Disclosed
DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation
Medium severity advisory GHSA-j656-3hf2-fvjc affecting @bytebase/dbhub. Patched in @bytebase/dbhub 0.22.6.
GHSA-j656-3hf2-fvjcAffects @bytebase/dbhub (npm)
The AI security desk
AI vulnerabilities.
Before they reach you.
Reviewed advisories, actively exploited CVEs, and reported incidents for AI frameworks, agents, MCP servers, inference stacks, coding tools, and model providers, including compromises that never get a CVE. Severity, affected packages, and a source you can check.
Saved snapshot: 11/2/2026, 8:12:51 PM UTC. Checking for updates…
100 advisories & incidents · newest first
Reported
Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers
The Hacker News reported a security matter involving Langflow on 2026-11-02 (vulnerability, flaw, flaws). No CVE is referenced; verify with the vendor before acting.
Affects Langflow
Reported
New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value
The Hacker News reported a security matter involving Claude, Gemini, Kimi on 2026-11-02 (malware, infostealer). No CVE is referenced; verify with the vendor before acting.
Affects Claude, Gemini, Kimi
Reported
Backporting security fixes at scale with Codex
Trail of Bits blog reported a security matter involving Codex, OpenAI on 2026-11-02 (vulnerability, vulnerabilities, flaw). Tracks CVE-2026-98432.
CVE-2026-98432Affects Codex, OpenAI
Reported
Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines
StepSecurity blog reported a security matter involving Claude Code, Cursor on 2026-11-01 (backdoor). No CVE is referenced; verify with the vendor before acting.
Affects Claude Code, Cursor
Reported
A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
The Hacker News reported a security matter involving ChatGPT, OpenAI on 2026-10-31 (flaw, malicious). No CVE is referenced; verify with the vendor before acting.
Affects ChatGPT, OpenAI
Disclosed
@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
High severity advisory GHSA-j63v-mwhm-56jx (CVE-2026-118763) affecting @sigstore/oci. Patched in @sigstore/oci 0.7.2.
GHSA-j63v-mwhm-56jx · CVE-2026-118763Affects @sigstore/oci (npm)
Reported
Anthropic: That Claude Code extension compromise… couldn't be us
The Register security reported a security matter involving Claude Code, Anthropic, Cursor on 2026-10-30 (flaw, backdoor, malicious). No CVE is referenced; verify with the vendor before acting.
Affects Claude Code, Anthropic, Cursor
Reported
Malicious Claude Code extension on Cursor planted SSH backdoors
BleepingComputer reported a security matter involving Claude Code, Cursor, Anthropic on 2026-10-30 (malicious, malware). No CVE is referenced; verify with the vendor before acting.
Affects Claude Code, Cursor, Anthropic
Reported
Compromised Claude Code extensions (versions 2.1.312 & 2.1.313) in Cursor try to install a backdoor
OX Security research reported a security matter involving Claude Code, Cursor, Anthropic on 2026-10-30 (vulnerability, backdoor, malicious). No CVE is referenced; verify with the vendor before acting.
Affects Claude Code, Cursor, Anthropic
Reported
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
The Hacker News reported a security matter involving Claude Code, Cursor, Anthropic on 2026-10-30 (backdoor, malicious). No CVE is referenced; verify with the vendor before acting.
Affects Claude Code, Cursor, Anthropic
Disclosed
PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox
High severity advisory GHSA-26mh-57q7-jfvr (CVE-2026-61438) affecting praisonai. Patched in praisonai 4.6.78.
GHSA-26mh-57q7-jfvr · CVE-2026-61438Affects praisonai (pip)
Disclosed
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy
High severity advisory GHSA-w9x9-j56r-h98r affecting @eeacms/volto-chatbot. Patched in @eeacms/volto-chatbot 2.0.4.
GHSA-w9x9-j56r-h98rAffects @eeacms/volto-chatbot (npm)
Reported
Claude Model Builds Exploits Across Major Browsers & OSes
Dark Reading reported a security matter involving Claude on 2026-10-29 (exploits). No CVE is referenced; verify with the vendor before acting.
Affects Claude
Reported
Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
The Hacker News reported a security matter involving Claude, ChatGPT, Anthropic, OpenAI and 1 more on 2026-10-29 (malicious, malware). No CVE is referenced; verify with the vendor before acting.
