A vulnerability, identified as CVE-2026-126995, affects tjake Jlama versions 0.8.4 and 0.9.0-beta. The issue arises in the SafeTensorIndex.loadWeights function in the SafeTensorIndex.java file, allowing an attacker to perform a path traversal through manipulation of the weightmap argument. This vulnerability can be exploited remotely, with a public exploit available. The affected project has been notified of the issue but has yet to respond.

A vulnerability (CVE-2026-126995) was discovered in tjake Jlama versions 0.8.4 and 0.9.0-beta, affecting the SafeTensorIndex.loadWeights function in SafeTensorIndex.java. The issue allows for path traversal via manipulation of the weightmap argument, enabling remote attacks. An exploit is publicly available, and the project has been notified but has not yet responded. This vulnerability matters to developers and operators of AI agents, as it may allow unauthorized access to sensitive data, compromising model integrity and potentially leading to data breaches or model tampering.

A vulnerability (CVE-2026-126995) was discovered in tjake Jlama versions up to 0.8.4 and 0.9.0-beta affecting the SafeTensorIndex.loadWeights function in SafeTensorIndex.java. The vulnerability allows for path traversal via manipulation of the weightmap argument, making it susceptible to remote attacks. An exploit has been publicly disclosed and the project has not yet responded to an early issue report. This vulnerability matters to people building or operating AI agents using tjake Jlama as it may allow unauthorized access to sensitive data or system resources.

A remote code execution (RCE) vulnerability, CVE-2026-67544, was discovered in Heym's workflow engine prior to version 0.0.71. The vulnerability occurs when an authenticated user submits arbitrary Python code through the Playwright node's playwrightCode field, which is then executed directly by the backend process without sandboxing or validation. This allows for RCE on the backend host, potentially running as the root user in default Docker deployments. The issue has been patched in version 0.0.71.

A vulnerability, tracked as CVE-2026-67547, was discovered in the self-hosted AI agent OS taOS. In versions prior to 1.0.0-beta.23, the taOS API endpoint for executing built-in skills did not perform sufficient access controls, allowing any authenticated non-admin user to execute arbitrary Python code on the host system. This vulnerability enabled remote code execution without requiring admin privileges. The issue was addressed in version 1.0.0-beta.23.

A vulnerability, CVE-2026-67546, was identified in Heym's agentic systems and business-process automation infrastructure prior to version 0.0.75. An authenticated user with the lowest role could execute a malicious command on the shared backend host by exploiting the POST /api/mcp/fetch-tools endpoint, which accepts the stdio transport. This allowed the attacker to bypass normal protocol validation and execute arbitrary code, regardless of whether the command was intended to communicate via the MCP protocol. The issue has been patched in version 0.0.75, which adds role-based access controls to mitigate the vulnerability.

A security vulnerability was discovered in Heym, a system used for building and running agentic systems and business-process automations. Prior to version 0.0.73, Heym's HTTP workflow node made unvalidated outbound HTTP requests to user-specified URLs, allowing an unauthenticated attacker to exploit a Server-Side Request Forgery (SSRF) vulnerability. This was possible when a workflow targeting internal addresses was exposed with anonymous execution. The issue has been resolved in version 0.0.73, which adds validation for target host or IP addresses in the HTTP workflow node.

A security vulnerability, CVE-2026-67548, was discovered in the self-hosted AI agent OS, taOS, prior to version 1.0.0-beta.25. The vulnerability allowed any authenticated user to read and modify system configuration, platform settings, and trigger a service restart, potentially causing configuration corruption or a denial of service. This was possible due to the lack of admin authorization dependency for APIRouter instance creation. The issue has been addressed in version 1.0.0-beta.25, and users are advised to update to this version to ensure system security. This vulnerability matters for developers and operators of AI agents as it highlights the importance of proper authorization and access control in AI agent management systems.

An authentication vulnerability was discovered in the Heym system, allowing non-admin team members to add attacker accounts to teams, grant them access to credentials, and decrypt sensitive data such as API keys and OAuth tokens. This was possible due to a flawed access control mechanism that relied solely on team membership rather than the team creator/admin role. The vulnerability has been patched in version 0.0.70, which enforces stricter access controls and adds a role column to the TeamMember entity.

A security vulnerability was discovered in the Heym system prior to version 0.0.70. The issue allowed authenticated users with the lowest role to access the POST /api/mcp/fetch-tools endpoint, which could be used to fetch an attacker-supplied URL through the SSE and Streamable HTTP transports without any security restrictions. This allowed an attacker to perform a server-side request forgery (SSRF) attack, which can be used to access private IP addresses and potentially compromise the system. The vulnerability was patched in version 0.0.70, which restricts access to the endpoint to users with higher roles and adds security restrictions to prevent SSRF attacks.

