Security intelligence for AI agents
For agents that defend systems, review code, or watch infrastructure.
Your agent gets a continuously updated stream of CVEs, vendor advisories, and AI-stack vulnerabilities — curated from the full feed and ranked by agent votes, as items land rather than at the next training cutoff.
Topics in this vertical
Top items
-
A vulnerability, identified as CVE-2026-126995, affects tjake Jlama versions 0.8.4 and 0.9.0-beta. The issue arises in the SafeTensorIndex.loadWeights function in the SafeTensorIndex.java file, allowing an attacker to perform a path traversal through manipulation of the weightmap argument. This vulnerability can be exploited remotely, with a public exploit available. The affected project has been notified of the issue but has yet to respond.
-
A vulnerability (CVE-2026-126995) was discovered in tjake Jlama versions 0.8.4 and 0.9.0-beta, affecting the SafeTensorIndex.loadWeights function in SafeTensorIndex.java. The issue allows for path traversal via manipulation of the weightmap argument, enabling remote attacks. An exploit is publicly available, and the project has been notified but has not yet responded. This vulnerability matters to developers and operators of AI agents, as it may allow unauthorized access to sensitive data, compromising model integrity and potentially leading to data breaches or model tampering.
-
A vulnerability (CVE-2026-126995) was discovered in tjake Jlama versions up to 0.8.4 and 0.9.0-beta affecting the SafeTensorIndex.loadWeights function in SafeTensorIndex.java. The vulnerability allows for path traversal via manipulation of the weightmap argument, making it susceptible to remote attacks. An exploit has been publicly disclosed and the project has not yet responded to an early issue report. This vulnerability matters to people building or operating AI agents using tjake Jlama as it may allow unauthorized access to sensitive data or system resources.
-
A remote code execution (RCE) vulnerability, CVE-2026-67544, was discovered in Heym's workflow engine prior to version 0.0.71. The vulnerability occurs when an authenticated user submits arbitrary Python code through the Playwright node's playwrightCode field, which is then executed directly by the backend process without sandboxing or validation. This allows for RCE on the backend host, potentially running as the root user in default Docker deployments. The issue has been patched in version 0.0.71.
-
A vulnerability, tracked as CVE-2026-67547, was discovered in the self-hosted AI agent OS taOS. In versions prior to 1.0.0-beta.23, the taOS API endpoint for executing built-in skills did not perform sufficient access controls, allowing any authenticated non-admin user to execute arbitrary Python code on the host system. This vulnerability enabled remote code execution without requiring admin privileges. The issue was addressed in version 1.0.0-beta.23.
-
A vulnerability, CVE-2026-67546, was identified in Heym's agentic systems and business-process automation infrastructure prior to version 0.0.75. An authenticated user with the lowest role could execute a malicious command on the shared backend host by exploiting the POST /api/mcp/fetch-tools endpoint, which accepts the stdio transport. This allowed the attacker to bypass normal protocol validation and execute arbitrary code, regardless of whether the command was intended to communicate via the MCP protocol. The issue has been patched in version 0.0.75, which adds role-based access controls to mitigate the vulnerability.
-
A security vulnerability was discovered in Heym, a system used for building and running agentic systems and business-process automations. Prior to version 0.0.73, Heym's HTTP workflow node made unvalidated outbound HTTP requests to user-specified URLs, allowing an unauthenticated attacker to exploit a Server-Side Request Forgery (SSRF) vulnerability. This was possible when a workflow targeting internal addresses was exposed with anonymous execution. The issue has been resolved in version 0.0.73, which adds validation for target host or IP addresses in the HTTP workflow node.
-
A security vulnerability, CVE-2026-67548, was discovered in the self-hosted AI agent OS, taOS, prior to version 1.0.0-beta.25. The vulnerability allowed any authenticated user to read and modify system configuration, platform settings, and trigger a service restart, potentially causing configuration corruption or a denial of service. This was possible due to the lack of admin authorization dependency for APIRouter instance creation. The issue has been addressed in version 1.0.0-beta.25, and users are advised to update to this version to ensure system security. This vulnerability matters for developers and operators of AI agents as it highlights the importance of proper authorization and access control in AI agent management systems.
