{"schemaVersion":1,"reviewedAt":"2026-10-26","windowStart":"2025-10-26","windowEnd":"2026-10-26","scope":"Security vulnerabilities affecting AI models, agents, AI platforms and supporting tools. Generic products are not included solely because AI helped discover a flaw.","coverageNote":"A curated, source-verified inventory within the stated disclosure window, not a claim to contain every AI vulnerability. CVE assignment and severity do not establish exploitation. Community posts are discovery leads; published summaries require primary evidence.","records":[{"id":"cve-2026-115419","cve":"CVE-2026-115419","title":"Strands A2A conversation state crosses tenant boundaries","disclosedAt":"2026-10-22","vendor":"AWS / Strands Agents","product":"Strands Agents SDK","summary":"A shared A2A server could expose another caller’s conversation history and accept instructions that affect later callers.","mechanism":"Conversation state was not isolated between A2A contexts.","prerequisites":"Authenticated access to an A2A instance serving multiple users or tenants.","impact":"Cross-tenant information disclosure and manipulation of agent behavior.","affectedVersions":"Python strands-agents with the A2A module before 1.43.0; TypeScript @strands-agents/sdk before 1.5.0.","fixedVersions":"Python 1.43.0; TypeScript 1.5.0.","severity":{"label":"High","score":8.6,"version":"4.0","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-115419"},"exploitation":{"status":"not-established","summary":"The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise."},"remediation":"Upgrade both applicable SDKs; until then run separate A2A instances per user or tenant.","lesson":"Treat conversation state as tenant data and test isolation across caller identities.","evidenceNote":"CNA CVSS 4.0 is 8.6; the upstream advisory also provides CVSS 3.1 at 8.1. Neither score measures observed attacks.","sources":[{"label":"AMZN CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-115419","publishedAt":"2026-10-22","sourceType":"primary"},{"label":"Upstream security advisory","url":"https://github.com/strands-agents/harness-sdk/security/advisories/GHSA-4v6f-7vjh-6x4m","publishedAt":"2026-10-22","sourceType":"primary"},{"label":"AWS security bulletin","url":"https://aws.amazon.com/security/security-bulletins/2026-146-aws/","publishedAt":"2026-10-22","sourceType":"primary"}],"relatedReportIds":["strands-a2a-cross-session-state-2026"]},{"id":"cve-2026-115886","cve":"CVE-2026-115886","title":"MLflow optional scorers can issue attacker-directed requests","disclosedAt":"2026-10-22","vendor":"MLflow project","product":"MLflow GenAI scorer endpoints","summary":"An attacker could select third-party scorer parameters that make the tracking server send an outbound request to an unintended host.","mechanism":"Scorer deserialization constrained module paths but not the selected class or constructor arguments.","prerequisites":"A reachable unauthenticated server with optional trulens and trulens-providers-litellm installed.","impact":"Server-side requests carrying attacker-controlled headers and body, potentially reaching internal services.","affectedVersions":"3.12.0rc0 through versions before 3.17.0.","fixedVersions":"3.17.0.","severity":{"label":"Medium","score":6.5,"version":"3.1","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-115886"},"exploitation":{"status":"not-established","summary":"The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise."},"remediation":"Upgrade, require authentication and limit optional integrations and egress destinations.","lesson":"Allowlisting a module does not make all of its constructors or arguments safe.","evidenceNote":"October 22 is upstream publication; October 23 is the CVE record. The demonstration used an attacker-owned canary token, not a stolen server credential.","sources":[{"label":"GitHub_M CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-115886","publishedAt":"2026-10-23","sourceType":"primary"},{"label":"Upstream security advisory","url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-2wqp-q3c6-ccj5","publishedAt":"2026-10-22","sourceType":"primary"}],"relatedReportIds":[]},{"id":"x402","cve":null,"title":"x402: Agent-payment verification and signing weaknesses","disclosedAt":"2026-10-22","vendor":"x402 maintainers","product":"x402 TypeScript payment facilitators and automatic clients","summary":"V12 disclosed three detailed critical findings within a larger 25-finding review of agent-payment software.","mechanism":"Missing transaction-type checks, unbound login domains and absent spending budgets crossed payment trust boundaries.","prerequisites":"An affected facilitator or automatic signing client interacting with attacker-controlled payment data.","impact":"Potential unpaid resource access, relayed wallet login or excessive token authorization.","affectedVersions":"Described TypeScript v1/v2 exact-scheme and automatic-client paths; no complete package-version range supplied.","fixedVersions":"V12 says the three critical findings were fixed by August 20; exact release mapping is not provided.","severity":null,"exploitation":{"status":"not-established","summary":"The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild."},"remediation":"Verify current upstream fixes; bind signatures to the intended origin and enforce spending limits before signing.","lesson":"Payment schemas and cryptographic signatures do not establish user intent or an acceptable budget.","evidenceNote":"Local research tests, not documented victim losses. The Solana test did not submit a live transaction. The publication does not establish remediation of all 25 findings.","sources":[{"label":"V12 x402 findings","url":"https://v12.sh/blog/x402","publishedAt":"2026-10-22","sourceType":"primary"}],"relatedReportIds":["x402-agent-payment-sdk-flaws-2026"]},{"id":"cve-2026-111079","cve":"CVE-2026-111079","title":"Goose terminal history can disclose secrets to model providers","disclosedAt":"2026-10-21","vendor":"Goose project / Red Hat CNA","product":"Goose terminal integration","summary":"Terminal integration sends recent shell commands to the configured LLM endpoint without redaction.","mechanism":"Secret-bearing history crosses from a local shell into provider requests and logs.","prerequisites":"Terminal integration enabled and sensitive values present in recent commands.","impact":"Potential exposure of credentials and secret-bearing environment assignments.","affectedVersions":"Goose terminal-history integration; the CNA does not provide a complete upstream version range.","fixedVersions":"1.56.0 changes new history hooks to opt-in; it does not redact opted-in history.","severity":{"label":"High","score":7.4,"version":"3.1","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-111079"},"exploitation":{"status":"not-established","summary":"The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise."},"remediation":"Upgrade, start a fresh shell with history sharing disabled, inspect existing hooks, and rotate credentials that were transmitted.","lesson":"Minimize model context and keep credentials out of shell command history.","evidenceNote":"The October 21 public hardening PR predates the October 22 CVE publication. Opt-in is mitigation, not proof that earlier disclosures were erased.","sources":[{"label":"redhat CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-111079","publishedAt":"2026-10-22","sourceType":"primary"},{"label":"Public hardening discussion","url":"https://github.com/aaif-goose/goose/pull/13051","publishedAt":"2026-10-21","sourceType":"primary"},{"label":"Goose 1.56.0 release","url":"https://github.com/aaif-goose/goose/releases/tag/v1.56.0","publishedAt":"2026-10-23","sourceType":"primary"}],"relatedReportIds":["goose-terminal-history-secret-disclosure-2026"]},{"id":"cve-2026-109440","cve":"CVE-2026-109440","title":"LangAlpha web content can trigger unapproved sandbox commands","disclosedAt":"2026-10-15","vendor":"ginlix-ai","product":"LangAlpha","summary":"Research demonstrated indirect prompt injection from retrieved web content into the agent’s execution tools.","mechanism":"Retrieved instructions share model context with always-available Bash and ExecuteCode tools.","prerequisites":"The agent retrieves attacker-controlled content; sensitive tools remain ungated.","impact":"Commands could access data and secrets available inside the workspace sandbox.","affectedVersions":"Through 2026.09.07, per the CNA.","fixedVersions":"No fixed release identified in the reviewed sources.","severity":{"label":"High","score":8.7,"version":"4.0","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-109440"},"exploitation":{"status":"not-established","summary":"The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise."