Affected versions, fixes, and what the evidence establishes about exploitation. Follow each weakness from its original disclosure to the practical next step.
31Reviewed weaknesses
27Distinct CVE identifiers
5With reported activity · read qualifications
Reviewed . Disclosure window: through .
Security vulnerabilities affecting AI models, agents, AI platforms and supporting tools. Generic products are not included solely because AI helped discover a flaw. A curated, source-verified inventory within the stated disclosure window, not a claim to contain every AI vulnerability. CVE assignment and severity do not establish exploitation. Community posts are discovery leads; published summaries require primary evidence.
CVSS measures technical severity, not exploitation or your deployment’s risk. “Reported activity” may include attempts; read the evidence. A proof of concept alone is not an incident.
Ordinary authenticated users could configure MCP stdio commands that run with the server’s privileges.
What to do
Upgrade the relevant packages, disable automatic login, and restrict who can configure executable MCP servers.
Affected versions, fix, and exploitation evidence
Affected
Before 1.9.0 for the settings route; related execution paths had broader exposure.
Fixed / mitigation status
1.9.0 for this route; related flow/tweak boundaries require Langflow/lfx 1.10.3 and langflow-base 0.10.3.
Exploitation
Previdian reports sensor-observed exploitation attempts from September 19 through October 26. This is evidence of attempts, not confirmed customer intrusions.
A fabricated bearer token could reach configured MCP tools without a valid LiteLLM key.
What to do
Upgrade; if delayed, disable or block MCP endpoints and investigate prior unauthorized tool access.
Affected versions, fix, and exploitation evidence
Affected
Before 1.84.0.
Fixed / mitigation status
1.84.0.
Exploitation
CISA lists this CVE in its Known Exploited Vulnerabilities catalog, added 2026-09-02. The catalog does not establish victim counts or exploitation of every affected deployment.
Webhook delivery could reach internal services and return their responses through the test endpoint.
What to do
Upgrade to include the follow-up protections, authenticate the tracking server and limit network egress.
Affected versions, fix, and exploitation evidence
Affected
CNA: 3.3.0–before 3.15.0; the upstream advisory’s structured range begins at 3.10.0.
Fixed / mitigation status
3.15.0 for the original flaw; 3.16.0 adds related IPv6-transition hardening.
Exploitation
CISA lists this CVE in its Known Exploited Vulnerabilities catalog, added 2026-08-19. The catalog does not establish victim counts or exploitation of every affected deployment.
IBM describes an unauthenticated code-execution chain combining weak Python isolation with an authentication bypass in Langflow OSS.
What to do
Apply IBM’s CVE-specific fix and review subsequent Langflow hardening guidance. Restrict access, disable unnecessary interpreters, and isolate untrusted execution.
Affected versions, fix, and exploitation evidence
Affected
Langflow OSS 1.0.0 through 1.9.3, according to IBM’s CVE record.
Fixed / mitigation status
IBM identifies 1.9.4 for this CVE. A separate September interpreter-hardening advisory recommends at least 1.12.3, but its mapping to this CVE is not verified.
Exploitation
The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise.
The public-flow build endpoint could accept executable flow definitions without authentication.
What to do
Upgrade and restrict public-flow building; disable automatic login and investigate exposed instances.
Affected versions, fix, and exploitation evidence
Affected
CNA: before 1.9.0; the upstream advisory originally listed through 1.8.2.
Fixed / mitigation status
1.9.0.
Exploitation
CISA lists this CVE in its Known Exploited Vulnerabilities catalog, added 2026-03-25. The catalog does not establish victim counts or exploitation of every affected deployment.
Unit 42 showed how a malicious extension could gain the Gemini panel’s privileged browser capabilities. Google had fixed the underlying WebView policy flaw in January.
What to do
Update and restart Chrome; review installed extensions and their permissions.
Affected versions, fix, and exploitation evidence
Affected
Chrome before 143.0.7499.192.
Fixed / mitigation status
143.0.7499.192/.193 on Windows/Mac; 143.0.7499.192 on Linux in the January update.
Exploitation
The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild.
Microsoft’s CVE record describes improper access control enabling code execution; IDEsaster links this issue to multi-root workspace settings.
What to do
Update VS Code and restrict agent writes to workspace configuration and executable settings.
Affected versions, fix, and exploitation evidence
Affected
Visual Studio Code 1.0.0 to before 1.106.2.
Fixed / mitigation status
Visual Studio Code 1.106.2.
Exploitation
The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild.
Where the evidence comes from
Primary evidence. Wider discovery.
