A vulnerability, identified as CVE-2026-126995, affects tjake Jlama versions 0.8.4 and 0.9.0-beta. The issue arises in the SafeTensorIndex.loadWeights function in the SafeTensorIndex.java file, allowing an attacker to perform a path traversal through manipulation of the weightmap argument. This vulnerability can be exploited remotely, with a public exploit available. The affected project has been notified of the issue but has yet to respond.

A remote code execution (RCE) vulnerability, CVE-2026-67544, was discovered in Heym's workflow engine prior to version 0.0.71. The vulnerability occurs when an authenticated user submits arbitrary Python code through the Playwright node's playwrightCode field, which is then executed directly by the backend process without sandboxing or validation. This allows for RCE on the backend host, potentially running as the root user in default Docker deployments. The issue has been patched in version 0.0.71.

A vulnerability, tracked as CVE-2026-67547, was discovered in the self-hosted AI agent OS taOS. In versions prior to 1.0.0-beta.23, the taOS API endpoint for executing built-in skills did not perform sufficient access controls, allowing any authenticated non-admin user to execute arbitrary Python code on the host system. This vulnerability enabled remote code execution without requiring admin privileges. The issue was addressed in version 1.0.0-beta.23.

A vulnerability, CVE-2026-67546, was identified in Heym's agentic systems and business-process automation infrastructure prior to version 0.0.75. An authenticated user with the lowest role could execute a malicious command on the shared backend host by exploiting the POST /api/mcp/fetch-tools endpoint, which accepts the stdio transport. This allowed the attacker to bypass normal protocol validation and execute arbitrary code, regardless of whether the command was intended to communicate via the MCP protocol. The issue has been patched in version 0.0.75, which adds role-based access controls to mitigate the vulnerability.

A security vulnerability was discovered in Heym, a system used for building and running agentic systems and business-process automations. Prior to version 0.0.73, Heym's HTTP workflow node made unvalidated outbound HTTP requests to user-specified URLs, allowing an unauthenticated attacker to exploit a Server-Side Request Forgery (SSRF) vulnerability. This was possible when a workflow targeting internal addresses was exposed with anonymous execution. The issue has been resolved in version 0.0.73, which adds validation for target host or IP addresses in the HTTP workflow node.

A security vulnerability, CVE-2026-67548, was discovered in the self-hosted AI agent OS, taOS, prior to version 1.0.0-beta.25. The vulnerability allowed any authenticated user to read and modify system configuration, platform settings, and trigger a service restart, potentially causing configuration corruption or a denial of service. This was possible due to the lack of admin authorization dependency for APIRouter instance creation. The issue has been addressed in version 1.0.0-beta.25, and users are advised to update to this version to ensure system security. This vulnerability matters for developers and operators of AI agents as it highlights the importance of proper authorization and access control in AI agent management systems.

An authentication vulnerability was discovered in the Heym system, allowing non-admin team members to add attacker accounts to teams, grant them access to credentials, and decrypt sensitive data such as API keys and OAuth tokens. This was possible due to a flawed access control mechanism that relied solely on team membership rather than the team creator/admin role. The vulnerability has been patched in version 0.0.70, which enforces stricter access controls and adds a role column to the TeamMember entity.

A security vulnerability was discovered in the Heym system prior to version 0.0.70. The issue allowed authenticated users with the lowest role to access the POST /api/mcp/fetch-tools endpoint, which could be used to fetch an attacker-supplied URL through the SSE and Streamable HTTP transports without any security restrictions. This allowed an attacker to perform a server-side request forgery (SSRF) attack, which can be used to access private IP addresses and potentially compromise the system. The vulnerability was patched in version 0.0.70, which restricts access to the endpoint to users with higher roles and adds security restrictions to prevent SSRF attacks.

A vulnerability (CVE-2026-67543) was discovered in Heym, an agentic system and business-process automation platform, prior to version 0.0.70. The issue allowed untrusted code to escape the intended Docker sandbox and execute with host root privileges due to inadequate isolation. Specifically, the skill executor skillpythonexecutor.py ran untrusted code in a local subprocess with excessive filesystem and network access, and mounted the Docker socket as root. This allowed an attacker to potentially exploit the vulnerability and gain root access on the host system. The issue has been patched in version 0.0.70 of Heym.

CVE-2026-67540 is a vulnerability in Heym, a system used for building and running agentic systems and business-process automations. Prior to version 0.0.70, authenticated users could access and use private workflow and node templates from other tenants by exploiting a lack of visibility and access control checks. This allowed unauthorized access to sensitive data, including full node/edge graphs and shared email addresses. The vulnerability has been patched in version 0.0.70, which enforces visibility and access controls correctly. This issue matters to people building or operating AI agents as it highlights the importance of robust access control and visibility checks in agentic systems to prevent unauthorized data access and potential security breaches.