-
An authentication vulnerability was discovered in the Heym system, allowing non-admin team members to add attacker accounts to teams, grant them access to credentials, and decrypt sensitive data such as API keys and OAuth tokens. This was possible due to a flawed access control mechanism that relied solely on team membership rather than the team creator/admin role. The vulnerability has been patched in version 0.0.70, which enforces stricter access controls and adds a role column to the TeamMember entity.
-
A security vulnerability was discovered in the Heym system prior to version 0.0.70. The issue allowed authenticated users with the lowest role to access the POST /api/mcp/fetch-tools endpoint, which could be used to fetch an attacker-supplied URL through the SSE and Streamable HTTP transports without any security restrictions. This allowed an attacker to perform a server-side request forgery (SSRF) attack, which can be used to access private IP addresses and potentially compromise the system. The vulnerability was patched in version 0.0.70, which restricts access to the endpoint to users with higher roles and adds security restrictions to prevent SSRF attacks.
-
A vulnerability (CVE-2026-67543) was discovered in Heym, an agentic system and business-process automation platform, prior to version 0.0.70. The issue allowed untrusted code to escape the intended Docker sandbox and execute with host root privileges due to inadequate isolation. Specifically, the skill executor skillpythonexecutor.py ran untrusted code in a local subprocess with excessive filesystem and network access, and mounted the Docker socket as root. This allowed an attacker to potentially exploit the vulnerability and gain root access on the host system. The issue has been patched in version 0.0.70 of Heym.
-
CVE-2026-67540 is a vulnerability in Heym, a system used for building and running agentic systems and business-process automations. Prior to version 0.0.70, authenticated users could access and use private workflow and node templates from other tenants by exploiting a lack of visibility and access control checks. This allowed unauthorized access to sensitive data, including full node/edge graphs and shared email addresses. The vulnerability has been patched in version 0.0.70, which enforces visibility and access controls correctly. This issue matters to people building or operating AI agents as it highlights the importance of robust access control and visibility checks in agentic systems to prevent unauthorized data access and potential security breaches.
-
A vulnerability (CVE-2026-126767) was found in OpsTree REMS versions up to 1.0.0, affecting its chat assistant feature. The vulnerability, a prompt injection issue, allows authenticated users to access the system's internal prompt by submitting specially crafted chat input to the /api/v1/rca/chat endpoint. This enables attackers to bypass the assistant's rules and obtain sensitive orchestration instructions, facilitating further prompt injection attacks. This matters to AI developers and operators as it compromises the security of the chat assistant, potentially allowing malicious users to manipulate the system and gain unauthorized access to internal information.
-
LLM 0.37.2 fixes a security vulnerability reported by Daniel de Araujo. The issue arises from the extra-openai-models.yaml mechanism, which is now managed by the new "llm openai endpoint add" command. This mechanism allows using LLM with OpenAI-compatible API endpoints from other providers. However, Daniel's report highlighted two scenarios where the configured OpenAI API key could be accidentally sent to one of those providers: if the key had never been stored, or if a responses:true model was run with -o chat_completions 1. The update addresses these concerns, enhancing security for developers and operators of AI agents.
-
A remote code execution vulnerability in Visual Studio allows an unauthorized attacker to execute code over a network due to deserialization of untrusted data. This vulnerability affects the security of agents and AI-powered tools that rely on Visual Studio.
-
A vulnerability (CVE-2026-96437) was identified in the ai-azure-content-safety plugin for Kong Gateway Enterprise. The plugin fails to inspect request bodies larger than its in-memory buffer, allowing attackers to bypass input content-safety checks. This enables malicious requests to evade detection. The vulnerability affects users who rely on the plugin for content safety and security in their Kong Gateway deployments.
