported a security matter involving Copilot on 2026-09-30 (vulnerability). Tracks CVE-2026-65669.", "affected": [ { "ecosystem": "product", "name": "Copilot", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Copilot" ], "signals": [ "vulnerability" ], "disclosedAt": "2026-09-30", "sourceUpdatedAt": "2026-09-30T21:00:40.000Z", "sourceId": "embrace-the-red", "sourceUrl": "https://embracethered.com/blog/posts/2026/from-select-to-sysadmin-sql-copilot-bluehat-asia", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-65669" ], "evidence": "Two weeks back I presented at BlueHat Asia 2026 about my research on Microsoft’s Copilot in SSMS, the SQL Server Management Studio. This post is a write up about the talk, which covered CVE-2026-65669 , a SQL Server Elevation of Privilege Vulnerability rated critical by Microsoft. So, make sure your installations are up-to-date. The slides of the presentation can be found here . BlueHat Asia 2026 in Singapore F", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-62mm-xwmv-crhg", "type": "advisory", "advisoryId": "GHSA-62mm-xwmv-crhg", "cveId": null, "title": "khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem", "summary": "High severity advisory GHSA-62mm-xwmv-crhg affecting khoj. Patched in khoj 2.0.0-beta.25.", "severity": "high", "cvssScore": 8.7, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "epssPercentile": null, "cwes": [ "CWE-22" ], "affected": [ { "ecosystem": "pip", "name": "khoj", "vulnerableVersionRange": ">= 2.0.0-beta.23, < 2.0.0-beta.25", "firstPatchedVersion": "2.0.0-beta.25" } ], "matchedTerms": [ "khoj" ], "disclosedAt": "2026-09-25", "sourceUpdatedAt": "2026-09-25T21:38:16Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-62mm-xwmv-crhg", "references": [ "https://github.com/khoj-ai/khoj/security/advisories/GHSA-62mm-xwmv-crhg", "https://github.com/khoj-ai/khoj/commit/21c51b9ace4eb59ce79ac0a93b917289824195cf", "https://github.com/khoj-ai/khoj/commit/9801ffd2de642772f072ca496032b7c352013b6a", "https://github.com/khoj-ai/khoj/releases/tag/2.0.0-beta.25", "https://github.com/advisories/GHSA-62mm-xwmv-crhg" ], "evidence": "### Summary The /home/{file_path:path} endpoint in web_client.py serves static files by directly concatenating the user-supplied file_path with the home_directory constant. There is no path traversal filtering, no path normalization check, and no authentication required. An attacker can use ../ sequences to read arbitrary files from the server filesystem. ### Details Vulnerable code — src/khoj/routers/web_client.py l", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-3cj3-hqcr-g934", "type": "advisory", "advisoryId": "GHSA-3cj3-hqcr-g934", "cveId": "CVE-2026-59723", "title": "Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (/browser endpoint)", "summary": "High severity advisory GHSA-3cj3-hqcr-g934 (CVE-2026-59723) affecting cline. Patched in cline 3.0.30.", "severity": "high", "cvssScore": 8.8, "cvssVector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "epssPercentile": 0.16024, "cwes": [ "CWE-346" ], "affected": [ { "ecosystem": "npm", "name": "cline", "vulnerableVersionRange": "< 3.0.30", "firstPatchedVersion": "3.0.30" } ], "matchedTerms": [ "cline", "mcp server", "MCP", "AI" ], "disclosedAt": "2026-09-24", "sourceUpdatedAt": "2026-09-24T19:48:35Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-3cj3-hqcr-g934", "references": [ "https://github.com/cline/cline/security/advisories/GHSA-3cj3-hqcr-g934", "https://nvd.nist.gov/vuln/detail/CVE-2026-59723", "https://github.com/cline/cline/pull/11724", "https://github.com/cline/cline/commit/d09270940f5746f288cfc4a5039b46a2f4d5d01e", "https://github.com/cline/cline/releases/tag/cli-v3.0.30", "https://github.com/advisories/GHSA-3cj3-hqcr-g934" ], "evidence": "### Summary The Cline Hub dashboard server (@cline/cline-hub), launched via the cline dashboard CLI command, accepts WebSocket connections on the /browser endpoint without validating the HTTP Origin header. When ROOM_SECRET is not set—the default for local (127.0.0.1) binds—isAuthorizedBrowserRequest() returns true unconditionally, allowing any website a developer visits to open a cross-origin WebSocket to ws://127.0", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-8pw2-6jv3-mj5j", "type": "advisory", "advisoryId": "GHSA-8pw2-6jv3-mj5j", "cveId": "CVE-2026-69147", "title": "vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation", "summary": "Medium severity advisory GHSA-8pw2-6jv3-mj5j (CVE-2026-69147) affecting vllm. Patched in vllm 0.28.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.47583, "cwes": [ "CWE-400", "CWE-770" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": "< 0.28.0", "firstPatchedVersion": "0.28.0" } ], "matchedTerms": [ "vllm", "gguf" ], "disclosedAt": "2026-09-17", "sourceUpdatedAt": "2026-09-17T17:17:41Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-8pw2-6jv3-mj5j", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j", "https://nvd.nist.gov/vuln/detail/CVE-2026-69147", "https://github.com/vllm-project/vllm/pull/47259", "https://github.com/vllm-project/vllm/commit/283893c72292ede38d277e3cd2b9b64c3e4f1dda", "https://github.com/vllm-project/vllm/commit/ba22152096b2484faa3579624a253d54804d876d", "https://github.com/vllm-project/vllm/releases/tag/v0.25.0", "https://github.com/advisories/GHSA-8pw2-6jv3-mj5j" ], "evidence": "## Summary Current vLLM main lets an inference request choose the PyNvVideoCodec GPU video decoder through media_io_kwargs.video.video_backend, but engine GPU memory reservation is computed only from static startup configuration and VLLM_VIDEO_LOADER_BACKEND. If the server starts with the default OpenCV/software backend and no --mm-ipc-gpu-memory-gb budget, a client can still route a video request into the