A vulnerability (CVE-2026-96437) was identified in the ai-azure-content-safety plugin for Kong Gateway Enterprise. The plugin fails to inspect request bodies larger than its in-memory buffer, allowing attackers to bypass input content-safety checks. This enables malicious requests to evade detection. The vulnerability affects users who rely on the plugin for content safety and security in their Kong Gateway deployments.

A vulnerability (CVE-2026-112137) has been discovered in Mendix Studio Pro 11, affecting versions 11.15.0 to 11.12.6 and 11.12.7. The issue arises from the MCP Server's failure to properly validate Content-Type and Origin headers in HTTP requests, making it susceptible to Cross-Site Request Forgery (CSRF). This vulnerability allows a malicious webpage to trick a user's browser into sending unauthorized requests, potentially executing unintended actions on the local MCP Server.

A vulnerability (CVE-2026-112136) was identified in Mendix Studio Pro 11, affecting versions 11.12.6 and 11.12.7, as well as all versions up to 11.15.0. The issue arises from the MCP Server's HTTP listener not properly restricting access to the loopback interface, potentially allowing remote systems to interact with the server. This exposes the server to unauthorized access and increases the risk of a successful attack. Developers and operators should update to a fixed version of Mendix Studio Pro 11 to mitigate this vulnerability.

A vulnerability, identified as CVE-2026-124503, was found in sooperset mcp-atlassian versions up to 0.24.0. The issue arises from the function validatesafepath in file src/mcpatlassian/utils/io.py, where a path traversal vulnerability allows remote attacks. The exploitation of this vulnerability is publicly available, and upgrading to version 0.24.1 can mitigate the issue. Developers should update the affected component to the latest version to prevent potential attacks.

A vulnerability was discovered in NocoBase plugin-ai versions 2.1.0 through 2.2.41, where an authenticated user can bypass authorization checks to access AI employees not assigned to them. This is due to the getAccessibleAIEmployee function not properly filtering by role. An attacker can exploit this vulnerability using the dispatch-sub-agent-task tool to execute unauthorized AI employees and the get-ai-employee tool to read sensitive data, such as prompts and tool configurations. This matters to AI developers and operators as it allows unauthorized access to AI employees and their associated data, potentially leading to data breaches or system compromise.

CVE-2026-125386 is a security vulnerability in langchain4j-aideepin, a Java-based library for AI development, affecting versions up to 3.32.0. The flaw is an Insecure Direct Object Reference (IDOR) vulnerability in the CharacterMessageController, allowing authenticated users to access other users' message references through the knowledge-embedding-ref, memory-embedding-ref, or graph-ref endpoints by supplying a different user's message UUID. This allows attackers to obtain sensitive information such as knowledge-base chunks, long-term memory text, and knowledge-graph data. This vulnerability matters to developers and operators of AI agents using langchain4j-aideepin, as it enables unauthorized access to sensitive data, potentially compromising model performance and user trust.

A vulnerability (CVE-2026-119613) was identified in Ash-project Ashai. The bug allows an attacker to retrieve internal error details, including module names and data values, by inducing a tool call failure. The error information, including potentially sensitive data, is not logged and is instead sent to clients and the model. The fix for this issue logs error messages with a unique ID and returns only the ID to the caller, preventing sensitive information exposure. This issue affects Ashai versions 1.5.0 and earlier.

A security vulnerability, identified as CVE-2026-124588, has been discovered in Hugging Face's finetrainers version 0.1.0 and 0.2.0. The issue arises in the Model Index Handler's resolve_component_cls function within the finetrainers/utils/model.py file. An attacker can inject code by manipulating the Library argument, allowing for remote code execution. A publicly available exploit exists, and the project has not yet responded to the issue report. This vulnerability matters to those building or operating AI agents using finetrainers, as it may be exploited by attackers, potentially compromising system security and integrity.

A vulnerability, identified as CVE-2026-124587, was discovered in elizaOS version 2.0.3-beta.7, specifically in the lifecycle/api-base-owner.ts file of the HTTP Server component. The issue allows for remote exploitation, resulting in information disclosure. An exploit is publicly available. Affected developers should apply the patch cf6fa193017e70884e01c5bb7890f74b6b2b79d2 to remediate the issue. This vulnerability affects the security of AI agents utilizing elizaOS, potentially compromising sensitive information.

A vulnerability was discovered in IBM Langflow OSS versions 1.0.0 to 1.12.2, allowing an authenticated flow author to write arbitrary files to any directory writable by the service account. This bypasses the platform's local file access isolation safeguard. Additionally, an attacker can read the contents of arbitrary files accessible to the service process through a crafted on-disk index, potentially exposing sensitive data such as configuration files, secrets, or database files stored under the application's data directory. This vulnerability matters to people building and operating AI agents as it allows an attacker to potentially access sensitive data, compromising system integrity and security.