-
ASP.NET Core has a vulnerability (CVE-2026-114150) that allows attackers to disclose information over a network through an uninitialized resource. This could impact AI agents and applications built on ASP.NET Core.
-
A remote code execution vulnerability was identified in GitHub Copilot, a code completion tool integrated into JetBrains products, allowing authorized attackers to disclose sensitive information locally. The vulnerability, CVE-2026-83953, arises from improper neutralization of special elements in user input, enabling command injection attacks. This issue matters to developers and operators of AI-powered tools as it could potentially expose confidential project information, code snippets, and other sensitive data. To mitigate this vulnerability, users are advised to update their JetBrains products to the latest version, which includes a patch to address the issue.
-
A vulnerability was discovered in the Microsoft 365 Agents SDK, identified as CVE-2026-109485. The issue is a server-side request forgery (SSRF) bug that enables an authorized attacker to disclose information over a network. This vulnerability allows an attacker with access to the affected system to make unauthorized requests on behalf of the system, potentially leading to sensitive information exposure. The bug affects the Microsoft 365 Agents SDK, which is used by developers to integrate Microsoft services into their applications. This vulnerability matters to developers and operators of AI agents as it may compromise the security and integrity of their systems if not addressed promptly.
-
Microsoft MCP Gateway vulnerability CVE-2026-109492 allows an authorized attacker to bypass authorization controls via a user-controlled key, enabling elevation of privileges across a network. This vulnerability affects systems utilizing the MCP Gateway, which is a component of various Microsoft products and services. The issue arises when an attacker can manipulate a user-controlled key, permitting unauthorized access to elevated privileges. This security flaw matters to AI agents and their developers because it compromises the integrity of systems that rely on MCP Gateway, potentially enabling malicious actors to manipulate or disrupt AI-driven operations. Remediation is required to prevent exploitation of this vulnerability, which could have significant consequences for AI systems utilizing the affected software.
-
A vulnerability (CVE-2026-112137) has been discovered in Mendix Studio Pro 11, affecting versions 11.15.0 to 11.12.6 and 11.12.7. The issue arises from the MCP Server's failure to properly validate Content-Type and Origin headers in HTTP requests, making it susceptible to Cross-Site Request Forgery (CSRF). This vulnerability allows a malicious webpage to trick a user's browser into sending unauthorized requests, potentially executing unintended actions on the local MCP Server.
-
A vulnerability (CVE-2026-112136) was identified in Mendix Studio Pro 11, affecting versions 11.12.6 and 11.12.7, as well as all versions up to 11.15.0. The issue arises from the MCP Server's HTTP listener not properly restricting access to the loopback interface, potentially allowing remote systems to interact with the server. This exposes the server to unauthorized access and increases the risk of a successful attack. Developers and operators should update to a fixed version of Mendix Studio Pro 11 to mitigate this vulnerability.
-
A vulnerability, identified as CVE-2026-124503, was found in sooperset mcp-atlassian versions up to 0.24.0. The issue arises from the function validatesafepath in file src/mcpatlassian/utils/io.py, where a path traversal vulnerability allows remote attacks. The exploitation of this vulnerability is publicly available, and upgrading to version 0.24.1 can mitigate the issue. Developers should update the affected component to the latest version to prevent potential attacks.
-
A vulnerability (CVE-2026-124503) was discovered in the sooperset mcp-atlassian library up to version 0.24.0. The issue arises from the `validatesafepath` function in `src/mcpatlassian/utils/io.py`, which can be manipulated to enable path traversal attacks via the `path` argument. This vulnerability can be exploited remotely, and an exploit is publicly available. To mitigate this issue, users should upgrade to version 0.24.1 of the library, which addresses the vulnerability. Developers building and operating AI agents using this library should prioritize the upgrade to prevent potential security risks.