PyNvVideoC", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-hx8v-g79f-8w5f", "type": "advisory", "advisoryId": "GHSA-hx8v-g79f-8w5f", "cveId": "CVE-2026-59823", "title": "LiteLLM Proxy has server-side request forgery via the user_config request parameter", "summary": "Medium severity advisory GHSA-hx8v-g79f-8w5f (CVE-2026-59823) affecting litellm. Patched in litellm 1.83.9.", "severity": "medium", "cvssScore": 5.3, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "epssPercentile": 0.37873, "cwes": [ "CWE-918" ], "affected": [ { "ecosystem": "pip", "name": "litellm", "vulnerableVersionRange": "<= 1.83.8", "firstPatchedVersion": "1.83.9" } ], "matchedTerms": [ "litellm" ], "disclosedAt": "2026-09-17", "sourceUpdatedAt": "2026-09-17T14:51:22Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-hx8v-g79f-8w5f", "references": [ "https://github.com/BerriAI/litellm/security/advisories/GHSA-hx8v-g79f-8w5f", "https://nvd.nist.gov/vuln/detail/CVE-2026-59823", "https://github.com/BerriAI/litellm/pull/25827", "https://github.com/BerriAI/litellm/commit/47214be317f45a2d2ac08258362e0481411eb427", "https://github.com/advisories/GHSA-hx8v-g79f-8w5f" ], "evidence": "### Summary A server-side request forgery in LiteLLM Proxy lets an authenticated caller redirect the proxy's outbound request to a host of their choosing by smuggling an api_base inside the user_config request body, bypassing the existing parameter guard. ### Details LiteLLM Proxy validates request bodies with is_request_body_safe, which blocks the api_base and base_url parameters but does not cover user_config. The ", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-hcwq-8wjf-3gcr", "type": "advisory", "advisoryId": "GHSA-hcwq-8wjf-3gcr", "cveId": "CVE-2026-57173", "title": "vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions", "summary": "Medium severity advisory GHSA-hcwq-8wjf-3gcr (CVE-2026-57173) affecting vllm. Patched in vllm 0.24.0.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.53698, "cwes": [ "CWE-770" ], "affected": [ { "ecosystem": "pip", "name": "vllm", "vulnerableVersionRange": "<= 0.23.0", "firstPatchedVersion": "0.24.0" } ], "matchedTerms": [ "vllm" ], "disclosedAt": "2026-09-16", "sourceUpdatedAt": "2026-09-16T22:12:18Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-hcwq-8wjf-3gcr", "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-hcwq-8wjf-3gcr", "https://nvd.nist.gov/vuln/detail/CVE-2026-57173", "https://github.com/vllm-project/vllm/pull/45908", "https://github.com/vllm-project/vllm/commit/3d20275bb4d434f53055c3c0b645fd8bb072965e", "https://github.com/vllm-project/vllm/releases/tag/v0.24.0", "https://github.com/advisories/GHSA-hcwq-8wjf-3gcr" ], "evidence": "### Summary The audio decode-duration guard (max_duration_s, env VLLM_MAX_AUDIO_DECODE_DURATION_S, default 600s) that protects against audio decompression-bomb DoS is wired into only the speech-to-text path (/v1/audio/transcriptions). The chat audio path (/v1/chat/completions, input_audio content parts) calls the same decoder with no limit, so an unauthenticated client can submit a few-KB compressed audio file that e", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-3g9q-v48f-hh9w", "type": "advisory", "advisoryId": "GHSA-3g9q-v48f-hh9w", "cveId": "CVE-2026-87011", "title": "Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout", "summary": "High severity advisory GHSA-3g9q-v48f-hh9w (CVE-2026-87011) affecting open-webui. Patched in open-webui 0.11.1.", "severity": "high", "cvssScore": 7.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "epssPercentile": 0.5057, "cwes": [ "CWE-405", "CWE-770" ], "affected": [ { "ecosystem": "pip", "name": "open-webui", "vulnerableVersionRange": ">= 0.9.0, <= 0.11.0", "firstPatchedVersion": "0.11.1" } ], "matchedTerms": [ "open-webui" ], "disclosedAt": "2026-09-10", "sourceUpdatedAt": "2026-09-10T22:45:10Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-3g9q-v48f-hh9w", "references": [ "https://github.com/open-webui/open-webui/security/advisories/GHSA-3g9q-v48f-hh9w", "https://nvd.nist.gov/vuln/detail/CVE-2026-87011", "https://github.com/open-webui/open-webui/commit/aeda6ff13a25d3b3ba1b303609f35382db22142c", "https://github.com/open-webui/open-webui/releases/tag/v0.11.1", "https://github.com/advisories/GHSA-3g9q-v48f-hh9w" ], "evidence": "## Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network, and repeated both fetches on every request because nothing was cached. The signing-key fetch also ran as a blocking ca", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-8r35-5x5r-hv74", "type": "advisory", "advisoryId": "GHSA-8r35-5x5r-hv74", "cveId": "CVE-2026-87013", "title": "Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle", "summary": "Medium severity advisory GHSA-8r35-5x5r-hv74 (CVE-2026-87013) affecting open-webui. Patched in open-webui 0.11.1.", "severity": "medium", "cvssScore": 4.3, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "epssPercentile": 0.41529, "cwes": [ "CWE-835" ], "affected": [ { "ecosystem": "pip", "name": "open-webui", "vulnerableVersionRange": ">= 0.10.0, <= 0.11.0", "firstPatchedVersion": "0.11.1" } ], "matchedTerms": [ "open-webui" ], "disclosedAt": "2026-09-10", "sourceUpdatedAt": "2026-09-10T22:42:26Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-8r35-5x5r-hv74", "references": [ "https://github.com/open-webui/open-webui/security/advisories/GHSA-8r35-5x5r-hv74", "https://nvd.nist.gov/vuln/detail/CVE-2026-87013", "https://github.com/open-webui/open-webui/pull/28748", "https://github.com/open-webui/open-webui/commit/23b3a69bc26839bfa74edd1be6bfa2568ae902f4", "https://github.com/open-webui/open-webui/releases/tag/v0.11.1", "https://github.com/advisories/GHSA-8r35-5x5r-hv74" ], "evidence": "## Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had already