Affects Claude, ChatGPT, Anthropic, OpenAI, GPT-5
Reported
Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched
The Register security reported a security matter involving OpenAI, Claude Desktop, Anthropic, Codex and 2 more on 2026-10-29 (vulnerability, vulnerabilities, flaw). No CVE is referenced; verify with the vendor before acting.
Affects OpenAI, Claude Desktop, Anthropic, Codex, GitHub Copilot, Cursor
Reported
Cohere’s Qwen Story: Looks More Like Model Jaggedness
Check Point Research reported a security matter involving Qwen, vLLM on 2026-10-29 (backdoor). No CVE is referenced; verify with the vendor before acting.
Affects Qwen, vLLM
Reported
Hugging Face malware campaign returns to hijack GPUs for crypto mining
BleepingComputer reported a security matter involving Hugging Face on 2026-10-29 (malware, hijack). No CVE is referenced; verify with the vendor before acting.
Affects Hugging Face
Reported
Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities
The Hacker News reported a security matter involving Gemini on 2026-10-29 (vulnerabilities, exploitation). No CVE is referenced; verify with the vendor before acting.
Affects Gemini
Reported
Malicious code in litellm (PyPI)
OSV lists litellm (pypi) as malicious in MAL-2026-2144, versions 1.82.7, 1.82.8, 1.107.0. Remove or pin away from the affected versions.
MAL-2026-2144Affects litellm (pypi)
Disclosed
LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests
Medium severity advisory GHSA-3fx2-cqw9-xr3c (CVE-2026-118667) affecting langgraph-sdk, langgraph. Patched in langgraph-sdk 0.4.6.
GHSA-3fx2-cqw9-xr3c · CVE-2026-118667Affects langgraph-sdk (pip), langgraph (pip)
Disclosed
ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
Medium severity advisory GHSA-48m4-24cq-37qf (CVE-2026-115919) affecting onnx. Patched in onnx 1.22.0.
GHSA-48m4-24cq-37qf · CVE-2026-115919Affects onnx (pip)
Disclosed
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
Medium severity advisory GHSA-5324-3w58-qpp2 (CVE-2026-116575) affecting mem0ai. Patched in mem0ai 2.0.18.
GHSA-5324-3w58-qpp2 · CVE-2026-116575Affects mem0ai (pip), mem0ai (npm)
Disclosed
vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
Medium severity advisory GHSA-542m-9234-8gvf (CVE-2026-115911) affecting vllm. Patched in vllm 0.32.0.
GHSA-542m-9234-8gvf · CVE-2026-115911Affects vllm (pip)
Disclosed
vLLM: Public multimodal SHM handle forgery reaches worker-side pickle.loads() with insecure serialization disabled
High severity advisory GHSA-6757-hggm-hp2w (CVE-2026-115912) affecting vllm. Patched in vllm 0.32.0.
GHSA-6757-hggm-hp2w · CVE-2026-115912Affects vllm (pip)
Disclosed
ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
Medium severity advisory GHSA-6pwm-x34p-fvj2 (CVE-2026-115920) affecting onnx. Patched in onnx 1.22.0.
GHSA-6pwm-x34p-fvj2 · CVE-2026-115920Affects onnx (pip)
Disclosed
vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine
Medium severity advisory GHSA-8397-8qf6-f2gm (CVE-2026-115913) affecting vllm. Patched in vllm 0.32.0.
GHSA-8397-8qf6-f2gm · CVE-2026-115913Affects vllm (pip)
Disclosed
vLLM DeepSeek-OCR image processing vulnerable to denial of service
Medium severity advisory GHSA-gq5q-89c7-vhvx (CVE-2026-115914) affecting vllm. Patched in vllm 0.32.0.
GHSA-gq5q-89c7-vhvx · CVE-2026-115914Affects vllm (pip)
Disclosed
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
High severity advisory GHSA-h3rc-j82p-2c3h (CVE-2026-115915) affecting vllm. Patched in vllm 0.32.0.
GHSA-h3rc-j82p-2c3h · CVE-2026-115915Affects vllm (pip)
Disclosed
ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute
Medium severity advisory GHSA-m4pr-6v3c-6fgr (CVE-2026-115921) affecting onnx. Patched in onnx 1.22.0.
GHSA-m4pr-6v3c-6fgr · CVE-2026-115921Affects onnx (pip)
Disclosed
ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
Medium severity advisory GHSA-q69g-f4f5-v8m7 (CVE-2026-115922) affecting onnx. Patched in onnx 1.22.0.