Government databases, vendor advisories, and original researcher reports establish the published findings. X, Reddit, and Digg help surface leads; an unverified social claim does not become a confirmed vulnerability here. Expand a source to see what was checked and any access limits.
19 exact-ID CNA records read in full, with upstream advisory cross-checks. Candidate selection used existing site CVEs plus NVD/EUVD/CERT discovery; this is not a complete AI CVE census.
Official GitHub mirror read in full; catalog release 2026-10-23T19:30:18.9209Z, 1756 records. Exact matches for this candidate set: CVE-2026-33017, CVE-2026-59822, CVE-2026-64849. Absence is not proof that no exploitation exists.
Open CISA KEV →NIST NVDVerification source · Limited coverage ·
Indexed NVD discovery searches covered AI/Langflow/LiteLLM/Ollama and exact CVEs. Detail pages often rendered empty. Three API requests (exact vLLM ID, Langflow and Ollama keywords for July1–October26, resultsPerPage2000) timed out; no complete result count or pagination coverage is asserted. CNA records were used for factual verification.
Open NIST NVD →ENISA EUVDVerification source · Limited coverage ·
Indexed discovery for LiteLLM, vLLM, Open WebUI and MLflow; direct EUVD-2026-30631 showed Application Unavailable and EUVD-2026-60473 could not be loaded. Search snippets are not used as publication evidence.
Full September7 bulletin checked; LiteLLM CVE-2026-59822 exploitation corroborates the independently retrieved CISA KEV entry. Other Langflow bulletins were discovery only where full content was inaccessible.
Open CERT-FR →CERT PolskaVerification source · Reviewed ·
Full October8 Ollama disclosure checked, including filesystem and restart prerequisites.
July cyber brief read for source discovery and corroboration; it summarizes others’ reporting and does not create new CVE identities. Existing Langflow/agent reports require deduplication.
Open CERT-EU →CSBWVerification source · Limited coverage ·
October26 vLLM warning found via search, direct page inaccessible. Not used to assert a new incident or reset the upstream October6 disclosure date.
Open CSBW →Palo Alto Networks Unit 42Verification source · Reviewed ·
Full technical reports read. Added Vertex permissions research, Chrome/Gemini CVE and Uni2TS CVE. BUGSTER already exists in incident register.
Primary taxonomy and containment research reviewed. These describe technique classes/controls rather than a new individually scoped CVE. October21 agentic campaigns are already represented in existing register.
Discovery query surfaced GitLab AI Gateway. Full primary GitLab advisory and CNA used for publication. One Reddit page exposed comments/title but omitted post body; no reliance on its search snippet as evidence.
Open Reddit →X.comDiscovery source · Limited coverage ·
Direct pages returned403. Official Cohere post discovered via Digg; original Cohere article retrieved and read. No direct X completeness claim.
Assumed user’s Dig.com meant Digg. Full discovery pages read; Cohere lead verified against original. General outbreak/AI claims not treated as proof of AI-product vulnerability.
Open Digg →Wiz, Noma, Capsule, V12 and maintainer advisoriesVerification source · Reviewed ·
Full relevant source sections and component advisories reviewed. Researcher/vendor disagreements, patch dates and grouped identities retained.
Reviewed the homepage, API reference, public source-status endpoint and a Strands CVE sample. Merges public advisories and labels model-written summaries. Useful for identifiers, aliases and leads; published claims here are checked against original sources. This sampled review does not independently verify its entire catalog or polling claims.
This is a reviewed selection of AI-related weaknesses within the stated disclosure window. It is not a complete global CVE database. The date is the earliest public disclosure documented in the linked evidence, which can precede a CVE record. New coverage does not reset that date. The incident register also includes research and incidents outside this vulnerability selection.
Severity and exploitation
CVSS scores retain their source and version; different authorities can disagree. A high score, public exploit, or research demonstration does not establish exploitation in the wild. “Not established” describes the reviewed evidence, not proof of safety. Read prerequisites and deployment-specific conditions before prioritizing. Fixed versions identify an issue-specific patch; they are not a recommendation to install an old release instead of the vendor’s current supported update.
Updates and corrections
Daily reviews check new disclosures, source corrections, and remediation changes before publication. The displayed review date is the published checkpoint. Source listings and feeds do not imply continuous monitoring or automatic verification. Suggest a sourced addition or correction.
Use and cite the data
The JSON, reader RSS, and filtered CSV use this same reviewed register. The reader feed is separate from email alerts; importing it may show historical entries. Cite each stable detail page with its source disclosures and your access date. Operating lessons are my editorial interpretation. Explore the AI trust field notes.