visited. A single request against a folder in a loop therefore never finishes. ## Preconditions Folders must be ", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-cqr2-h44g-v75v", "type": "advisory", "advisoryId": "GHSA-cqr2-h44g-v75v", "cveId": "CVE-2026-86085", "title": "n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints", "summary": "Medium severity advisory GHSA-cqr2-h44g-v75v (CVE-2026-86085) affecting n8n. Patched in n8n 2.38.2.", "severity": "medium", "cvssScore": 5.1, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "epssPercentile": 0.38552, "cwes": [ "CWE-862" ], "affected": [ { "ecosystem": "npm", "name": "n8n", "vulnerableVersionRange": ">= 2.38.0, < 2.38.2", "firstPatchedVersion": "2.38.2" }, { "ecosystem": "npm", "name": "n8n", "vulnerableVersionRange": "< 2.37.7", "firstPatchedVersion": "2.37.7" } ], "matchedTerms": [ "n8n" ], "disclosedAt": "2026-09-10", "sourceUpdatedAt": "2026-09-10T21:13:25Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-cqr2-h44g-v75v", "references": [ "https://github.com/n8n-io/n8n/security/advisories/GHSA-cqr2-h44g-v75v", "https://nvd.nist.gov/vuln/detail/CVE-2026-86085", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2", "https://github.com/advisories/GHSA-cqr2-h44g-v75v" ], "evidence": "## Impact The endpoints /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members checked only that the caller could manage the role type, not that they could see the project named in the request. A user holding role-management permission could therefore name any project on the instance and read back its members' names and email addresses. The patch adds a project-access check to both routes,", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-cw9w-vv67-hf73", "type": "advisory", "advisoryId": "GHSA-cw9w-vv67-hf73", "cveId": "CVE-2026-86073", "title": "n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution", "summary": "Medium severity advisory GHSA-cw9w-vv67-hf73 (CVE-2026-86073) affecting n8n. Patched in n8n 2.38.1.", "severity": "medium", "cvssScore": 5.9, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N", "epssPercentile": 0.328, "cwes": [ "CWE-863" ], "affected": [ { "ecosystem": "npm", "name": "n8n", "vulnerableVersionRange": ">= 2.38.0, < 2.38.1", "firstPatchedVersion": "2.38.1" }, { "ecosystem": "npm", "name": "n8n", "vulnerableVersionRange": "< 2.37.7", "firstPatchedVersion": "2.37.7" } ], "matchedTerms": [ "n8n", "MCP" ], "disclosedAt": "2026-09-10", "sourceUpdatedAt": "2026-09-10T21:21:49Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-cw9w-vv67-hf73", "references": [ "https://github.com/n8n-io/n8n/security/advisories/GHSA-cw9w-vv67-hf73", "https://nvd.nist.gov/vuln/detail/CVE-2026-86073", "https://github.com/n8n-io/n8n/pull/37122", "https://github.com/n8n-io/n8n/pull/37588", "https://github.com/n8n-io/n8n/commit/18458482861097a26f874f30ad7e8136e268475c", "https://github.com/n8n-io/n8n/commit/380788fd9a3264c83161e868026a98731d274d88", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.1" ], "evidence": "## Impact The OAuth token endpoint bound an authorization code's first access token to the consented resource, but not its refresh token. Refreshing only checked that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could refresh with a different workflow's URL and get a valid, unapproved token for it. The patch binds refresh tokens to the grante", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-p78m-89r6-pgf7", "type": "advisory", "advisoryId": "GHSA-p78m-89r6-pgf7", "cveId": "CVE-2026-87015", "title": "Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication", "summary": "Medium severity advisory GHSA-p78m-89r6-pgf7 (CVE-2026-87015) affecting open-webui. Patched in open-webui 0.11.1.", "severity": "medium", "cvssScore": 6.8, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "epssPercentile": 0.40949, "cwes": [ "CWE-201" ], "affected": [ { "ecosystem": "pip", "name": "open-webui", "vulnerableVersionRange": ">= 0.6.27, < 0.11.1", "firstPatchedVersion": "0.11.1" } ], "matchedTerms": [ "open-webui" ], "disclosedAt": "2026-09-10", "sourceUpdatedAt": "2026-09-10T21:23:45Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-p78m-89r6-pgf7", "references": [ "https://github.com/open-webui/open-webui/security/advisories/GHSA-p78m-89r6-pgf7", "https://nvd.nist.gov/vuln/detail/CVE-2026-87015", "https://github.com/open-webui/open-webui/pull/28630", "https://github.com/open-webui/open-webui/commit/cd9db21c5276807a2975ddba17cef369ad1114b7", "https://github.com/open-webui/open-webui/releases/tag/v0.11.1", "https://github.com/advisories/GHSA-p78m-89r6-pgf7" ], "evidence": "## Summary When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callable that performs the request reads it late instead of per connection, so every tool callable built in the same pass sends", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-pf83-w3f9-8m37", "type": "advisory", "advisoryId": "GHSA-pf83-w3f9-8m37", "cveId": "CVE-2026-86084", "title": "n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions", "summary": "Medium severity advisory GHSA-pf83-w3f9-8m37 (CVE-2026-86084) affecting n8n. Patched in n8n 1.123.76.", "severity": "medium", "cvssScore": 6, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "epssPercentile": 0.39678, "cwes": [ "CWE-288" ], "affected": [ { "ecosystem": "npm", "name": "n8n", "vulnerableVersionRange": "< 1.123.76", "firstPatchedVersion": "1.123.76" }, { "ecosystem": "npm", "name": "n8n", "vulnerableVersionRange": ">= 2.38.0, < 2.38.2", "firstPatchedVersion": "2.38.2" }, { "ecosystem": "npm", "name": "n8n", "vulnerableVersionRange": ">= 2.0.0, < 2.37.7", "firstPatchedVersion": "2.37.7" } ], "matchedTerms": [ "n8n" ], "disclosedAt": "2026-09-10", "sourceUpdatedAt": "2026-09-10T21:07:27Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-pf83-w3f9-8m37", "references": [ "https://github.com/n8n-io/n8n/security/advisories/GHSA-pf83-w3f9-8m37", "https://nvd.nist.gov/vuln/detail/CVE-2026-86084", "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2", "https://github.com/advisories/GHSA-pf83-w3f9-8m37" ], "evidence": "## Impact The public OIDC login and callback endpoints ran the full flow whether or not OIDC was the instance's active, enabled authentication method, so turning OIDC off in Settings did not stop it issuing sessions. An administrator who disabled the provider still had a working login route. The patch requires OIDC to be the enabled, active authentication method before either endpoint starts the flow or issues a sess", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-pq6c-vh67-xpm3", "type": "advisory", "advisoryId": "GHSA-pq6c-vh67-xpm3", "cveId": "CVE-2026-86993", "title": "n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check", "summary": "Medium severity advisory GHSA-pq6c-vh67-xpm3 (CVE-2026-86993) affecting n8n. Patched in n8n 1.123.76.", "severity": "medium", "cvssScore": 5.9, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N", "epssPercentile": 0.39541, "cwes": [ "CWE-862" ], "affected": [ { "ecosystem": "npm", "name": "n8n", "vulnerableVersionRange": "< 1.123.76", "firstPatchedVersion": "1.123.76" }, { "ecosystem": "npm", "name": "n8n", "vulnerableVersionRange": ">= 2.38.0, < 2.38.2", "firstPatchedVersion": "2.38.2" }, { "ecosystem": "npm", "name": "n8n", "vulnerableVersionRange": ">= 2.0.0, < 2.37.7", "firstPatchedVersion": "2.37.7" } ], "matchedTerms": [ "n8n" ], "disclosedAt": "2026-09-10", "sourceUpdatedAt": "2026-09-10T21:07:46Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-pq6c-vh67-xpm3", "references": [ "https://github.com/n8n-io/n8n/security/advisories/GHSA-pq6c-vh67-xpm3", "https://nvd.nist.gov/vuln/detail/CVE-2026-86993", "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2", "https://github.com/advisories/GHSA-pq6c-vh67-xpm3" ], "evidence": "## Impact A log streaming event destination may reference a generic HTTP credential, and the destination resolved and decrypted whichever credential it named without checking that the caller had access to it. A user holding a custom global role scoped to Log Streaming operations could therefore name a credential belonging to another project and have its decrypted secret sent to an endpoint they controlled. The patch ", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-q5wm-mgqx-fv2f", "type": "advisory", "advisoryId": "GHSA-q5wm-mgqx-fv2f", "cveId": "CVE-2026-86074", "title": "n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content", "summary": "Medium severity advisory GHSA-q5wm-mgqx-fv2f (CVE-2026-86074) affecting n8n. Patched in n8n 2.38.2.", "severity": "medium", "cvssScore": 5.9, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N", "epssPercentile": 0.31508, "cwes": [ "CWE-918" ], "affected": [ { "ecosystem": "npm", "name": "n8n", "vulnerableVersionRange": ">= 2.38.0, < 2.38.2", "firstPatchedVersion": "2.38.2" }, { "ecosystem": "npm", "name": "n8n", "vulnerableVersionRange": "< 2.37.7", "firstPatchedVersion": "2.37.7" } ], "matchedTerms": [ "n8n", "AI" ], "disclosedAt": "2026-09-10", "sourceUpdatedAt": "2026-09-10T21:18:48Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-q5wm-mgqx-fv2f", "references": [ "https://github.com/n8n-io/n8n/security/advisories/GHSA-q5wm-mgqx-fv2f", "https://nvd.nist.gov/vuln/detail/CVE-2026-86074", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2", "https://github.com/advisories/GHSA-q5wm-mgqx-fv2f" ], "evidence": "## Impact Instance AI credential setup accepted a credential test/verification URL without checking it matched the workflow node's origin. Exfiltration required the user to actively inject an attacker-controlled URL into the setup flow. The patch derives the credential destination from the node's own URL and confines authenticated requests, redirects and probes to that origin. ## Patches The issue has been fixed in n", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-qgpw-8g46-w95v", "type": "advisory", "advisoryId": "GHSA-qgpw-8g46-w95v", "cveId": "CVE-2026-86995", "title": "n8n: Git Node branch. .remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read", "summary": "Medium severity advisory GHSA-qgpw-8g46-w95v (CVE-2026-86995) affecting n8n. Patched in n8n 1.123.76.", "severity": "medium", "cvssScore": 5.3, "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "epssPercentile": 0.34513, "cwes": [ "CWE-22", "CWE-73" ], "affected": [ { "ecosystem": "npm", "name": "n8n", "vulnerableVersionRange": "< 1.123.76", "firstPatchedVersion": "1.123.76" }, { "ecosystem": "npm", "name": "n8n", "vulnerableVersionRange": ">= 2.38.0, < 2.38.2", "firstPatchedVersion": "2.38.2" }, { "ecosystem": "npm", "name": "n8n", "vulnerableVersionRange": ">= 2.0.0, < 2.37.7", "firstPatchedVersion": "2.37.7" } ], "matchedTerms": [ "n8n" ], "disclosedAt": "2026-09-10", "sourceUpdatedAt": "2026-09-10T21:16:38Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-qgpw-8g46-w95v", "references": [ "https://github.com/n8n-io/n8n/security/advisories/GHSA-qgpw-8g46-w95v", "https://nvd.nist.gov/vuln/detail/CVE-2026-86995", "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7", "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2", "https://github.com/advisories/GHSA-qgpw-8g46-w95v" ], "evidence": "## Impact The Git node validated the repository that a fetch or pull targeted, but setUpstream wrote a branch. .remote value into the repository's own configuration without validating it. A subsequent fetch or pull resolved the remote from that configuration rather than from the checked parameter, so an authenticated user with workflow-edit permission