A vulnerability (CVE-2026-67543) was discovered in Heym, an agentic system and business-process automation platform, prior to version 0.0.70. The issue allowed untrusted code to escape the intended Docker sandbox and execute with host root privileges due to inadequate isolation. Specifically, the skill executor skillpythonexecutor.py ran untrusted code in a local subprocess with excessive filesystem and network access, and mounted the Docker socket as root. This allowed an attacker to potentially exploit the vulnerability and gain root access on the host system. The issue has been patched in version 0.0.70 of Heym.

CVE-2026-67540 is a vulnerability in Heym, a system used for building and running agentic systems and business-process automations. Prior to version 0.0.70, authenticated users could access and use private workflow and node templates from other tenants by exploiting a lack of visibility and access control checks. This allowed unauthorized access to sensitive data, including full node/edge graphs and shared email addresses. The vulnerability has been patched in version 0.0.70, which enforces visibility and access controls correctly. This issue matters to people building or operating AI agents as it highlights the importance of robust access control and visibility checks in agentic systems to prevent unauthorized data access and potential security breaches.

A vulnerability (CVE-2026-126767) was found in OpsTree REMS versions up to 1.0.0, affecting its chat assistant feature. The vulnerability, a prompt injection issue, allows authenticated users to access the system's internal prompt by submitting specially crafted chat input to the /api/v1/rca/chat endpoint. This enables attackers to bypass the assistant's rules and obtain sensitive orchestration instructions, facilitating further prompt injection attacks. This matters to AI developers and operators as it compromises the security of the chat assistant, potentially allowing malicious users to manipulate the system and gain unauthorized access to internal information.

A remote code execution vulnerability in Visual Studio allows an unauthorized attacker to execute code over a network due to deserialization of untrusted data. This vulnerability affects the security of agents and AI-powered tools that rely on Visual Studio.

A vulnerability (CVE-2026-96437) was identified in the ai-azure-content-safety plugin for Kong Gateway Enterprise. The plugin fails to inspect request bodies larger than its in-memory buffer, allowing attackers to bypass input content-safety checks. This enables malicious requests to evade detection. The vulnerability affects users who rely on the plugin for content safety and security in their Kong Gateway deployments.

ASP.NET Core has a vulnerability (CVE-2026-114150) that allows attackers to disclose information over a network through an uninitialized resource. This could impact AI agents and applications built on ASP.NET Core.

A remote code execution vulnerability was identified in GitHub Copilot, a code completion tool integrated into JetBrains products, allowing authorized attackers to disclose sensitive information locally. The vulnerability, CVE-2026-83953, arises from improper neutralization of special elements in user input, enabling command injection attacks. This issue matters to developers and operators of AI-powered tools as it could potentially expose confidential project information, code snippets, and other sensitive data. To mitigate this vulnerability, users are advised to update their JetBrains products to the latest version, which includes a patch to address the issue.

A vulnerability was discovered in the Microsoft 365 Agents SDK, identified as CVE-2026-109485. The issue is a server-side request forgery (SSRF) bug that enables an authorized attacker to disclose information over a network. This vulnerability allows an attacker with access to the affected system to make unauthorized requests on behalf of the system, potentially leading to sensitive information exposure. The bug affects the Microsoft 365 Agents SDK, which is used by developers to integrate Microsoft services into their applications. This vulnerability matters to developers and operators of AI agents as it may compromise the security and integrity of their systems if not addressed promptly.

Microsoft MCP Gateway vulnerability CVE-2026-109492 allows an authorized attacker to bypass authorization controls via a user-controlled key, enabling elevation of privileges across a network. This vulnerability affects systems utilizing the MCP Gateway, which is a component of various Microsoft products and services. The issue arises when an attacker can manipulate a user-controlled key, permitting unauthorized access to elevated privileges. This security flaw matters to AI agents and their developers because it compromises the integrity of systems that rely on MCP Gateway, potentially enabling malicious actors to manipulate or disrupt AI-driven operations. Remediation is required to prevent exploitation of this vulnerability, which could have significant consequences for AI systems utilizing the affected software.

A vulnerability (CVE-2026-112137) has been discovered in Mendix Studio Pro 11, affecting versions 11.15.0 to 11.12.6 and 11.12.7. The issue arises from the MCP Server's failure to properly validate Content-Type and Origin headers in HTTP requests, making it susceptible to Cross-Site Request Forgery (CSRF). This vulnerability allows a malicious webpage to trick a user's browser into sending unauthorized requests, potentially executing unintended actions on the local MCP Server.