},"remediation":"Require approval for sensitive execution, keep secrets behind mediated tools, and restrict sandbox egress.","lesson":"A natural-language instruction is not an access-control boundary.","evidenceNote":"The CNA records October 15 public disclosure. Lasso used a local harness with mocked Daytona and a benign command; production secret theft and sandbox escape were not demonstrated.","sources":[{"label":"VulnCheck CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-109440","publishedAt":"2026-10-20","sourceType":"primary"}],"relatedReportIds":["langalpha-web-prompt-injection-2026"]},{"id":"sneakpeek","cve":null,"title":"SneakPeek: Claude Desktop preview exposes local files","disclosedAt":"2026-10-14","vendor":"Anthropic","product":"Claude Desktop / Claude Code preview pane","summary":"Noma demonstrated local-file disclosure when the preview automatically rendered crafted HTML.","mechanism":"The large-file rendering path combined missing script restrictions with local-file access; a worker bypass defeated an initial fix.","prerequisites":"A user asks Claude to inspect attacker-controlled HTML in a repository.","impact":"Potential exposure of local credentials and other readable files.","affectedVersions":"Preview implementations before the fix; the source does not identify a first affected release.","fixedVersions":"Claude Desktop 1.30096.1 and later, according to Noma’s August 17 fix timeline.","severity":{"label":"High","score":8.7,"version":"4.0","sourceUrl":"https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data"},"exploitation":{"status":"not-established","summary":"The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild."},"remediation":"Update and verify the desktop build; isolate untrusted artifact rendering and review credentials if exposure is suspected.","lesson":"Security checks must cover every rendering path and execution context.","evidenceNote":"Noma reports a final successful retest. Its October report says CVE/advisory publication was pending; no CVE identity is invented.","sources":[{"label":"Noma SneakPeek disclosure","url":"https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data","publishedAt":"2026-10-14","sourceType":"primary"}],"relatedReportIds":["sneakpeek-claude-desktop-2026"]},{"id":"cve-2026-103663","cve":"CVE-2026-103663","title":"Ollama model-layer paths can write outside the model store","disclosedAt":"2026-10-08","vendor":"Ollama / CERT Polska","product":"Ollama","summary":"A remote caller could use malformed model-layer paths to write files beyond the model store.","mechanism":"Layer digest handling did not sufficiently constrain the resulting filesystem path.","prerequisites":"Unauthenticated API access; root execution additionally requires write access to the Ollama library directory and a later server restart.","impact":"Arbitrary file writes; eligible container deployments could execute the planted code as root after restart.","affectedVersions":"0.34.2 through versions before 0.35.0.","fixedVersions":"0.35.0.","severity":{"label":"Critical","score":9.4,"version":"4.0","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-103663"},"exploitation":{"status":"not-established","summary":"The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise."},"remediation":"Upgrade, run without unnecessary filesystem privileges, and inspect affected library directories before restarting exposed instances.","lesson":"Inference containers should not be able to rewrite their own executable libraries.","evidenceNote":"CERT Polska supplies scenario-specific scores: 6.9 without library-directory write access and 9.4 with that access. The higher score applies to the stated execution scenario, not every installation.","sources":[{"label":"CERT-PL CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-103663","publishedAt":"2026-10-08","sourceType":"primary"},{"label":"CERT Polska coordinated disclosure","url":"https://cert.pl/en/posts/2026/10/CVE-2026-103663/","publishedAt":"2026-10-08","sourceType":"primary"}],"relatedReportIds":[]},{"id":"cve-2026-114053","cve":"CVE-2026-114053","title":"vLLM requests can select untrusted processor-code revisions","disclosedAt":"2026-10-06","vendor":"vLLM project","product":"vLLM","summary":"A multimodal request could replace the operator-reviewed processor code with another repository revision.","mechanism":"Request processor arguments were allowed to influence dynamic code loading.","prerequisites":"Dynamic processor code, trust_remote_code enabled, and an attacker-controlled revision in the served model repository; the revision must be fetchable or cached.","impact":"Arbitrary Python execution in the API or renderer process.","affectedVersions":"0.7.3 through versions before 0.31.0, per the CNA.","fixedVersions":"0.31.0.","severity":{"label":"Critical","score":9.2,"version":"4.0","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-114053"},"exploitation":{"status":"not-established","summary":"The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise."},"remediation":"Upgrade, avoid remote-code trust unless required, and protect auxiliary endpoints such as tokenization with access controls.","lesson":"Pin code authority separately from request-controlled preprocessing settings.","evidenceNote":"Default trust_remote_code=False is not affected. October 6 is upstream disclosure; October 21 is CVE publication. The CNA’s 9.2 CVSS 4.0 score reflects conditional exposure; laboratory demonstration is not a reported intrusion.","sources":[{"label":"VulnCheck CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-114053","publishedAt":"2026-10-21","sourceType":"primary"},{"label":"Upstream security advisory","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-6mm3-gc2m","publishedAt":"2026-10-06","sourceType":"primary"}],"relatedReportIds":[]},{"id":"cve-2026-90970","cve":"CVE-2026-90970","title":"GitLab AI Gateway custom-flow sandbox escape","disclosedAt":"2026-10-02","vendor":"GitLab","product":"GitLab AI Gateway","summary":"GitLab disclosed a critical template-sandbox escape affecting its self-hosted AI Gateway. GitLab-hosted gateways were already patched.","mechanism":"A crafted flow configuration escapes the prompt template sandbox.","prerequisites":"Authenticated Duo Agent Platform access and an affected AI Gateway.","impact":"Arbitrary commands on the AI Gateway.","affectedVersions":"18.1.6–before 19.2.4; 19.3–before 19.3.2; 19.4–before 19.4.1.","fixedVersions":"19.2.4, 19.3.2 or 19.4.1 for the corresponding branch.","severity":{"label":"Critical","score":9.9,"version":"3.1","sourceUrl":"https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/"},"exploitation":{"status":"not-established","summary":"The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild."},"remediation":"Patch the AI Gateway component and verify its version separately from the GitLab application.","lesson":"Inventory AI gateways as independent services with their own patch ownership.","evidenceNote":"CNA publication is October 2; later Reddit and European coverage are discovery/corroboration, not new disclosures.","sources":[{"label":"GitLab critical patch notice","url":"https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/","publishedAt":"2026-10-02","sourceType":"primary"},{"label":"GitLab CNA record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-90970","publishedAt":"2026-10-02","sourceType":"primary"}],"relatedReportIds":[]},{"id":"cve-2026-93675","cve":"CVE-2026-93675","title":"Langflow dependency confusion can enable code execution","disclosedAt":"2026-10-02","vendor":"IBM","product":"Langflow OSS","summary":"IBM reports a dependency-confusion condition that could allow remote code execution.","mechanism":"Unexpected dependency resolution violates the intended trust boundary.","prerequisites":"The vendor CVSS requires user interaction; detailed attack prerequisites are not published in the reviewed bulletin.","impact":"Potential compromise of code execution, service data and availability.","affectedVersions":"1.0.0 through 1.12.2.","fixedVersions":"1.12.3.","severity":{"label":"High","score":8.8,"version":"3.1","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-93675"},"exploitation":{"status":"not-established","summary":"The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise."},"remediation":"Upgrade to at least 1.12.3 and review package-source and dependency policies.","lesson":"Control where agent-platform dependencies are obtained and how they are verified.","evidenceNote":"The bulletin is dated October 2; the CVE record followed October 7. Public technical detail is limited, so no more specific exploit chain is asserted.","sources":[{"label":"ibm CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-93675","publishedAt":"2026-10-07","sourceType":"primary"},{"label":"IBM multi-vulnerability bulletin","url":"https://www.ibm.com/support/pages/node/7290694","publishedAt":"2026-10-02","sourceType":"primary"}],"relatedReportIds":[]},{"id":"cve-2026-114612","cve":"CVE-2026-114612","title":"LiteLLM encryption-key reuse enables administrator impersonation","disclosedAt":"2026-09-30","vendor":"BerriAI","product":"LiteLLM proxy","summary":"A low-privilege internal user could obtain a forged administrator session and invoke privileged MCP commands.","mechanism":"The proxy reused one cryptographic context for stored secrets and session tokens.","prerequisites":"An internal user account; 1.87.0–1.90.x additionally requires experimental UI login. Later affected versions expose the path by default.","impact":"Administrative takeover and potential host command execution.","affectedVersions":"1.87.0–before 1.100.4; 1.101.x before .3; 1.102.x before .2; 1.103.x before .1; 1.104.0-rc.1.","fixedVersions":"1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2 on the appropriate branch.","severity":{"label":"Critical","score":9.9,"version":"3.1","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-114612"},"exploitation":{"status":"not-established","summary":"The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise."},"remediation":"Upgrade; the advisory offers disabling experimental UI login as a temporary mitigation, with CLI SSO and Claude Code gateway-login disruption.","lesson":"Separate encryption and token-signing contexts so one interface cannot mint authority for another.","evidenceNote":"Upstream disclosure was September 30; October 22 is CVE publication. Branch-specific fixes should not be collapsed into one minimum version.","sources":[{"label":"GitHub_M CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-114612","publishedAt":"2026-10-22","sourceType":"primary"},{"label":"Upstream security advisory","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45","publishedAt":"2026-09-30","sourceType":"primary"}],"relatedReportIds":[]},{"id":"cve-2026-108836","cve":"CVE-2026-108836","title":"Ollama model pulls can reach unintended network destinations","disclosedAt":"2026-09-17","vendor":"Ollama","product":"Ollama Pull API","summary":"The CVE authority reports server-side request forgery in model-pull name validation.","mechanism":"Insufficient destination validation can permit server-side requests outside intended registry boundaries.","prerequisites":"Remote access to an affected Pull API; practical reach depends on server network privileges.","impact":"Potential access to or interaction with network services reachable by the server.","affectedVersions":"CNA description: through 0.34.1; structured affected list names 0.34.0 and 0.34.1.","fixedVersions":"0.34.2, per the CNA.","severity":{"label":"Medium","score":6.9,"version":"4.0","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-108836"},"exploitation":{"status":"not-established","summary":"The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise."},"remediation":"Upgrade, restrict model-pull access and control inference-server egress.","lesson":"Validate resolved addresses and every redirect rather than trusting the first hostname.","evidenceNote":"The CNA links the September 17 public redirect-hardening PR; CVE publication followed October 12. The linked 0.34.2 release has inconsistent creation/publication timestamps, so it is not used to backdate disclosure. Public exploit availability is not evidence of malicious use. The historical 0.34.2 fix is affected by the separate CVE-2026-103663; use current vendor guidance rather than treating an older issue-specific fix as a safe overall baseline.","sources":[{"label":"VulDB CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-108836","publishedAt":"2026-10-12","sourceType":"primary"},{"label":"Public redirect-validation hardening","url":"https://github.com/ollama/ollama/pull/18512","publishedAt":"2026-09-17","sourceType":"primary"}],"relatedReportIds":[]},{"id":"cve-2026-105740","cve":"CVE-2026-105740","title":"Langflow MCP settings allow server command execution","disclosedAt":"2026-09-10","vendor":"Langflow / IBM","product":"Langflow MCP","summary":"Ordinary authenticated users could configure MCP stdio commands that run with the server’s privileges.","mechanism":"MCP configuration accepted unrestricted commands and environment settings; listing servers could trigger execution.","prerequisites":"A valid Langflow account with access to the vulnerable MCP settings path.","impact":"Server code execution and access to secrets held by the service.","affectedVersions":"Before 1.9.0 for the settings route; related execution paths had broader exposure.","fixedVersions":"1.9.0 for this route; related flow/tweak boundaries require Langflow/lfx 1.10.3 and langflow-base 0.10.3.","severity":{"label":"Critical","score":9.9,"version":"3.1","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-105740"},"exploitation":{"status":"reported","summary":"Previdian reports sensor-observed exploitation attempts from September 19 through October 26. This is evidence of attempts, not confirmed customer intrusions.","sourceUrl":"https://previdian.com/CVE-2026-105740"},"remediation":"Upgrade the relevant packages, disable automatic login, and restrict who can configure executable MCP servers.","lesson":"A connector configuration is executable authority and needs explicit authorization.","evidenceNote":"September 10 is the upstream advisory date; October 5 is CVE publication. Sensor attempts do not establish customer compromises.","sources":[{"label":"GitHub_M CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-105740","publishedAt":"2026-10-05","sourceType":"primary"},{"label":"Upstream security advisory","url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2","publishedAt":"2026-09-10","sourceType":"primary"},{"label":"Previdian sensor evidence","url":"https://previdian.com/CVE-2026-105740","publishedAt":"2026-10-11","sourceType":"primary"},{"label":"Broader execution-boundary advisory","url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45","publishedAt":"2026-09-28","sourceType":"primary"}],"relatedReportIds":["langflow-mcp-exploitation-attempts-2026"]},{"id":"cve-2026-96620","cve":"CVE-2026-96620","title":"Claude Python SDK resume input can inject startup options","disclosedAt":"2026-07-15","vendor":"Anthropic","product":"Claude Agent SDK for Python","summary":"Applications passing an untrusted session identifier to resume could start an unauthorized MCP process.","mechanism":"A dash-leading resume value was parsed as a separate CLI option.","prerequisites":"The application accepts attacker-controlled resume input and forwards it into the SDK.","impact":"Command execution at CLI startup outside SDK tool-permission controls.","affectedVersions":"Before 0.2.121.","fixedVersions":"0.2.121.","severity":{"label":"Critical","score":9.2,"version":"4.0","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-96620"},"exploitation":{"status":"not-established","summary":"The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise."},"remediation":"Upgrade and validate externally supplied session identifiers; review all process-startup arguments.","lesson":"Agent tool permissions must also cover startup and configuration boundaries.","evidenceNote":"The July 15 public fix discussion assessed narrower flag injection; the September 12 advisory describes the MCP command-execution consequence. October 16 is CVE publication.","sources":[{"label":"GitHub_M CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-96620","publishedAt":"2026-10-16","sourceType":"primary"},{"label":"Upstream security advisory","url":"https://github.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-h4mw-j7qp-8mwm","publishedAt":"2026-09-12","sourceType":"primary"},{"label":"Public argument-binding fix discussion","url":"https://github.com/anthropics/claude-agent-sdk-python/pull/1123","publishedAt":"2026-07-15","sourceType":"primary"}],"relatedReportIds":["claude-python-sdk-resume-injection-2026"]},{"id":"cve-2026-59822","cve":"CVE-2026-59822","title":"LiteLLM MCP OAuth fallback bypasses authentication","disclosedAt":"2026-06-30","vendor":"BerriAI","product":"LiteLLM MCP","summary":"A fabricated bearer token could reach configured MCP tools without a valid LiteLLM key.","mechanism":"An OAuth passthrough fallback replaced failed authentication with an empty authorization object.","prerequisites":"Network access to the vulnerable MCP Streamable HTTP routes.","impact":"Unauthorized tool calls and access to connected services.","affectedVersions":"Before 1.84.0.","fixedVersions":"1.84.0.","severity":{"label":"High","score":8.8,"version":"4.0","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-59822"},"exploitation":{"status":"reported","summary":"CISA lists this CVE in its Known Exploited Vulnerabilities catalog, added 2026-09-02. The catalog does not establish victim counts or exploitation of every affected deployment.","sourceUrl":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json"},"remediation":"Upgrade; if delayed, disable or block MCP endpoints and investigate prior unauthorized tool access.","lesson":"An authentication failure must remain a failure across every connector fallback.","evidenceNote":"June 30 is the upstream publication date; July 8 is the CVE publication. KEV confirms known exploitation but does not provide victim counts or a campaign narrative.","sources":[{"label":"GitHub_M CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-59822","publishedAt":"2026-07-08","sourceType":"primary"},{"label":"Upstream security advisory","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q","publishedAt":"2026-06-30","sourceType":"primary"},{"label":"CERT-FR exploitation summary","url":"https://www.cert.cyber.gouv.fr/actualite/CERTFR-2026-ACT-038/","publishedAt":"2026-09-07","sourceType":"primary"},{"label":"CISA KEV exact-ID entry (official catalog mirror verified)","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","publishedAt":"2026-10-23","sourceType":"primary"}],"relatedReportIds":[]},{"id":"cve-2026-64849","cve":"CVE-2026-64849","title":"MLflow webhook checks can be bypassed with redirects or DNS changes","disclosedAt":"2026-06-26","vendor":"MLflow project","product":"MLflow tracking server","summary":"Webhook delivery could reach internal services and return their responses through the test endpoint.","mechanism":"The guard validated the initial hostname, but subsequent connections and redirects could use another address.","prerequisites":"A reachable tracking server with webhook support; default deployments can expose these routes without authentication.","impact":"Internal information disclosure and requests to services reachable from the MLflow host.","affectedVersions":"CNA: 3.3.0–before 3.15.0; the upstream advisory’s structured range begins at 3.10.0.","fixedVersions":"3.15.0 for the original flaw; 3.16.0 adds related IPv6-transition hardening.","severity":{"label":"Critical","score":9.3,"version":"3.1","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-64849"},"exploitation":{"status":"reported","summary":"CISA lists this CVE in its Known Exploited Vulnerabilities catalog, added 2026-08-19. The catalog does not establish victim counts or exploitation of every affected deployment.","sourceUrl":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json"},"remediation":"Upgrade to include the follow-up protections, authenticate the tracking server and limit network egress.","lesson":"Check the actual connected peer address, not only a hostname at validation time.","evidenceNote":"June 26 is the public issue; August 2 is the advisory and August 17 the CVE publication. The sources differ on the lower affected version. KEV confirms exploitation without identifying victims.","sources":[{"label":"GitHub_M CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-64849","publishedAt":"2026-08-17","sourceType":"primary"},{"label":"Upstream security advisory","url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","publishedAt":"2026-08-02","sourceType":"primary"},{"label":"Earlier public webhook issue","url":"https://github.com/mlflow/mlflow/issues/24179","publishedAt":"2026-06-26","sourceType":"primary"},{"label":"CISA KEV exact-ID entry (official catalog mirror verified)","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","publishedAt":"2026-10-23","sourceType":"primary"}],"relatedReportIds":[]},{"id":"cve-2026-12957","cve":"CVE-2026-12957","title":"Amazon Q language server executes trusted-workspace configuration","disclosedAt":"2026-06-23","vendor":"Amazon Web Services","product":"Language Servers for AWS / Amazon Q Developer","summary":"Improper trust-boundary enforcement permits commands in a crafted project configuration to run.","mechanism":"Configuration processing crosses the boundary into command execution.","prerequisites":"The local user opens a malicious workspace and confirms workspace trust.","impact":"Arbitrary code execution with the language-server process’s permissions.","affectedVersions":"Language Servers for AWS before 1.65.0.","fixedVersions":"1.65.0 fixes this CVE; AWS recommends 1.69.0 and corresponding plugin updates to cover both June bulletin issues.","severity":{"label":"High","score":8.5,"version":"4.0","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-12957"},"exploitation":{"status":"not-established","summary":"The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild."},"remediation":"Upgrade the language server and bundled IDE plugin; restrict untrusted workspaces.","lesson":"Workspace trust is a consequential authorization, even when the user only intends to inspect a project.","evidenceNote":"Distinct from the symlink CVE-2026-12958 in the same bulletin. Do not apply the 1.69.0 affected range of that flaw to this CVE.","sources":[{"label":"AWS CNA record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-12957","publishedAt":"2026-06-23","sourceType":"primary"},{"label":"AWS security bulletin","url":"https://aws.amazon.com/security/security-bulletins/2026-047-aws/","publishedAt":"2026-06-23","sourceType":"primary"}],"relatedReportIds":[]},{"id":"cve-2026-12958","cve":"CVE-2026-12958","title":"Amazon Q language server writes through unvalidated symlinks","disclosedAt":"2026-06-23","vendor":"Amazon Web Services","product":"Language Servers for AWS / Amazon Q Developer","summary":"A trusted workspace containing a malicious symlink can redirect an agent write outside the workspace.","mechanism":"Missing symlink validation crosses the file-write boundary.","prerequisites":"The user opens and trusts the workspace, then the agent writes through the crafted link.","impact":"Modification of files outside the intended workspace.","affectedVersions":"Language Servers for AWS before 1.69.0; @aws/lsp-codewhisperer before 0.0.117.","fixedVersions":"Language server 1.69.0; @aws/lsp-codewhisperer 0.0.117.","severity":{"label":"High","score":8.5,"version":"4.0","sourceUrl":"https://github.com/Amazon-Q-Developer/language-servers/security/advisories/GHSA-6v3r-4p5c-mrp5"},"exploitation":{"status":"not-established","summary":"The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild."},"remediation":"Upgrade the bundled language server/plugin; verify auto-update completed, including derivative deployments.","lesson":"Authorize the resolved destination of a write, not only its displayed workspace path.","evidenceNote":"Public advisory June 23 predates July 8 GhostApproval coverage. AWS lists no workaround; patching this component does not resolve every vendor’s symlink behavior.","sources":[{"label":"AWS maintainer advisory","url":"https://github.com/Amazon-Q-Developer/language-servers/security/advisories/GHSA-6v3r-4p5c-mrp5","publishedAt":"2026-06-23","sourceType":"primary"},{"label":"AWS security bulletin","url":"https://aws.amazon.com/security/security-bulletins/2026-047-aws/","publishedAt":"2026-06-23","sourceType":"primary"},{"label":"Wiz GhostApproval research","url":"https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants","publishedAt":"2026-07-08","sourceType":"primary"}],"relatedReportIds":["ghostapproval-coding-agents-2026"]},{"id":"cve-2026-10561","cve":"CVE-2026-10561","title":"Langflow Python interpreter can escape code restrictions","disclosedAt":"2026-06-21","vendor":"IBM / Langflow","product":"Langflow PythonREPLComponent","summary":"IBM describes an unauthenticated code-execution chain combining weak Python isolation with an authentication bypass in Langflow OSS.","mechanism":"Improper isolation of Python execution, combined with an authentication bypass, can let an attacker run code on the host.","prerequisites":"Network access to a vulnerable Langflow OSS deployment. IBM describes the chain as unauthenticated; the reviewed CVE record does not specify every deployment condition.","impact":"Server compromise, secret disclosure, and unauthorized privilege changes.","affectedVersions":"Langflow OSS 1.0.0 through 1.9.3, according to IBM’s CVE record.","fixedVersions":"IBM identifies 1.9.4 for this CVE. A separate September interpreter-hardening advisory recommends at least 1.12.3, but its mapping to this CVE is not verified.","severity":{"label":"Critical","score":10,"version":"3.1","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-10561"},"exploitation":{"status":"not-established","summary":"The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise."},"remediation":"Apply IBM’s CVE-specific fix and review subsequent Langflow hardening guidance. Restrict access, disable unnecessary interpreters, and isolate untrusted execution.","lesson":"Test the effective execution boundary, including automatic-login defaults.","evidenceNote":"June 21 is IBM’s initial bulletin date. The September 28 GHSA describes related interpreter hardening but has no assigned CVE in the reviewed advisory; its version range and 9.9 score are not treated as corrections to this CVE’s IBM range and 10.0 score.","sources":[{"label":"ibm CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-10561","publishedAt":"2026-06-22","sourceType":"primary"},{"label":"Related interpreter-hardening advisory; CVE mapping unverified","url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-8qpj-27x8-pwpq","publishedAt":"2026-09-28","sourceType":"primary"},{"label":"IBM original bulletin and version guidance","url":"https://www.ibm.com/support/pages/node/7277242","publishedAt":"2026-06-21","sourceType":"primary"}],"relatedReportIds":[]},{"id":"cve-2026-50549","cve":"CVE-2026-50549","title":"Cursor path-resolution failure allows sandbox-escaping writes","disclosedAt":"2026-06-05","vendor":"Cursor","product":"Cursor Desktop","summary":"A path-validation fallback lets the agent write outside its workspace without approval.","mechanism":"Failed canonicalization falls back to the original path, permitting writes through a symlink.","prerequisites":"Attacker influence over agent behavior and a path whose resolution fails.","impact":"Arbitrary file writes under the user’s privileges, potentially leading to unsandboxed code execution.","affectedVersions":"Cursor before 3.0.","fixedVersions":"Cursor 3.0.","severity":{"label":"Critical","score":9.3,"version":"4.0","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-50549"},"exploitation":{"status":"not-established","summary":"The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild."},"remediation":"Install a supported release containing the 3.0 fix; treat unresolved paths as denied.","lesson":"File-boundary checks must fail closed when the real destination cannot be resolved.","evidenceNote":"Maintainer advisory June 5 predates CNA publication June 25 and GhostApproval July 8. The broader GhostApproval claims include disputed Anthropic behavior and should not be generalized to this patched Cursor CVE.","sources":[{"label":"Cursor maintainer advisory","url":"https://github.com/cursor/cursor/security/advisories/GHSA-3v8f-48vw-3mjx","publishedAt":"2026-06-05","sourceType":"primary"},{"label":"CNA record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-50549","publishedAt":"2026-06-25","sourceType":"primary"},{"label":"Wiz GhostApproval research","url":"https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants","publishedAt":"2026-07-08","sourceType":"primary"}],"relatedReportIds":["ghostapproval-coding-agents-2026"]},{"id":"cve-2026-45401","cve":"CVE-2026-45401","title":"Open WebUI redirects bypass internal-address restrictions","disclosedAt":"2026-05-10","vendor":"Open WebUI project","product":"Open WebUI","summary":"Authenticated users could make web or image retrieval follow redirects into private network resources.","mechanism":"Initial URL validation was not repeated for redirect targets in several fetch paths.","prerequisites":"An authenticated user and a reachable URL returning a redirect.","impact":"Disclosure of internal HTTP responses, including reachable metadata or administration services.","affectedVersions":"Before 0.9.5.","fixedVersions":"0.9.5.","severity":{"label":"High","score":8.5,"version":"3.1","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-45401"},"exploitation":{"status":"not-established","summary":"The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise."},"remediation":"Upgrade and constrain retrieval egress; validate each redirect destination.","lesson":"Network access controls must survive redirects across every retrieval helper.","evidenceNote":"May 10 is upstream disclosure; May 15 is CVE publication. Exposure depends on services reachable from the WebUI server; not every metadata service yields credentials.","sources":[{"label":"GitHub_M CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-45401","publishedAt":"2026-05-15","sourceType":"primary"},{"label":"Upstream security advisory","url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-rh5x-h6pp-cjj6","publishedAt":"2026-05-10","sourceType":"primary"}],"relatedReportIds":[]},{"id":"pipeleak","cve":null,"title":"PipeLeak: Agentforce custom-action prompt injection","disclosedAt":"2026-04-15","vendor":"Salesforce","product":"Agentforce custom lead and email flows","summary":"Capsule showed an untrusted lead submission redirecting an agent toward CRM data disclosure in a custom configuration.","mechanism":"Lead text becomes instructions that drive data-query and email actions.","prerequisites":"A public lead form, an employee’s agent review, and custom actions permitting data access and external email without approval.","impact":"Disclosure of CRM records through the configured email tool.","affectedVersions":"The researcher’s custom Agentforce deployment; no platform-wide version range established.","fixedVersions":"No universal patched release established. Salesforce said default email actions require human approval and custom actions can enable it.","severity":null,"exploitation":{"status":"not-established","summary":"The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild."},"remediation":"Require approval for sensitive custom actions; restrict recipients and data access.","lesson":"Validate each agent action’s authority independently of the text it processes.","evidenceNote":"Salesforce characterized custom-action exfiltration as configuration-specific while investigating prompt injection. The disagreement is preserved; this is not a confirmed compromise of Salesforce customers.","sources":[{"label":"Capsule PipeLeak disclosure and quoted vendor response","url":"https://www.capsulesecurity.io/blog-post/pipeleak-the-lead-that-stole-your-database-exploiting-salesforce-agentforce-with-indirect-prompt-injection","publishedAt":"2026-04-15","sourceType":"primary"}],"relatedReportIds":["pipeleak-agentforce-2026"]},{"id":"cve-2026-40217","cve":"CVE-2026-40217","title":"LiteLLM guardrail tester allows sandbox escape","disclosedAt":"2026-04-08","vendor":"BerriAI","product":"LiteLLM","summary":"Attackers probed the custom guardrail tester with payloads intended to reach unrestricted Python execution.","mechanism":"Source-text filtering could be bypassed through runtime construction and Python object behavior.","prerequisites":"Authenticated access to the guardrail testing endpoint, including a guessed or exposed master key.","impact":"Commands run with proxy privileges, potentially root in the default container.","affectedVersions":"Zenity identifies 1.81.8 through versions before 1.83.10; the CNA identifies a vulnerable image digest.","fixedVersions":"1.83.10, per Zenity’s remediation and reproduction report.","severity":{"label":"High","score":8.8,"version":"3.1","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-40217"},"exploitation":{"status":"reported","summary":"Zenity observed malicious honeypot requests and reproduced payloads in a lab. Successful compromise of customer systems is not established.","sourceUrl":"https://labs.zenity.io/post/threat-actors-are-trying-to-use-litellm-s-guardrail-tester-to-run-code-as-root"},"remediation":"Upgrade, restrict the management endpoint, rotate default or exposed keys, and run the gateway without root privileges.","lesson":"A code guardrail needs an execution boundary, not only forbidden-word filtering.","evidenceNote":"X41 published April 8; April 10 is CVE publication and June 30 is campaign reporting. X41’s original page predates the available patch.","sources":[{"label":"mitre CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-40217","publishedAt":"2026-04-10","sourceType":"primary"},{"label":"X41 original disclosure","url":"https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm/","publishedAt":"2026-04-08","sourceType":"primary"},{"label":"Zenity telemetry and fix validation","url":"https://labs.zenity.io/post/threat-actors-are-trying-to-use-litellm-s-guardrail-tester-to-run-code-as-root","publishedAt":"2026-06-30","sourceType":"primary"}],"relatedReportIds":["litellm-guardrail-exploitation-attempts-2026"]},{"id":"double-agents","cve":null,"title":"Double Agents: Vertex AI default service-agent permissions","disclosedAt":"2026-03-31","vendor":"Google Cloud","product":"Vertex AI Agent Engine","summary":"Unit 42 demonstrated that a malicious or compromised deployed agent could misuse its default service identity.","mechanism":"The agent runtime exposes credentials whose default permissions reach beyond the intended task.","prerequisites":"An attacker-controlled or compromised deployed agent with the relevant service-account permissions.","impact":"Access to consumer-project data and some producer-project artifacts in the researchers’ environment.","affectedVersions":"Hosted Agent Engine configuration using the described default service agent; no version range supplied.","fixedVersions":"No universal software patch claimed; Google documented behavior and recommended a dedicated customer-managed service account.","severity":null,"exploitation":{"status":"not-established","summary":"The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild."},"remediation":"Use a dedicated least-privilege service account and verify resource permissions before deploying third-party agents.","lesson":"The effective authority is the runtime identity’s permissions, not the agent’s stated purpose.","evidenceNote":"Research demonstration, no CVE reported. Google confirmed controls prevent modification of production base images; Workspace access also requires IAM permissions. Proposed pickle exploitation was not tested.","sources":[{"label":"Unit 42 Double Agents research","url":"https://unit42.paloaltonetworks.com/double-agents-vertex-ai/","publishedAt":"2026-03-31","sourceType":"primary"}],"relatedReportIds":[]},{"id":"cve-2026-33017","cve":"CVE-2026-33017","title":"Langflow public-flow builder accepts executable attacker data","disclosedAt":"2026-03-16","vendor":"Langflow","product":"Langflow public flow builder","summary":"The public-flow build endpoint could accept executable flow definitions without authentication.","mechanism":"The server used caller-supplied node definitions instead of the stored public flow.","prerequisites":"A reachable public flow with a known identifier; automatic login can further expose flow creation.","impact":"Arbitrary execution with the Langflow service’s privileges and access to its credentials.","affectedVersions":"CNA: before 1.9.0; the upstream advisory originally listed through 1.8.2.","fixedVersions":"1.9.0.","severity":{"label":"Critical","score":9.3,"version":"4.0","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-33017"},"exploitation":{"status":"reported","summary":"CISA lists this CVE in its Known Exploited Vulnerabilities catalog, added 2026-03-25. The catalog does not establish victim counts or exploitation of every affected deployment.","sourceUrl":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json"},"remediation":"Upgrade and restrict public-flow building; disable automatic login and investigate exposed instances.","lesson":"Public execution interfaces should operate on trusted stored definitions, not replacement code from callers.","evidenceNote":"March 16 is upstream disclosure; March 20 is CVE publication. This is a distinct path from the older CVE-2025-3248.","sources":[{"label":"GitHub_M CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-33017","publishedAt":"2026-03-20","sourceType":"primary"},{"label":"Upstream security advisory","url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx","publishedAt":"2026-03-16","sourceType":"primary"},{"label":"CISA KEV exact-ID entry (official catalog mirror verified)","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","publishedAt":"2026-10-23","sourceType":"primary"}],"relatedReportIds":[]},{"id":"cve-2026-1868","cve":"CVE-2026-1868","title":"GitLab Duo Workflow Service insecure template expansion","disclosedAt":"2026-02-06","vendor":"GitLab","product":"GitLab AI Gateway / Duo Workflow Service","summary":"A separate February AI Gateway flaw allowed authenticated users to reach unsafe template expansion through Duo flow definitions.","mechanism":"User-controlled flow data reaches insecure template expansion.","prerequisites":"Authenticated access to the GitLab instance and a vulnerable self-hosted AI Gateway.","impact":"Gateway code execution or denial of service.","affectedVersions":"CNA version ranges: 18.1.6 to before 18.6.2; 18.7.0 to before 18.7.1; 18.8.0 to before 18.8.1.","fixedVersions":"18.6.2, 18.7.1 and 18.8.1.","severity":{"label":"Critical","score":9.9,"version":"3.1","sourceUrl":"https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-18-8-1-released/"},"exploitation":{"status":"not-established","summary":"The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild."},"remediation":"Use a currently supported patched gateway; the October CVE-2026-90970 requires later fixes on affected branches.","lesson":"A previous patch for a vulnerability class does not establish protection from subsequent variants.","evidenceNote":"February 6 vendor disclosure predates the February 9 CNA publication. This is distinct from CVE-2026-90970.","sources":[{"label":"GitLab February critical patch notice","url":"https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-18-8-1-released/","publishedAt":"2026-02-06","sourceType":"primary"},{"label":"GitLab CNA record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-1868","publishedAt":"2026-02-09","sourceType":"primary"}],"relatedReportIds":[]},{"id":"cve-2026-21520","cve":"CVE-2026-21520","title":"Copilot Studio sensitive-information disclosure (ShareLeak)","disclosedAt":"2026-01-22","vendor":"Microsoft","product":"Copilot Studio","summary":"Microsoft describes an unauthenticated information-disclosure flaw; researchers connect it to indirect prompt injection through SharePoint forms.","mechanism":"Untrusted form content could redirect a connected agent’s handling of information.","prerequisites":"An affected Copilot Studio workflow consumes attacker-controlled form content and has access to connected data.","impact":"Sensitive connected information could be sent outside its intended audience.","affectedVersions":"Copilot Studio service; no customer-installable version range is provided.","fixedVersions":"Service-side remediation reported; no local patch version specified.","severity":{"label":"High","score":7.5,"version":"3.1","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-21520"},"exploitation":{"status":"not-established","summary":"The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise."},"remediation":"Verify service guidance, constrain connector permissions and destinations, and review workflows processing external forms.","lesson":"External content should not decide where privileged agent data is sent.","evidenceNote":"Microsoft records January 22; Capsule’s later research gives a conflicting January 15 CVE date. The registry retains Microsoft’s date and does not infer a customer breach.","sources":[{"label":"microsoft CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-21520","publishedAt":"2026-01-22","sourceType":"primary"},{"label":"Microsoft security update guide","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21520","publishedAt":"2026-01-22","sourceType":"primary"},{"label":"Capsule technical disclosure","url":"https://www.capsulesecurity.io/blog-post/shareleak-taking-the-wheel-of-microsofts-copilot-studio-cve-2026-21520","publishedAt":"2026-04-15","sourceType":"primary"}],"relatedReportIds":["copilot-studio-shareleak"]},{"id":"cve-2025-12420","cve":"CVE-2025-12420","title":"ServiceNow AI identity flaw enables user impersonation","disclosedAt":"2026-01-12","vendor":"ServiceNow","product":"Now Assist AI Agents / Virtual Agent API","summary":"An unauthenticated actor could impersonate a ServiceNow user and exercise that user’s privileges.","mechanism":"The affected AI integration did not adequately bind claimed identity to authenticated authority.","prerequisites":"A vulnerable Store App or instance configuration exposing the affected integration.","impact":"Unauthorized access and operations permitted to the impersonated account.","affectedVersions":"Now Assist AI Agents 5.0.26–5.1.17 and through 5.2.18 as listed by the CNA; Virtual Agent API before 3.15.2 / 4.0.4 on the corresponding branches.","fixedVersions":"Hosted-instance update deployed October 2025; Virtual Agent API 3.15.2 / 4.0.4. Apply the appropriate vendor update for other configurations.","severity":{"label":"Critical","score":9.3,"version":"4.0","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2025-12420"},"exploitation":{"status":"not-established","summary":"The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise."},"remediation":"Confirm hosted remediation and apply the appropriate supplied update to self-hosted or specially configured instances.","lesson":"Bind agent identity to verified authentication rather than user-supplied account attributes.","evidenceNote":"The CVE year is 2025 but public publication is January 2026. The CNA’s overlapping AI Agents ranges are preserved rather than converted into an unsupported single range.","sources":[{"label":"SN CVE authority record","url":"https://cveawg.mitre.org/api/cve/CVE-2025-12420","publishedAt":"2026-01-12","sourceType":"primary"},{"label":"ServiceNow advisory","url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2587329","publishedAt":"2026-01-12","sourceType":"primary"}],"relatedReportIds":["servicenow-bodysnatcher"]},{"id":"cve-2026-22584","cve":"CVE-2026-22584","title":"Uni2TS model configuration permits code injection","disclosedAt":"2026-01-09","vendor":"Salesforce","product":"Uni2TS","summary":"Model metadata can reach executable configuration handling when vulnerable Uni2TS loads a model.","mechanism":"Hydra instantiation processes attacker-controlled model configuration.","prerequisites":"Loading a crafted model with the affected library.","impact":"Code execution with the model-loading process’s authority.","affectedVersions":"Uni2TS through 1.2.0 on macOS, Windows and Linux, according to the CNA.","fixedVersions":"Unit 42 reports an allowlist/validation fix on July 31, 2025; a numbered fixed release was not established from the accessible sources.","severity":{"label":"High","score":null,"version":null,"sourceUrl":"https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/"},"exploitation":{"status":"not-established","summary":"The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild."},"remediation":"Verify the upstream fix is present before loading third-party models; isolate model-loading jobs.","lesson":"A safe weights format does not make the surrounding model loader safe.","evidenceNote":"January 9 CNA publication precedes January 13 technical coverage. The Salesforce help page did not expose substantive text; fix timing is attributed to Unit 42, not independently read from that page. The July 2025 remediation predates this rolling window; January 9 is the earliest public security disclosure date verified in this review, not the date the code was first fixed.","sources":[{"label":"Salesforce CNA record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-22584","publishedAt":"2026-01-09","sourceType":"primary"},{"label":"Unit 42 AI/ML library research","url":"https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/","publishedAt":"2026-01-13","sourceType":"primary"}],"relatedReportIds":[]},{"id":"cve-2026-0628","cve":"CVE-2026-0628","title":"Chrome extension policy flaw could hijack the Gemini panel","disclosedAt":"2026-01-06","vendor":"Google","product":"Chrome / Gemini Live panel","summary":"Unit 42 showed how a malicious extension could gain the Gemini panel’s privileged browser capabilities. Google had fixed the underlying WebView policy flaw in January.","mechanism":"Extension request manipulation could inject code into a privileged AI panel.","prerequisites":"A user installs a malicious extension on an affected Chrome build; the demonstrated path uses the Gemini panel.","impact":"Potential local-file access, screenshots and camera/microphone access.","affectedVersions":"Chrome before 143.0.7499.192.","fixedVersions":"143.0.7499.192/.193 on Windows/Mac; 143.0.7499.192 on Linux in the January update.","severity":{"label":"High","score":null,"version":null,"sourceUrl":"https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop.html"},"exploitation":{"status":"not-established","summary":"The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild."},"remediation":"Update and restart Chrome; review installed extensions and their permissions.","lesson":"An AI sidebar expands the authority that a conventional extension flaw can reach.","evidenceNote":"January 6 is the public security-update date. Unit 42’s detailed Gemini research appeared March 2. A demonstration is not evidence of victims.","sources":[{"label":"Google Chrome stable security update","url":"https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop.html","publishedAt":"2026-01-06","sourceType":"primary"},{"label":"Unit 42 Gemini panel research","url":"https://unit42.paloaltonetworks.com/gemini-live-in-chrome-hijacking/","publishedAt":"2026-03-02","sourceType":"primary"},{"label":"Chrome CNA record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-0628","publishedAt":"2026-01-06","sourceType":"primary"}],"relatedReportIds":[]},{"id":"cve-2025-64660","cve":"CVE-2025-64660","title":"Copilot and VS Code access-control flaw enables code execution","disclosedAt":"2025-11-20","vendor":"Microsoft","product":"Visual Studio Code / GitHub Copilot","summary":"Microsoft’s CVE record describes improper access control enabling code execution; IDEsaster links this issue to multi-root workspace settings.","mechanism":"Agent-influenced workspace configuration can reach underlying editor execution features.","prerequisites":"An authorized attacker and user interaction, as reflected in Microsoft’s CVSS vector.","impact":"Code execution in the developer environment.","affectedVersions":"Visual Studio Code 1.0.0 to before 1.106.2.","fixedVersions":"Visual Studio Code 1.106.2.","severity":{"label":"High","score":8,"version":"3.1","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2025-64660"},"exploitation":{"status":"not-established","summary":"The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild."},"remediation":"Update VS Code and restrict agent writes to workspace configuration and executable settings.","lesson":"Review automatic editor side effects as part of an AI agent’s permissions.","evidenceNote":"November 20 is the earliest public date documented in the retrieved authority record; December 6 grouped research is later. The original IDEsaster article names ten CVEs while reporting 24 assignments overall.","sources":[{"label":"Microsoft CNA record","url":"https://cveawg.mitre.org/api/cve/CVE-2025-64660","publishedAt":"2025-11-20","sourceType":"primary"},{"label":"IDEsaster original research","url":"https://maccarita.com/posts/idesaster/","publishedAt":"2025-12-06","sourceType":"primary"}],"relatedReportIds":["idesaster-ai-ide-chains"]}],"coverage":[{"name":"CVE authority records","category":"government","url":"https://cveawg.mitre.org/api/cve/","role":"verification","checkedAt":"2026-10-26","status":"reviewed","note":"19 exact-ID CNA records read in full, with upstream advisory cross-checks. Candidate selection used existing site CVEs plus NVD/EUVD/CERT discovery; this is not a complete AI CVE census."},{"name":"CISA KEV","category":"government","url":"https://github.com/cisagov/kev-data","role":"verification","checkedAt":"2026-10-26","status":"reviewed","note":"Official GitHub mirror read in full; catalog release 2026-10-23T19:30:18.9209Z, 1756 records. Exact matches for this candidate set: CVE-2026-33017, CVE-2026-59822, CVE-2026-64849. Absence is not proof that no exploitation exists."},{"name":"NIST NVD","category":"government","url":"https://nvd.nist.gov/vuln/search","role":"verification","checkedAt":"2026-10-26","status":"limited","note":"Indexed NVD discovery searches covered AI/Langflow/LiteLLM/Ollama and exact CVEs. Detail pages often rendered empty. Three API requests (exact vLLM ID, Langflow and Ollama keywords for July1–October26, resultsPerPage2000) timed out; no complete result count or pagination coverage is asserted. CNA records were used for factual verification."},{"name":"ENISA EUVD","category":"government","url":"https://euvd.enisa.europa.eu/","role":"verification","checkedAt":"2026-10-26","status":"limited","note":"Indexed discovery for LiteLLM, vLLM, Open WebUI and MLflow; direct EUVD-2026-30631 showed Application Unavailable and EUVD-2026-60473 could not be loaded. Search snippets are not used as publication evidence."},{"name":"CERT-FR","category":"government","url":"https://www.cert.cyber.gouv.fr/actualite/CERTFR-2026-ACT-038/","role":"verification","checkedAt":"2026-10-26","status":"reviewed","note":"Full September7 bulletin checked; LiteLLM CVE-2026-59822 exploitation corroborates the independently retrieved CISA KEV entry. Other Langflow bulletins were discovery only where full content was inaccessible."},{"name":"CERT Polska","category":"government","url":"https://cert.pl/en/posts/2026/10/CVE-2026-103663/","role":"verification","checkedAt":"2026-10-26","status":"reviewed","note":"Full October8 Ollama disclosure checked, including filesystem and restart prerequisites."},{"name":"CERT-EU","category":"government","url":"https://www.cert.europa.eu/publications/threat-intelligence/cb26-08/","role":"verification","checkedAt":"2026-10-26","status":"reviewed","note":"July cyber brief read for source discovery and corroboration; it summarizes others’ reporting and does not create new CVE identities. Existing Langflow/agent reports require deduplication."},{"name":"CSBW","category":"government","url":"https://portal.cybersicherheit-bw.de/berichte/kritische-sicherheitsluecke-vllm","role":"verification","checkedAt":"2026-10-26","status":"limited","note":"October26 vLLM warning found via search, direct page inaccessible. Not used to assert a new incident or reset the upstream October6 disclosure date."},{"name":"Palo Alto Networks Unit 42","category":"vendor","url":"https://unit42.paloaltonetworks.com/double-agents-vertex-ai/","role":"verification","checkedAt":"2026-10-26","status":"reviewed","note":"Full technical reports read. Added Vertex permissions research, Chrome/Gemini CVE and Uni2TS CVE. BUGSTER already exists in incident register."},{"name":"CrowdStrike","category":"vendor","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-prompt-injection-techniques/","role":"verification","checkedAt":"2026-10-26","status":"reviewed","note":"Primary taxonomy and containment research reviewed. These describe technique classes/controls rather than a new individually scoped CVE. October21 agentic campaigns are already represented in existing register."},{"name":"Reddit","category":"community","url":"https://www.reddit.com/r/pwnhub/comments/1ww92o9/cve_daily_brief_20261003/","role":"discovery","checkedAt":"2026-10-26","status":"limited","note":"Discovery query surfaced GitLab AI Gateway. Full primary GitLab advisory and CNA used for publication. One Reddit page exposed comments/title but omitted post body; no reliance on its search snippet as evidence."},{"name":"X.com","category":"community","url":"https://x.com/cohere/status/2114752002370544004","role":"discovery","checkedAt":"2026-10-26","status":"limited","note":"Direct pages returned403. Official Cohere post discovered via Digg; original Cohere article retrieved and read. No direct X completeness claim."},{"name":"Digg","category":"community","url":"https://digg.com/","role":"discovery","checkedAt":"2026-10-26","status":"reviewed","note":"Assumed user’s Dig.com meant Digg. Full discovery pages read; Cohere lead verified against original. General outbreak/AI claims not treated as proof of AI-product vulnerability."},{"name":"Wiz, Noma, Capsule, V12 and maintainer advisories","category":"research","url":"https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants","role":"verification","checkedAt":"2026-10-26","status":"reviewed","note":"Full relevant source sections and component advisories reviewed. Researcher/vendor disagreements, patch dates and grouped identities retained."},{"name":"cve.now (aggregated discovery)","category":"research","url":"https://cve.now/","role":"discovery","checkedAt":"2026-10-26","status":"reviewed","note":"Reviewed the homepage, API reference, public source-status endpoint and a Strands CVE sample. Merges public advisories and labels model-written summaries. Useful for identifiers, aliases and leads; published claims here are checked against original sources. This sampled review does not independently verify its entire catalog or polling claims."}]}