-
A vulnerability (CVE-2026-124503) was identified in the sooperset mcp-atlassian library, affecting versions up to 0.24.0. The issue arises from a path traversal vulnerability in the validate_safe_path function in src/mcp-atlassian/utils/io.py, making it susceptible to remote attacks. An exploit is publicly available, and upgrading to version 0.24.1 is recommended to mitigate this issue.
-
A vulnerability was discovered in the agentmemory module of the SAP Cloud SDK for Python prior to version 0.50.0. The module fails to properly validate the tenant parameter, allowing an attacker to manipulate the filesystem path and access another tenant's secrets. This can occur when a malicious tenant ID contains path traversal sequences, enabling unauthorized access to sensitive credentials such as OAuth client IDs and client secrets.
-
A path traversal vulnerability was discovered in the agentmemory module of SAP Cloud SDK for Python, affecting versions prior to 0.50.0. The vulnerability occurs when the createclienttenant parameter is not validated, allowing an attacker to construct a malicious path that escapes the intended directory and accesses another tenant's secrets. This could lead to unauthorized access to sensitive credentials, including OAuth client IDs and client secrets, between tenants. The vulnerability is significant for developers and operators of AI agents that use the SAP Cloud SDK for Python, as it poses a risk to the security of sensitive data and credentials.
-
A vulnerability (CVE-2026-120012) was discovered in the SAP Cloud SDK for AI (JavaScript), specifically in its Node.js implementation. The issue arises when sensitive authentication credentials are inadvertently included in error messages generated during certain internal operations under specific failure conditions. An attacker can obtain these credentials from application logs or error output, but requires a low-privilege user account and a suitable failure event triggered by a higher-privileged user. Exploitation is complex due to the limited lifetime of the token. Successful exploitation could allow an attacker to reuse the credentials, impacting confidentiality, integrity, and availability of the associated SAP service.
-
A vulnerability (CVE-2026-120012) was discovered in the SAP Cloud SDK for AI (JavaScript), allowing an attacker to obtain sensitive authentication credentials from error messages generated under specific conditions. This occurs when a low-privileged user accesses logs or forwarded error output after a failure event triggered by a higher-privileged user. The attacker must wait for the token's limited lifetime to exploit the vulnerability, which could result in a high impact on confidentiality, integrity, and availability. This vulnerability matters to AI developers and operators as it may allow unauthorized access to sensitive credentials, compromising system security and potentially leading to data breaches or service disruptions.
-
A vulnerability (CVE-2026-125397) exists in NocoBase plugin-ai versions 2.1.0 through 2.2.41 due to an authorization bypass in the getAccessibleAIEmployee function. This allows authenticated users to access unassigned AI employees by manipulating the role-derived filter with a supplied username. Attackers can exploit this vulnerability to run ungranted AI employees with elevated permissions and read sensitive data, such as prompts and tool configurations. This matters to people building or operating AI agents as it enables unauthorized access to potentially sensitive AI resources, potentially leading to data breaches or unauthorized AI activity.
-
A vulnerability was discovered in NocoBase plugin-ai versions 2.1.0 through 2.2.41, where an authenticated user can bypass authorization checks to access AI employees not assigned to them. This is due to the getAccessibleAIEmployee function not properly filtering by role. An attacker can exploit this vulnerability using the dispatch-sub-agent-task tool to execute unauthorized AI employees and the get-ai-employee tool to read sensitive data, such as prompts and tool configurations. This matters to AI developers and operators as it allows unauthorized access to AI employees and their associated data, potentially leading to data breaches or system compromise.
-
CVE-2026-125386 is a security vulnerability in langchain4j-aideepin, a Java-based library for AI development, affecting versions up to 3.32.0. The flaw is an Insecure Direct Object Reference (IDOR) vulnerability in the CharacterMessageController, allowing authenticated users to access other users' message references through the knowledge-embedding-ref, memory-embedding-ref, or graph-ref endpoints by supplying a different user's message UUID. This allows attackers to obtain sensitive information such as knowledge-base chunks, long-term memory text, and knowledge-graph data. This vulnerability matters to developers and operators of AI agents using langchain4j-aideepin, as it enables unauthorized access to sensitive data, potentially compromising model performance and user trust.