GHSA-q69g-f4f5-v8m7 · CVE-2026-115922Affects onnx (pip)
Disclosed
vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
Medium severity advisory GHSA-q97c-p368-75c4 (CVE-2026-115916) affecting vllm. Patched in vllm 0.32.0.
GHSA-q97c-p368-75c4 · CVE-2026-115916Affects vllm (pip)
Disclosed
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
Low severity advisory GHSA-vvpg-rrww-wpmh (CVE-2026-115917) affecting vllm. Patched in vllm 0.32.0.
GHSA-vvpg-rrww-wpmh · CVE-2026-115917Affects vllm (pip)
Disclosed
vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
Medium severity advisory GHSA-x567-49g5-p4cf (CVE-2026-115918) affecting vllm. Patched in vllm 0.32.0.
GHSA-x567-49g5-p4cf · CVE-2026-115918Affects vllm (pip)
Reported
Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
The Hacker News reported a security matter involving Anthropic on 2026-10-28 (flaw, flaws, exploits). No CVE is referenced; verify with the vendor before acting.
Affects Anthropic
Disclosed
MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
Critical severity advisory GHSA-26p8-2jq9-3vq9 (CVE-2026-116692) affecting mlflow. Patched in mlflow 3.17.0.
GHSA-26p8-2jq9-3vq9 · CVE-2026-116692Affects mlflow (pip)
Disclosed
Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
Medium severity advisory GHSA-5h93-6whr-6q8j (CVE-2026-116685) affecting mcp. Patched in mcp 2.2.0.
GHSA-5h93-6whr-6q8j · CVE-2026-116685Affects mcp (pip), mcp (pip)
Disclosed
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
High severity advisory GHSA-7hp6-4w63-5g45 (CVE-2026-114612) affecting litellm. Patched in litellm 1.100.4.
GHSA-7hp6-4w63-5g45 · CVE-2026-114612Affects litellm (pip), litellm (pip), litellm (pip), litellm (pip), litellm (pip)
Disclosed
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
High severity advisory GHSA-f897-62hf-6gxq affecting @modelcontextprotocol/sdk, @modelcontextprotocol/server, @modelcontextprotocol/node, @modelcontextprotocol/hono. Patched in @modelcontextprotocol/sdk 1.30.1.
GHSA-f897-62hf-6gxqAffects @modelcontextprotocol/sdk (npm), @modelcontextprotocol/server (npm), @modelcontextprotocol/node (npm), @modelcontextprotocol/hono (npm)
Disclosed
vllm p2p never connected zmq_exhaustion
Medium severity advisory GHSA-frvg-qw88-hww9 (CVE-2026-94624) affecting vllm. Patched in vllm 0.32.0.
GHSA-frvg-qw88-hww9 · CVE-2026-94624Affects vllm (pip)
Disclosed
LiteLLM: internal_user_viewer arbitrary local file read via vertex_ai_credentials
High severity advisory GHSA-g5ff-637f-6q2m affecting litellm. Patched in litellm 1.95.0.
GHSA-g5ff-637f-6q2mAffects litellm (pip)
Disclosed
vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
High severity advisory GHSA-h3rc-6mm3-gc2m (CVE-2026-114053) affecting vllm. Patched in vllm 0.31.0.
GHSA-h3rc-6mm3-gc2m · CVE-2026-114053Affects vllm (pip)
Disclosed
LiteLLM vulnerable to reflected XSS in /sso/debug/callback
Medium severity advisory GHSA-hhww-mrg2-969h affecting litellm. Patched in litellm 1.85.0.
GHSA-hhww-mrg2-969hAffects litellm (pip)
Disclosed
MLflow CrewAI autologging records LLM provider API keys in logged trace spans
Medium severity advisory GHSA-j7qq-vr8c-xvw3 (CVE-2026-116691) affecting mlflow. Patched in mlflow 3.17.0.
GHSA-j7qq-vr8c-xvw3 · CVE-2026-116691Affects mlflow (pip)
Disclosed
Agno: Arbitrary code execution via eval() on field_type in FunctionCall
Critical severity advisory GHSA-m4w4-3r8h-jw98 (CVE-2026-35002) affecting agno. Patched in agno 2.3.24.