could point it at any local repository the n8n process could read ", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-v39v-59xw-j98g", "type": "advisory", "advisoryId": "GHSA-v39v-59xw-j98g", "cveId": "CVE-2026-87012", "title": "Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value", "summary": "Medium severity advisory GHSA-v39v-59xw-j98g (CVE-2026-87012) affecting open-webui. Patched in open-webui 0.11.1.", "severity": "medium", "cvssScore": 4.3, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "epssPercentile": 0.41529, "cwes": [ "CWE-754", "CWE-1287" ], "affected": [ { "ecosystem": "pip", "name": "open-webui", "vulnerableVersionRange": ">= 0.9.0, < 0.11.1", "firstPatchedVersion": "0.11.1" } ], "matchedTerms": [ "open-webui" ], "disclosedAt": "2026-09-10", "sourceUpdatedAt": "2026-09-10T22:42:48Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-v39v-59xw-j98g", "references": [ "https://github.com/open-webui/open-webui/security/advisories/GHSA-v39v-59xw-j98g", "https://nvd.nist.gov/vuln/detail/CVE-2026-87012", "https://github.com/open-webui/open-webui/pull/28790", "https://github.com/open-webui/open-webui/commit/abc69000b33b4894fbd97fc2c962139cf9a8d784", "https://github.com/open-webui/open-webui/releases/tag/v0.11.1", "https://github.com/advisories/GHSA-v39v-59xw-j98g" ], "evidence": "# Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value ## Summary Calendar events carry a free-form meta object that is stored exactly as submitted, with no validation of the values inside it. The scheduler reads the per-event alert offset out of that object in a single pass that covers every user's upcoming events, and compares it numerically without checking that it is a n", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-wjwr-xfp9-r66p", "type": "advisory", "advisoryId": "GHSA-wjwr-xfp9-r66p", "cveId": "CVE-2026-87014", "title": "Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes", "summary": "Medium severity advisory GHSA-wjwr-xfp9-r66p (CVE-2026-87014) affecting open-webui. Patched in open-webui 0.11.1.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "epssPercentile": 0.43528, "cwes": [ "CWE-613", "CWE-863" ], "affected": [ { "ecosystem": "pip", "name": "open-webui", "vulnerableVersionRange": ">= 0.9.0, < 0.11.1", "firstPatchedVersion": "0.11.1" } ], "matchedTerms": [ "open-webui" ], "disclosedAt": "2026-09-10", "sourceUpdatedAt": "2026-09-10T22:41:34Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-wjwr-xfp9-r66p", "references": [ "https://github.com/open-webui/open-webui/security/advisories/GHSA-wjwr-xfp9-r66p", "https://nvd.nist.gov/vuln/detail/CVE-2026-87014", "https://github.com/open-webui/open-webui/commit/ce3c175e260709f359d7e6cbb3132f0572098b95", "https://github.com/open-webui/open-webui/releases/tag/v0.11.1", "https://github.com/advisories/GHSA-wjwr-xfp9-r66p" ], "evidence": "## Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO role-sync paths, the reverse-proxy trusted role header and OAuth role mapping, changed the role in the database without teari", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-wpmr-8h3q-fwj7", "type": "advisory", "advisoryId": "GHSA-wpmr-8h3q-fwj7", "cveId": "CVE-2026-87016", "title": "Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite", "summary": "High severity advisory GHSA-wpmr-8h3q-fwj7 (CVE-2026-87016) affecting open-webui. Patched in open-webui 0.11.1.", "severity": "high", "cvssScore": 8.1, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "epssPercentile": 0.48541, "cwes": [ "CWE-155", "CWE-287" ], "affected": [ { "ecosystem": "pip", "name": "open-webui", "vulnerableVersionRange": ">= 0.6.41, < 0.11.1", "firstPatchedVersion": "0.11.1" } ], "matchedTerms": [ "open-webui" ], "disclosedAt": "2026-09-10", "sourceUpdatedAt": "2026-09-10T21:23:26Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-wpmr-8h3q-fwj7", "references": [ "https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7", "https://nvd.nist.gov/vuln/detail/CVE-2026-87016", "https://github.com/open-webui/open-webui/pull/28624", "https://github.com/open-webui/open-webui/commit/73c1f5806aeb6345dad5de8f5aa26d1f3d0bef80", "https://github.com/open-webui/open-webui/releases/tag/v0.11.1", "https://github.com/advisories/GHSA-wpmr-8h3q-fwj7" ], "evidence": "## Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account the database returns first, which can be an administrator. The same defect affects SCIM external-ID resolution. PostgreSQL", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "id": "ghsa:GHSA-wvm9-9g5j-623f", "type": "advisory", "advisoryId": "GHSA-wvm9-9g5j-623f", "cveId": "CVE-2026-88006", "title": "Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange", "summary": "Medium severity advisory GHSA-wvm9-9g5j-623f (CVE-2026-88006) affecting open-webui. Patched in open-webui 0.11.1.", "severity": "medium", "cvssScore": 6.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "epssPercentile": 0.30794, "cwes": [ "CWE-863" ], "affected": [ { "ecosystem": "pip", "name": "open-webui", "vulnerableVersionRange": ">= 0.8.0, < 0.11.1", "firstPatchedVersion": "0.11.1" } ], "matchedTerms": [ "open-webui" ], "disclosedAt": "2026-09-10", "sourceUpdatedAt": "2026-09-10T23:04:57Z", "exploitation": null, "sourceId": "ghsa", "sourceUrl": "https://github.com/advisories/GHSA-wvm9-9g5j-623f", "references": [ "https://github.com/open-webui/open-webui/security/advisories/GHSA-wvm9-9g5j-623f", "https://nvd.nist.gov/vuln/detail/CVE-2026-88006", "https://github.com/open-webui/open-webui/commit/d799e81edbdc971c6deb096b6474cd95b93504bf", "https://github.com/open-webui/open-webui/releases/tag/v0.11.1", "https://github.com/advisories/GHSA-wvm9-9g5j-623f" ], "evidence": "## Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at their existing role through this endpoint. ## Preconditions - ENABLE_OAUTH_TOKEN_EXCHANGE=True. It is disabled by defa", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:00:19.721Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:23177012", "type": "incident", "advisoryId": "incident:23177012", "cveId": null, "title": "Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise", "summary": "Wiz blog reported a security matter involving LiteLLM on 2026-09-09 (remote code execution, code execution, compromise). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "LiteLLM", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "LiteLLM", "MCP", "AI" ], "signals": [ "remote code execution", "code execution", "compromise" ], "disclosedAt": "2026-09-09", "sourceUpdatedAt": "2026-09-09T16:06:00.000Z", "sourceId": "wiz-research", "sourceUrl": "https://www.wiz.io/blog/off-guard-breaking-litellm-from-authentication-bypass-to-cloud-compromise", "references": [], "evidence": "How default keys, unauthenticated MCP sessions, and custom code guardrails expose cloud AI infrastructure to root-level remote code execution and IAM theft.", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:8c803e71", "type": "incident", "advisoryId": "incident:8c803e71", "cveId": null, "title": "OpenAI: Hugging Face mob agent incident is 'a warning shot'", "summary": "ReversingLabs blog reported a security matter involving OpenAI, Hugging Face on 2026-09-09 (supply chain). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "OpenAI", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Hugging Face", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "OpenAI", "Hugging Face" ], "signals": [ "supply chain" ], "disclosedAt": "2026-09-09", "sourceUpdatedAt": "2026-09-09T15:00:00.000Z", "sourceId": "reversinglabs-blog", "sourceUrl": "https://www.reversinglabs.com/blog/openai-hugging-face-warning-shot", "references": [], "evidence": "The post-mortem reaches sobering conclusions, and demands a plan of action for the AI industry — plus your SecOps strategy.", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:923c5ac8", "type": "incident", "advisoryId": "incident:923c5ac8", "cveId": null, "title": "The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT", "summary": "Check Point Research reported a security matter involving ChatGPT, OpenAI, Hugging Face on 2026-09-08 (code execution, malicious, exfiltrate). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "ChatGPT", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "OpenAI", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Hugging Face", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "ChatGPT", "OpenAI", "Hugging Face", "text generation", "LLMs" ], "signals": [ "code execution", "malicious", "exfiltrate" ], "disclosedAt": "2026-09-08", "sourceUpdatedAt": "2026-09-08T13:00:18.000Z", "sourceId": "checkpoint-research", "sourceUrl": "https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt", "references": [], "evidence": "Research by: Alexey Bukhteyev Key Takeaways Check Point Research discovered a covert cross-account command channel through which an attacker could use a victim’s ChatGPT session to execute hidden tasks with the tools, data, and connected apps available to that session. The victim could receive a normal answer to their visible request while the attacker’s task was processed separately and its result returned across ac", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "osv:MAL-2026-1380", "type": "incident", "advisoryId": "MAL-2026-1380", "cveId": null, "title": "Malicious code in cline (npm)", "summary": "OSV lists cline (npm) as malicious in MAL-2026-1380, versions 2.3.0. Remove or pin away from the affected versions.", "affected": [ { "ecosystem": "npm", "name": "cline", "vulnerableVersionRange": "2.3.0", "firstPatchedVersion": null } ], "matchedTerms": [ "cline" ], "signals": [ "malicious" ], "disclosedAt": "2026-09-07", "sourceUpdatedAt": "2026-09-07T02:15:13.175523968Z", "sourceId": "osv-malicious", "sourceUrl": "https://osv.dev/vulnerability/MAL-2026-1380", "references": [ "https://github.com/advisories/GHSA-9ppg-jx86-fqw7", "https://github.com/cline/cline/security/advisories/GHSA-9ppg-jx86-fqw7" ], "evidence": "--- The package cline was found to contain malicious code. ### Description On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: cline@2.3.0. The published package contains a modified package.json with an added postinstall script: \"postinstall\": \"npm install -g openclaw@latest\" This causes openclaw (an unrelated, non-malic", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "id": "kev:CVE-2026-59822", "type": "exploited", "advisoryId": "CVE-2026-59822", "cveId": "CVE-2026-59822", "title": "BerriAI LiteLLM Improper Authentication Vulnerability", "summary": "CISA added CVE-2026-59822 in BerriAI LiteLLM to the Known Exploited Vulnerabilities catalog on 2026-09-02.", "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [ "CWE-287", "CWE-306" ], "affected": [ { "ecosystem": "product", "name": "LiteLLM", "vendor": "BerriAI", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "litellm", "MCP" ], "disclosedAt": "2026-09-02", "sourceUpdatedAt": "2026-10-30T17:02:45.3665Z", "exploitation": { "dateAdded": "2026-09-02", "dueDate": "2026-09-16", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discon", "knownRansomwareCampaignUse": false }, "sourceId": "cisa-kev", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822", "references": [ "https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-59822" ], "evidence": "BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:12:51.420Z", "revision": 2, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:0b095c60", "type": "incident", "advisoryId": "incident:0b095c60", "cveId": null, "title": "OpenClaw went viral. Meet the maintainers building and securing it.", "summary": "GitHub security blog reported a security matter involving OpenClaw, GitHub Copilot on 2026-08-27 (supply chain). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "OpenClaw", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "GitHub Copilot", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "OpenClaw", "GitHub Copilot", "AI" ], "signals": [ "supply chain" ], "disclosedAt": "2026-08-27", "sourceUpdatedAt": "2026-08-27T16:00:00.000Z", "sourceId": "github-security-blog", "sourceUrl": "https://github.blog/open-source/maintainers/openclaw-went-viral-meet-the-maintainers-building-and-securing-it", "references": [], "evidence": "What began as a personal experiment quickly became a global open source project with extraordinary momentum. OpenClaw is a personal AI assistant that runs on users’ devices and connects with the messaging channels they already use. Started by Peter Steinberger as a weekend project in November 2025, its GitHub repository has grown to approximately 388,000 stars, 81,000 forks, and more than 80,000 commits by Augu", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:5cb3f0c6", "type": "incident", "advisoryId": "incident:5cb3f0c6", "cveId": null, "title": "Claude Code Security: Pros, cons — and best practices", "summary": "ReversingLabs blog reported a security matter involving Claude Code on 2026-08-27 (supply chain). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Claude Code", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Claude Code", "AI" ], "signals": [ "supply chain" ], "disclosedAt": "2026-08-27", "sourceUpdatedAt": "2026-08-27T15:00:00.000Z", "sourceId": "reversinglabs-blog", "sourceUrl": "https://www.reversinglabs.com/blog/claude-code-security", "references": [], "evidence": "Claude Code Security is a step forward on AI coding risk — but it trips on modern threats. Learn best practices for AI coding security.", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:7d762026", "type": "incident", "advisoryId": "incident:7d762026", "cveId": null, "title": "Breaking Claude Code Opus 5 Auto Mode", "summary": "Embrace The Red reported a security matter involving Claude Code, Anthropic on 2026-08-27 (code execution, prompt injection). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Claude Code", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "Anthropic", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Claude Code", "Anthropic", "prompt injection" ], "signals": [ "code execution", "prompt injection" ], "disclosedAt": "2026-08-27", "sourceUpdatedAt": "2026-08-27T04:00:00.000Z", "sourceId": "embrace-the-red", "sourceUrl": "https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode", "references": [], "evidence": "In this post, we explore how a simple website summary request hijacks Claude Code Opus 5 in Auto Mode and achieves code execution with 60-80% attack success rate using a small sample size. This is interesting because a third-party evaluation commissioned by Anthropic showed a 0.00% prompt injection attack success rate for Opus 5 in Auto Mode. Auto Mode Is Now the Default in Claude Code Auto Mode replaces human approv", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:d718ff5e", "type": "incident", "advisoryId": "incident:d718ff5e", "cveId": null, "title": "The Hugging Face incident and the road ahead", "summary": "OpenAI news reported a security matter involving Hugging Face, OpenAI on 2026-08-26 (security incident). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Hugging Face", "vulnerableVersionRange": null, "firstPatchedVersion": null }, { "ecosystem": "product", "name": "OpenAI", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Hugging Face", "OpenAI" ], "signals": [ "security incident" ], "disclosedAt": "2026-08-26", "sourceUpdatedAt": "2026-08-26T00:00:00.000Z", "sourceId": "openai-news", "sourceUrl": "https://openai.com/index/hugging-face-incident-and-the-road-ahead", "references": [], "evidence": "OpenAI shares findings from the Hugging Face security incident and the steps we’re taking to strengthen AI model security, monitoring, and alignment.", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "osv:MAL-2026-5478", "type": "incident", "advisoryId": "MAL-2026-5478", "cveId": null, "title": "Malicious code in mcp-server-git (npm)", "summary": "OSV lists mcp-server-git (npm) as malicious in MAL-2026-5478, versions 0.0.1, 0.0.2. Remove or pin away from the affected versions.", "affected": [ { "ecosystem": "npm", "name": "mcp-server-git", "vulnerableVersionRange": "0.0.1, 0.0.2", "firstPatchedVersion": null } ], "matchedTerms": [ "mcp-server-git" ], "signals": [ "malicious" ], "disclosedAt": "2026-08-20", "sourceUpdatedAt": "2026-08-20T15:30:12.066555930Z", "sourceId": "osv-malicious", "sourceUrl": "https://osv.dev/vulnerability/MAL-2026-5478", "references": [ "https://www.npmjs.com/package/mcp-server-git/v/0.0.1", "https://www.npmjs.com/package/mcp-server-git/v/0.0.2", "https://github.com/advisories/GHSA-prf3-6rx4-9h5f" ], "evidence": "--- package.json declares postinstall: node index.js. On every npm install, index.js (lines 14-29) reads os.hostname(), process.cwd(), os.platform(), the npm user-agent, and Node version, and POSTs them as JSON to the hardcoded endpoint https://npx-canary-log.vulnerable-live.workers.dev/log (index.js:16). The package name mcp-server-git impersonates the well-known Model Context Protocol git server (officially distrib", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "id": "kev:CVE-2026-64849", "type": "exploited", "advisoryId": "CVE-2026-64849", "cveId": "CVE-2026-64849", "title": "MLflow Server-Side Request Forgery Vulnerability", "summary": "CISA added CVE-2026-64849 in MLflow to the Known Exploited