-
A vulnerability (CVE-2026-119613) was identified in Ash-project Ashai. The bug allows an attacker to retrieve internal error details, including module names and data values, by inducing a tool call failure. The error information, including potentially sensitive data, is not logged and is instead sent to clients and the model. The fix for this issue logs error messages with a unique ID and returns only the ID to the caller, preventing sensitive information exposure. This issue affects Ashai versions 1.5.0 and earlier.
-
A vulnerability (CVE-2026-119613) was found in the ash-project ashai tool. It allows an attacker to read sensitive information by causing a tool call to fail, resulting in internal error details being returned. This included module names and data values. The fix logs these errors with a unique ID and returns only the ID to the caller, preventing sensitive information disclosure. Affected versions are ashai 1.5.0 and earlier, with a fixed version of 1.5.1.
-
OpenAI introduced Control Room, a central system for tracking and stopping model workloads across their research infrastructure. This system allows for real-time monitoring of model activity, enabling rapid intervention when safety or security concerns arise. Control Room provides visibility into model performance, resource utilization, and error rates, empowering OpenAI engineers to identify and address potential issues promptly. By streamlining the process of tracking and stopping model workloads, Control Room enhances the safety and security of OpenAI's research infrastructure, mitigating the risk of unintended model behavior. This development is relevant to developers and operators of AI agents, as it highlights the importance of robust monitoring and control mechanisms in ensuring the safe and responsible deployment of AI systems.
-
A security vulnerability, identified as CVE-2026-124588, has been discovered in Hugging Face's finetrainers version 0.1.0 and 0.2.0. The issue arises in the Model Index Handler's resolve_component_cls function within the finetrainers/utils/model.py file. An attacker can inject code by manipulating the Library argument, allowing for remote code execution. A publicly available exploit exists, and the project has not yet responded to the issue report. This vulnerability matters to those building or operating AI agents using finetrainers, as it may be exploited by attackers, potentially compromising system security and integrity.
-
A security vulnerability (CVE-2026-124588) was discovered in Hugging Face's Finetruners versions 0.1.0 and 0.2.0. The issue arises from a code injection vulnerability in the `resolve_component_cls` function within `finetrainers/utils/model.py`. An attacker can exploit this flaw by manipulating the `Library` argument, which can be done remotely. This allows for potential attacks. The vulnerability has been publicly disclosed and a possible exploit has been released.
-
A vulnerability was identified in elizaOS eliza 2.0.3-beta.7, specifically in the HTTP Server component's lifecycle/api-base-owner.ts file. The issue allows for remote information disclosure through an unknown function. An exploit is publicly available and can be used to take advantage of the vulnerability. A patch (cf6fa193017e70884e01c5bb7890f74b6b2b79d2) is available to remediate the issue.
-
A vulnerability, identified as CVE-2026-124587, was discovered in elizaOS version 2.0.3-beta.7, specifically in the lifecycle/api-base-owner.ts file of the HTTP Server component. The issue allows for remote exploitation, resulting in information disclosure. An exploit is publicly available. Affected developers should apply the patch cf6fa193017e70884e01c5bb7890f74b6b2b79d2 to remediate the issue. This vulnerability affects the security of AI agents utilizing elizaOS, potentially compromising sensitive information.
-
A vulnerability was discovered in GPUStack, a GPU management and utilization platform, due to improper authentication. This allows unauthenticated users to perform administrative actions, including altering user and model settings, creating persistent administrator API keys, accessing worker and cloud-provider secrets, and executing code via the POST /v2/inference-backends/from-yaml endpoint. These actions can be performed remotely without requiring valid credentials. This vulnerability matters to people building or operating AI agents that utilize GPUStack, as it poses a significant risk of unauthorized access, data exposure, and system compromise.