GHSA-m4w4-3r8h-jw98 · CVE-2026-35002Affects agno (pip)
Disclosed
MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source
High severity advisory GHSA-m65p-9j7q-6w33 (CVE-2026-116690) affecting mlflow. Patched in mlflow 3.17.0.
GHSA-m65p-9j7q-6w33 · CVE-2026-116690Affects mlflow (pip)
Disclosed
Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
Medium severity advisory GHSA-rwrf-2pqf-9j8j (CVE-2026-116686) affecting mcp. Patched in mcp 2.2.0.
GHSA-rwrf-2pqf-9j8j · CVE-2026-116686Affects mcp (pip), mcp (pip)
Disclosed
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
Medium severity advisory GHSA-w4fh-qvv9-3v23 (CVE-2026-116684) affecting mcp. Patched in mcp 2.2.0.
GHSA-w4fh-qvv9-3v23 · CVE-2026-116684Affects mcp (pip), mcp (pip)
Reported
Tricks from the Past deployed via signed ChatGPT and Claude binaries
Check Point Research reported a security matter involving Claude, ChatGPT, Anthropic, OpenAI and 1 more on 2026-10-27 (malicious, malware, poisoning). No CVE is referenced; verify with the vendor before acting.
Affects Claude, ChatGPT, Anthropic, OpenAI, GPT-5
Reported
OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections
The Hacker News reported a security matter involving OpenAI on 2026-10-27 (flaw). No CVE is referenced; verify with the vendor before acting.
Affects OpenAI
Reported
LiteLLM supply chain attack started with an exposed master key
The Register security reported a security matter involving LiteLLM, Anthropic, OpenAI on 2026-10-26 (malicious, trojan, infostealer). No CVE is referenced; verify with the vendor before acting.
Affects LiteLLM, Anthropic, OpenAI
Reported
Alibaba's Qwen AI caught trying to contact server in China
The Register security reported a security matter involving Qwen on 2026-10-26 (malicious, exfiltrate, poisoning). No CVE is referenced; verify with the vendor before acting.
Affects Qwen
Reported
Trumpets blare and skies part as AI hypefest culminates in Anthropic IPO filing
The Register security reported a security matter involving Anthropic, Claude on 2026-10-26 (vulnerabilities, malicious). No CVE is referenced; verify with the vendor before acting.
Affects Anthropic, Claude
Disclosed
MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
Medium severity advisory GHSA-2wqp-q3c6-ccj5 (CVE-2026-115886) affecting mlflow. Patched in mlflow 3.17.0.
GHSA-2wqp-q3c6-ccj5 · CVE-2026-115886Affects mlflow (pip)
Disclosed
FastMCP: Post-transform component authorization is skipped on direct calls
Medium severity advisory GHSA-7xgj-8392-5q4r affecting fastmcp, fastmcp-slim. Patched in fastmcp 3.4.10.
GHSA-7xgj-8392-5q4rAffects fastmcp (pip), fastmcp (pip), fastmcp-slim (pip), fastmcp-slim (pip)
Disclosed
vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)
High severity advisory GHSA-gx7p-2j49-hfq4 (CVE-2026-114055) affecting vllm. Patched in vllm 0.31.0.
GHSA-gx7p-2j49-hfq4 · CVE-2026-114055Affects vllm (pip)
Disclosed
vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine
Medium severity advisory GHSA-p92p-rxj5-7p2x (CVE-2026-114050) affecting vllm. Patched in vllm 0.31.0.
GHSA-p92p-rxj5-7p2x · CVE-2026-114050Affects vllm (pip)
Disclosed
FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server
Medium severity advisory GHSA-vqqp-x5qm-5qp4 affecting fastmcp, fastmcp-slim. Patched in fastmcp 4.1.2.
GHSA-vqqp-x5qm-5qp4Affects fastmcp (pip), fastmcp-slim (pip)
Reported
Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack
The Register security reported a security matter involving OpenAI, Hugging Face, Codex on 2026-10-23 (vulnerabilities, exploit, exploited). No CVE is referenced; verify with the vendor before acting.
Affects OpenAI, Hugging Face, Codex
Reported
CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server
AWS security bulletins reported a security matter involving Model Context Protocol on 2026-10-23 (security bulletin). Tracks CVE-2026-115845.
CVE-2026-115845Disclosed
Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization
High severity advisory GHSA-354v-3q48-cv69 (CVE-2026-114135) affecting jupyter-server. Patched in jupyter-server 2.6.0.