Vulnerabilities catalog on 2026-08-19.", "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [ "CWE-918" ], "affected": [ { "ecosystem": "product", "name": "MLflow", "vendor": "MLflow", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "mlflow" ], "disclosedAt": "2026-08-19", "sourceUpdatedAt": "2026-10-30T17:02:45.3665Z", "exploitation": { "dateAdded": "2026-08-19", "dueDate": "2026-09-02", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discon", "knownRansomwareCampaignUse": false }, "sourceId": "cisa-kev", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849", "references": [ "https://github.com/mlflow/mlflow/pull/24258", "https://github.com/mlflow/mlflow/issues/24179", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-64849" ], "evidence": "MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:12:51.420Z", "revision": 2, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:cb886861", "type": "incident", "advisoryId": "incident:cb886861", "cveId": null, "title": "Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR", "summary": "Wiz blog reported a security matter involving GitHub Copilot on 2026-08-17 (flaw, exploited). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "GitHub Copilot", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "GitHub Copilot" ], "signals": [ "flaw", "exploited" ], "disclosedAt": "2026-08-17", "sourceUpdatedAt": "2026-08-17T14:00:00.000Z", "sourceId": "wiz-research", "sourceUrl": "https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug", "references": [], "evidence": "Wiz Red Agent independently discovered and exploited a GitHub Actions injection missed by GitHub’s Advanced Security, validated access to sensitive data in Snowflake’s internal Jira, and assessed the blast radius—all without human intervention, five days after the flaw became live.", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true }, { "id": "kev:CVE-2025-62593", "type": "exploited", "advisoryId": "CVE-2025-62593", "cveId": "CVE-2025-62593", "title": "Ray-Project Ray Code Injection Vulnerability", "summary": "CISA added CVE-2025-62593 in Ray-Project Ray to the Known Exploited Vulnerabilities catalog on 2026-08-17.", "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [ "CWE-94", "CWE-352" ], "affected": [ { "ecosystem": "product", "name": "Ray", "vendor": "Ray-Project", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "ray" ], "disclosedAt": "2026-08-17", "sourceUpdatedAt": "2026-10-30T17:02:45.3665Z", "exploitation": { "dateAdded": "2026-08-17", "dueDate": "2026-08-20", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discon", "knownRansomwareCampaignUse": false }, "sourceId": "cisa-kev", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-62593", "references": [ "https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v", "https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2025-62593" ], "evidence": "Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:12:51.420Z", "revision": 2, "baseline": true }, { "id": "kev:CVE-2026-9198", "type": "exploited", "advisoryId": "CVE-2026-9198", "cveId": "CVE-2026-9198", "title": "IBM Langflow Code Injection Vulnerability", "summary": "CISA added CVE-2026-9198 in IBM Langflow to the Known Exploited Vulnerabilities catalog on 2026-08-04.", "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [ "CWE-94" ], "affected": [ { "ecosystem": "product", "name": "Langflow", "vendor": "IBM", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "langflow" ], "disclosedAt": "2026-08-04", "sourceUpdatedAt": "2026-10-30T17:02:45.3665Z", "exploitation": { "dateAdded": "2026-08-04", "dueDate": "2026-08-07", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discon", "knownRansomwareCampaignUse": false }, "sourceId": "cisa-kev", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9198", "references": [ "https://www.ibm.com/support/pages/node/7278927", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-9198" ], "evidence": "Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.", "firstSeenAt": "2026-10-30T17:00:19.721Z", "publishedAt": "2026-10-30T17:00:19.721Z", "updatedAt": "2026-10-30T17:12:51.420Z", "revision": 2, "baseline": true }, { "severity": "unknown", "cvssScore": null, "cvssVector": null, "epssPercentile": null, "cwes": [], "exploitation": null, "id": "incident:2f96b998", "type": "incident", "advisoryId": "incident:2f96b998", "cveId": null, "title": "Anthropic Incident: An AI Agent Published a Malicious Package to PyPI and 15 Real Systems Ran It", "summary": "StepSecurity blog reported a security matter involving Anthropic on 2026-08-03 (malicious, supply chain). No CVE is referenced; verify with the vendor before acting.", "affected": [ { "ecosystem": "product", "name": "Anthropic", "vulnerableVersionRange": null, "firstPatchedVersion": null } ], "matchedTerms": [ "Anthropic", "ai agent" ], "signals": [ "malicious", "supply chain" ], "disclosedAt": "2026-08-03", "sourceUpdatedAt": "2026-08-03T06:43:08.000Z", "sourceId": "stepsecurity", "sourceUrl": "https://www.stepsecurity.io/blog/anthropic-incident-ai-agent-malicious-package-pypi", "references": [], "evidence": "An AI agent published a malicious package to PyPI and 15 systems ran it within an hour. What Anthropic's incident means for supply chain security.", "firstSeenAt": "2026-10-30T18:48:04.802Z", "publishedAt": "2026-10-30T18:48:04.802Z", "updatedAt": "2026-10-30T18:48:04.802Z", "revision": 1, "baseline": true } ], "links": { "documentation": "https://www.aidatahub.io/docs/security-advisories", "latest": "https://www.aidatahub.io/api/latest-security", "schema": "https://www.aidatahub.io/api/security-advisories.schema.json", "client": "https://www.aidatahub.io/api/security-advisories-client-v1.mjs", "rss": "https://www.aidatahub.io/security/advisories.xml" } }