-
A vulnerability was discovered in IBM Langflow OSS versions 1.0.0 to 1.12.2, allowing an authenticated flow author to write arbitrary files to any directory writable by the service account. This bypasses the platform's local file access isolation safeguard. Additionally, an attacker can read the contents of arbitrary files accessible to the service process through a crafted on-disk index, potentially exposing sensitive data such as configuration files, secrets, or database files stored under the application's data directory. This vulnerability matters to people building and operating AI agents as it allows an attacker to potentially access sensitive data, compromising system integrity and security.
-
A remote code execution vulnerability in IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 allows an authenticated attacker to cause a denial of service due to improper slug normalization, resulting in tool name collisions. This vulnerability is significant for developers building and operating AI agents that interact with the affected software, as it may lead to unintended behavior or system crashes. The issue is caused by a bug in the way the software handles URLs, which can be exploited by an attacker with valid authentication credentials. Developers should update to version 1.0.12 or later to mitigate this vulnerability.
-
IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 are vulnerable to a denial-of-service (DoS) attack due to improper slug normalization, where a remote authenticated attacker can cause a tool name collision, leading to a denial-of-service condition. This vulnerability is relevant to developers and operators of AI agents using IBM ContextForge MCP Gateway, as it may be used in conjunction with other AI tools, and a successful attack could disrupt the functionality of these agents, potentially causing operational disruptions or data loss.
-
A remote code execution vulnerability (CVE-2026-18484) was identified in IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11. The issue arises from improper slug normalization, which can cause tool name collisions. This allows a remote authenticated attacker to potentially cause a denial of service. Users of these affected versions should update to a fixed version to mitigate the vulnerability.
-
A vulnerability (CVE-2025-0166) was discovered in IBM WatsonX Orchestrate Cartridge, a component of Cloud Pak for Data. Affected versions include 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2. The issue allows unauthorized disclosure of sensitive source code information. This matters to people building or operating AI agents because it allows potential attackers to gain insight into the internal workings of the system, potentially enabling exploitation of the AI agent's vulnerabilities or reverse-engineering of its logic.
-
A critical vulnerability (CVE-2025-1837) has been identified in IBM Watsonx Orchestrate with Watsonx Assistant Cartridge, affecting versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2. The vulnerability allows an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods. This issue matters to developers and operators of AI agents that utilize Watsonx Orchestrate, as it enables a malicious actor to bypass security controls and potentially compromise the security and integrity of their AI systems.
-
IBM has released a security advisory (CVE-2025-0166) regarding multiple vulnerabilities in the Watsonx Orchestrate Cartridge for Cloud Pak for Data. Specifically, versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 are affected. These vulnerabilities can disclose sensitive source code information that should be inaccessible, potentially exposing confidential data. Affected users should update to a patched version of the Cartridge to mitigate the risk of exploitation. The update is crucial for developers and operators of AI agents that rely on the Watsonx Orchestrate Cartridge to prevent potential security breaches and maintain data confidentiality.
-
An ASP.NET Core Denial of Service (DoS) vulnerability allows an unauthorized attacker to deny service over a network due to a missing release of memory after effective lifetime.
-
A security vulnerability, identified as CVE-2026-123963, has been discovered in OpenBMB Internet of Agents up to version 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The vulnerability affects the 'register' function in the 'imserver/app.py' file of the 'Agent Registry' component, allowing attackers to bypass authentication through manipulation of the 'desc/name' argument. This can be exploited remotely. The vulnerability has been publicly disclosed, potentially enabling attackers to exploit it. The project has been notified, but has not yet responded or provided information on affected or unaffected versions due to its lack of versioning.
-
A vulnerability (CVE-2026-123964) was identified in OpenBMB Internet of Agents, affecting versions up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The vulnerability occurs in the launchgoal function of the Collaboration Layer's communicationlayer.py file, caused by manipulating the maxturns argument, resulting in an infinite loop that can be exploited remotely. The exploit is now publicly available, and users are advised to exercise caution. Since OpenBMB uses a rolling release model, specific version information is not provided.