GHSA-354v-3q48-cv69 · CVE-2026-114135Affects jupyter-server (pip)
Disclosed
mem0ai Databricks vector store vulnerable to SQL injection
Critical severity advisory GHSA-7587-9684-52r6 (CVE-2026-115324) affecting mem0ai. Patched in mem0ai 1.0.8.
GHSA-7587-9684-52r6 · CVE-2026-115324Affects mem0ai (pip)
Disclosed
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
High severity advisory GHSA-pjvx-prjx-h659 (CVE-2026-114140) affecting nbconvert. Patched in nbconvert 7.17.2.
GHSA-pjvx-prjx-h659 · CVE-2026-114140Affects nbconvert (pip)
Reported
LiteLLM Compromised, Steals Credentials
Wiz blog reported a security matter involving LiteLLM on 2026-10-21 (malicious, compromised). No CVE is referenced; verify with the vendor before acting.
Affects LiteLLM
Reported
Compromised LiteLLM 1.107.0 on PyPI Ships a Credential Stealer and Code Loader
Mend.io blog reported a security matter involving LiteLLM, Claude, Codex, Copilot and 3 more on 2026-10-21 (malicious, compromised). No CVE is referenced; verify with the vendor before acting.
Affects LiteLLM, Claude, Codex, Copilot, Cursor, Windsurf, Gemini
Reported
LiteLLM supply chain attack hoovers up passwords and secrets
The Register security reported a security matter involving LiteLLM, Anthropic, OpenAI, Gemini on 2026-10-21 (malicious, malware, trojan). No CVE is referenced; verify with the vendor before acting.
Affects LiteLLM, Anthropic, OpenAI, Gemini
Reported
LiteLLM 1.107.0 Compromised With A RAT InfoStealer
OX Security research reported a security matter involving LiteLLM, Claude Code, GitHub Copilot, Cursor on 2026-10-21 (malicious, malware, trojan). No CVE is referenced; verify with the vendor before acting.
Affects LiteLLM, Claude Code, GitHub Copilot, Cursor
Reported
CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
AWS security bulletins reported a security matter involving SageMaker on 2026-10-21 (code execution, security bulletin). Tracks CVE-2026-112408.
CVE-2026-112408Affects SageMaker
Reported
Cloudflare links vulnerability discovery to defense with OpenAI
OpenAI news reported a security matter involving OpenAI, Codex on 2026-10-21 (vulnerability, vulnerabilities). No CVE is referenced; verify with the vendor before acting.
Affects OpenAI, Codex
Disclosed
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
High severity advisory GHSA-22jm-h49p-29qw (CVE-2026-111767) affecting @modelcontextprotocol/sdk. Patched in @modelcontextprotocol/sdk 1.32.0.
GHSA-22jm-h49p-29qw · CVE-2026-111767Affects @modelcontextprotocol/sdk (npm)
Disclosed
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
High severity advisory GHSA-46jr-4wx8-v453 (CVE-2026-111768) affecting @modelcontextprotocol/sdk, @modelcontextprotocol/server. Patched in @modelcontextprotocol/sdk 1.32.0.
GHSA-46jr-4wx8-v453 · CVE-2026-111768Affects @modelcontextprotocol/sdk (npm), @modelcontextprotocol/server (npm)
Disclosed
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
Medium severity advisory GHSA-6prh-2h8m-c8cw (CVE-2026-111769) affecting @modelcontextprotocol/sdk, @modelcontextprotocol/client. Patched in @modelcontextprotocol/sdk 1.32.0.
GHSA-6prh-2h8m-c8cw · CVE-2026-111769Affects @modelcontextprotocol/sdk (npm), @modelcontextprotocol/client (npm)
Disclosed
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
Medium severity advisory GHSA-rvq5-wwqv-78pq (CVE-2026-111771) affecting @modelcontextprotocol/sdk, @modelcontextprotocol/server, @modelcontextprotocol/express, @modelcontextprotocol/server-legacy. Patched in @modelcontextprotocol/sdk 1.32.0.
GHSA-rvq5-wwqv-78pq · CVE-2026-111771Affects @modelcontextprotocol/sdk (npm), @modelcontextprotocol/server (npm), @modelcontextprotocol/express (npm), @modelcontextprotocol/server-legacy (npm)
Disclosed
MLflow FileStore trace IDs allow path traversal and arbitrary file writes
High severity advisory GHSA-wqmh-qccw-pqwf (CVE-2026-53995) affecting mlflow. Patched in mlflow 3.17.2.
GHSA-wqmh-qccw-pqwf · CVE-2026-53995Affects mlflow (pip)
Reported
CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew
AWS security bulletins reported a security matter involving Kiro on 2026-10-20 (security bulletin). Tracks CVE-2026-112380.
CVE-2026-112380Affects Kiro
Disclosed
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
Medium severity advisory GHSA-84m7-p3x7-pcfv (CVE-2026-59951) affecting mcp. Patched in mcp 1.30.0.
GHSA-84m7-p3x7-pcfv · CVE-2026-59951Affects mcp (pip), mcp (pip)
Disclosed
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
Medium severity advisory GHSA-jwrc-gm9j-263p (CVE-2026-102832) affecting jupyterlab, notebook, jupyterlite-core. Patched in jupyterlab 4.6.4.
GHSA-jwrc-gm9j-263p · CVE-2026-102832Affects jupyterlab (pip), jupyterlab (pip), notebook (pip), jupyterlite-core (pip)
Disclosed
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
High severity advisory GHSA-pq7j-f95f-qfcv (CVE-2026-86063) affecting @anthropic-ai/claude-code. Patched in @anthropic-ai/claude-code 2.1.179.
GHSA-pq7j-f95f-qfcv · CVE-2026-86063Affects @anthropic-ai/claude-code (npm)
Reported
CVE-2026-110248 - Insertion of sensitive information into log files in Amazon SageMaker Python SDK
AWS security bulletins reported a security matter involving SageMaker on 2026-10-14 (security bulletin). Tracks CVE-2026-110248.
CVE-2026-110248Affects SageMaker
Reported
When LLM Gateways Go Wrong: Findings from LiteLLM
Check Point Research reported a security matter involving LiteLLM on 2026-10-13 (vulnerability, vulnerabilities, flaw). Tracks CVE-2026-35029, CVE-2026-59823.
CVE-2026-35029Affects LiteLLM
Reported
Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)
Embrace The Red reported a security matter involving Copilot on 2026-10-13 (vulnerability, remote code execution, code execution). Tracks CVE-2026-103572.
CVE-2026-103572Affects Copilot
Disclosed
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when include_content=False
Low severity advisory GHSA-3gh4-cghq-f8v4 (CVE-2026-107293) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.4.
GHSA-3gh4-cghq-f8v4 · CVE-2026-107293Affects pydantic-ai (pip), pydantic-ai (pip), pydantic-ai-slim (pip), pydantic-ai-slim (pip)
Disclosed
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when include_content=False
Low severity advisory GHSA-4x9p-g9wm-8q7f (CVE-2026-107291) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.6.
GHSA-4x9p-g9wm-8q7f · CVE-2026-107291Affects pydantic-ai (pip), pydantic-ai (pip), pydantic-ai-slim (pip), pydantic-ai-slim (pip)
Disclosed
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
High severity advisory GHSA-6fqq-452j-qhrp (CVE-2026-107286) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 2.53.0.
GHSA-6fqq-452j-qhrp · CVE-2026-107286Affects pydantic-ai (pip), pydantic-ai-slim (pip)
Disclosed
Pydantic AI: Event loop blocked by quadratic title extraction in web_fetch
Medium severity advisory GHSA-fpf4-vwcp-v4hp (CVE-2026-107290) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.6.
GHSA-fpf4-vwcp-v4hp · CVE-2026-107290Affects pydantic-ai (pip), pydantic-ai (pip), pydantic-ai-slim (pip), pydantic-ai-slim (pip)
Disclosed
Pydantic AI Web chat UI (Agent.to_web(), clai web): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat e
High severity advisory GHSA-h4xc-3qfq-jf93 (CVE-2026-107295) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.4.
GHSA-h4xc-3qfq-jf93 · CVE-2026-107295Affects pydantic-ai (pip), pydantic-ai (pip), pydantic-ai-slim (pip), pydantic-ai-slim (pip)
Disclosed
Pydantic AI Web chat UI (Agent.to_web(), clai web): the local chat endpoint does not validate the Host header
Medium severity advisory GHSA-q2xc-rrxj-58x9 (CVE-2026-107292) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.5.
GHSA-q2xc-rrxj-58x9 · CVE-2026-107292Affects pydantic-ai (pip), pydantic-ai (pip), pydantic-ai-slim (pip), pydantic-ai-slim (pip)
Disclosed
Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl
Medium severity advisory GHSA-v2xh-2vp8-57h8 (CVE-2026-107294) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.2.
GHSA-v2xh-2vp8-57h8 · CVE-2026-107294Affects pydantic-ai (pip), pydantic-ai (pip), pydantic-ai-slim (pip), pydantic-ai-slim (pip)
Disclosed
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
Medium severity advisory GHSA-v36g-jcw9-x7cw (CVE-2026-107287) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.7.
GHSA-v36g-jcw9-x7cw · CVE-2026-107287Affects pydantic-ai (pip), pydantic-ai (pip), pydantic-ai-slim (pip), pydantic-ai-slim (pip)
Disclosed
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
Medium severity advisory GHSA-vmxc-h2x2-jmf3 (CVE-2026-107289) affecting pydantic-ai, pydantic-ai-slim. Patched in pydantic-ai 1.107.6.
GHSA-vmxc-h2x2-jmf3 · CVE-2026-107289Affects pydantic-ai (pip), pydantic-ai (pip), pydantic-ai-slim (pip), pydantic-ai-slim (pip)
Reported
What RL Found Before Anthropic’s Midnight Blizzard Report
ReversingLabs blog reported a security matter involving Anthropic on 2026-10-08 (malware). No CVE is referenced; verify with the vendor before acting.
Affects Anthropic
Disclosed
Langflow: IP Spoofing Bypass via X-Forwarded-For Allowing Remote Configuration Write
High severity advisory GHSA-4f6c-2vvp-gw82 (CVE-2026-105741) affecting langflow. Patched in langflow 1.10.3.
GHSA-4f6c-2vvp-gw82 · CVE-2026-105741Affects langflow (pip)
Disclosed
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
High severity advisory GHSA-4hmc-cfm3-w43c (CVE-2026-105699) affecting langflow. Patched in langflow 1.9.1.
GHSA-4hmc-cfm3-w43c · CVE-2026-105699Affects langflow (pip)
Disclosed
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
Critical severity advisory GHSA-9gvv-qjj3-2p6g (CVE-2026-73483) affecting flowise, flowise-components. Patched in flowise 3.1.3.
GHSA-9gvv-qjj3-2p6g · CVE-2026-73483Affects flowise (npm), flowise-components (npm)
Disclosed
Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
Medium severity advisory GHSA-gh98-4phw-6fmw (CVE-2026-105698) affecting langflow, langflow-base. Patched in langflow 1.10.1.
GHSA-gh98-4phw-6fmw · CVE-2026-105698Affects langflow (pip), langflow-base (pip)
Disclosed
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
Critical severity advisory GHSA-w794-rj3p-xv45 (CVE-2026-105697) affecting langflow, langflow-base, lfx. Patched in langflow 1.10.3.
GHSA-w794-rj3p-xv45 · CVE-2026-105697Affects langflow (pip), langflow-base (pip), lfx (pip)
Disclosed
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
Critical severity advisory GHSA-w7x8-q2gp-5cgg (CVE-2026-73487) affecting flowise, flowise-components. Patched in flowise 3.1.3.
GHSA-w7x8-q2gp-5cgg · CVE-2026-73487Affects flowise (npm), flowise-components (npm)
Reported
CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS
AWS security bulletins reported a security matter involving Amazon Q on 2026-10-07 (security bulletin). Tracks CVE-2026-105811.
CVE-2026-105811Affects Amazon Q
Disclosed
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
High severity advisory GHSA-6qxp-vccf-f47h (CVE-2026-104850) affecting @modelcontextprotocol/sdk, @modelcontextprotocol/client. Patched in @modelcontextprotocol/sdk 1.31.0.
GHSA-6qxp-vccf-f47h · CVE-2026-104850Affects @modelcontextprotocol/sdk (npm), @modelcontextprotocol/client (npm)
Disclosed
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
Critical severity advisory GHSA-8qpj-27x8-pwpq (CVE-2026-10561) affecting langflow. Patched in langflow 1.10.1.
GHSA-8qpj-27x8-pwpq · CVE-2026-10561Affects langflow (pip)
No advisories match these filters. Try another severity or search.
Coverage & source health
Every 15 minutes we check two required databases, the reviewed GitHub Advisory Database and the CISA Known Exploited Vulnerabilities catalog, keeping advisories that affect a watchlist of AI packages or whose text describes AI systems. We also read 34 supplementary feeds: vendor status pages, release notes and security bulletins, security research and reporting, and OSV malicious-package records. A report becomes an incident only when its headline names a watchlisted product and the text carries security vocabulary, so compromises without a CVE (a trojanized extension, a poisoned PyPI release) still surface. Watchlist matching is conservative: this is not every vulnerability in every dependency you run.
- GitHub Advisory Database (required) · last successful check: 2026-11-02T20:12:51.521Z
- CISA Known Exploited Vulnerabilities (required) · last successful check: 2026-11-02T20:12:51.521Z
- Claude status history · last successful check: 2026-11-02T20:12:51.521Z
- Claude Code release notes · last successful check: 2026-11-02T20:12:51.521Z
- OpenAI Codex release notes · last successful check: 2026-11-02T20:12:51.521Z
- Gemini CLI release notes · last successful check: 2026-11-02T20:12:51.521Z
- OpenAI status history · last successful check: 2026-11-02T20:12:51.521Z
- OpenAI news · last successful check: 2026-11-02T20:12:51.521Z
- Cursor changelog · last successful check: 2026-11-02T20:12:51.521Z
- Ollama blog · last successful check: 2026-11-02T20:12:51.521Z
- Hugging Face blog · last successful check: 2026-11-02T20:12:51.521Z
- GitHub changelog · last successful check: 2026-11-02T20:12:51.521Z
- GitHub security blog · last successful check: 2026-11-02T20:12:51.521Z
- Google security blog · last successful check: 2026-11-02T20:12:51.521Z
- AWS security bulletins · last successful check: 2026-11-02T20:12:51.521Z
- The Hacker News · last successful check: 2026-11-02T20:12:51.521Z
- BleepingComputer · last successful check: 2026-11-02T20:12:51.521Z
- The Register security · last successful check: 2026-11-02T20:12:51.521Z
- Dark Reading · last successful check: 2026-11-02T20:12:51.521Z
- The Record · last successful check: 2026-11-02T20:12:51.521Z
- Krebs on Security · last successful check: 2026-11-02T20:12:51.521Z
- CISA news · last successful check: 2026-11-02T20:12:51.521Z
- OX Security research · last successful check: 2026-11-02T20:12:51.521Z
- StepSecurity blog · last successful check: 2026-11-02T20:12:51.521Z
- Embrace The Red · last successful check: 2026-11-02T20:12:51.521Z
- Trail of Bits blog · last successful check: 2026-11-02T20:12:51.521Z
- Wiz blog · last successful check: 2026-11-02T20:12:51.521Z
- Snyk blog · last successful check: 2026-11-02T20:12:51.521Z
- GitGuardian blog · last successful check: 2026-11-02T20:12:51.521Z
- ReversingLabs blog · last successful check: 2026-11-02T20:12:51.521Z
- Check Point Research · last successful check: 2026-11-02T20:12:51.521Z
- Palo Alto Unit 42 · last successful check: 2026-11-02T20:12:51.521Z
- Kaspersky Securelist · last successful check: 2026-11-02T20:12:51.521Z
- Mend.io blog · last successful check: 2026-11-02T20:12:51.521Z
- Checkmarx blog · last successful check: 2026-11-02T20:12:51.521Z
- OSV malicious packages (OpenSSF) · last successful check: 2026-11-02T20:12:51.521Z
Severity follows the GitHub advisory. CISA entries and incidents carry no severity score; CISA entries are confirmed as exploited in the wild, and incidents are reports to verify with the vendor. Supplementary feeds flap; the feed is marked degraded only when a required source fails or more than a fifth of the supplementary feeds do. Historical entries remain in the archive when a source withdraws them; always check the current advisory before acting.
Build your own alerts
One feed.
Your security workflow.
Free JSON and RSS. No account or API key.
Explore the API & copy an example →GET https://www.aidatahub.io/api/latest-security?severity=criticalGet advisories and incidents from the last seven UTC dates, filtered by severity or by type (?type=incident for reports without a CVE). See the API guide for copyable JavaScript, Python, and cURL examples.
Checks run every 15 minutes. The complete historical feed is also available for durable alerts.
Just want updates? Subscribe with RSS ↗