Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,839 results · page 14 of 37
Apr 17, 2026Giskard is an open-source testing framework for AI models.CVE-2026-40320 · Other software · Giskard-AI · reported by GitHubMedium 5.4
Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template() constructor, silently interpreting template expressions at runtime. If check definitions are loaded from an untrusted source, a crafted rule string could achieve arbitrary code execution. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1.
- Product
- giskard-oss
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026Giskard is an open-source testing framework for AI models.CVE-2026-40319 · Other software · Giskard-AI · reported by GitHubLow 1
Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the RegexMatching check passes a user-supplied regular expression pattern directly to Python's re.search() without any timeout or complexity guard. A crafted regex pattern can trigger catastrophic backtracking, causing the process to hang indefinitely. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1.
- Product
- giskard-oss
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026mcp-framework is a framework for building Model Context Protocol (MCP) servers.CVE-2026-39313 · Other software · QuantGeekDev · reported by GitHubHigh 8.7
mcp-framework is a framework for building Model Context Protocol (MCP) servers. In versions 0.2.21 and below, the readRequestBody() function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never enforced in readRequestBody(). A remote unauthenticated attacker can crash any mcp-framework HTTP server by sending a single large POST request to /mcp, causing memory exhaustion and denial of service. This issue has been fixed in version 0.2.22.
- Product
- mcp-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 20263D viewer – Embed 3D Models: Missing AuthorizationCVE-2026-40729 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D viewer – Embed 3D Models: from n/a through <= 1.8.5.
- Product
- 3D viewer – Embed 3D Models
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update 3D viewer – Embed 3D Models to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2026mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management.CVE-2026-39884 · Other software · Flux159 · reported by GitHubHigh 8.3
mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior contain an argument injection vulnerability in the port_forward tool in src/tools/port_forward.ts, where a kubectl command is constructed via string concatenation with user-controlled input and then naively split on spaces before being passed to spawn(). Unlike all other tools in the codebase which correctly use array-based argument passing with execFileSync(), port_forward treats every space in user-controlled fields (namespace, resourceType, resourceName, localPort, targetPort) as an argument boundary, allowing an attacker to inject arbitrary kubectl flags. This enables exposure of internal Kubernetes services to the network by injecting --address=0.0.0.0, cross-namespace targeting by injecting additional -n flags, and indirect exploitation via prompt injection against AI agents connected to the MCP server. This issue has been fixed in version 3.5.0.
- Product
- mcp-server-kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration fCVE-2025-61260 · Other software · reported by MITRECritical 9.8
A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads project-local .env and .codex/config.toml files without requiring user confirmation, allowing attackers to embed arbitrary commands that execute immediately.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.checkpoint.comresearch.checkpoint.com
Apr 13, 2026A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialiCVE-2026-1462 · Other software · keras-team · reported by security@huntr.devHigh 7.8
A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `safe_mode=True`. This bypasses the security guarantees of `safe_mode` and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and the lack of validation in the `from_config()` method.
- Product
- keras-team/keras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026OpenClaw before 2026.3.24 contains an authorization bypass vulnerability in the HTTP /v1/models endpoint that fails to enforce operator read scope requirements.CVE-2026-35619 · Other software · OpenClaw · reported by VulnCheckMedium 5.3
OpenClaw before 2026.3.24 contains an authorization bypass vulnerability in the HTTP /v1/models endpoint that fails to enforce operator read scope requirements. Attackers with only operator.approvals scope can enumerate gateway model metadata through the HTTP compatibility route, bypassing the stricter WebSocket RPC authorization checks.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Apollo MCP Server is a Model Context Protocol server that exposes GraphQL operations as MCP tools.CVE-2026-35577 · Other software · apollographql · reported by GitHubMedium 6.8
Apollo MCP Server is a Model Context Protocol server that exposes GraphQL operations as MCP tools. Prior to version 1.7.0, the Apollo MCP Server did not validate the Host header on incoming HTTP requests when using StreamableHTTP transport. In configurations where an HTTP-based MCP server is run on localhost without additional authentication or network-level controls, this could potentially allow a malicious website—visited by a user running the server locally—to use DNS rebinding techniques to bypass same-origin policy restrictions and issue requests to the local MCP server. If successfully exploited, this could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the local user. This issue is limited to HTTP-based transport modes (StreamableHTTP). It does not affect servers using stdio transport. The practical risk is further reduced in deployments that use authentication, network-level access controls, or are not bound to localhost. This vulnerability is fixed in 1.7.0.
- Product
- apollo-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026n8n-MCP is a Model Context Protocol (MCP) server that provides AI assistants with comprehensive access to n8n node documentation, properties, and operations.CVE-2026-39974 · Other software · czlonkowski · reported by GitHubHigh 8.5
n8n-MCP is a Model Context Protocol (MCP) server that provides AI assistants with comprehensive access to n8n node documentation, properties, and operations. Prior to 2.47.4, an authenticated Server-Side Request Forgery in n8n-mcp allows a caller holding a valid AUTH_TOKEN to cause the server to issue HTTP requests to arbitrary URLs supplied through multi-tenant HTTP headers. Response bodies are reflected back through JSON-RPC, so an attacker can read the contents of any URL the server can reach — including cloud instance metadata endpoints (AWS IMDS, GCP, Azure, Alibaba, Oracle), internal network services, and any other host the server process has network access to. The primary at-risk deployments are multi-tenant HTTP installations where more than one operator can present a valid AUTH_TOKEN, or where a token is shared with less-trusted clients. Single-tenant stdio deployments and HTTP deployments without multi-tenant headers are not affected. This vulnerability is fixed in 2.47.4.
- Product
- n8n-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP).CVE-2026-39885 · Other software · agentfront · reported by GitHubHigh 7.5
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing $ref values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the initialize() call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications. This vulnerability is fixed in 2.3.0.
- Product
- frontmcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients.CVE-2026-35568 · Other software · modelcontextprotocol · reported by GitHubHigh 7.6
MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a DNS rebinding vulnerability. This vulnerability allows an attacker to access a locally or network-private java-sdk MCP server via a victims browser that is either local, or network adjacent. This allows an attacker to make any tool call to the server as if they were a locally running MCP connected AI agent. This vulnerability is fixed in 1.0.0.
- Product
- java-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disclosure by uploading a model configuratioCVE-2026-24147 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 4.8
NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disclosure by uploading a model configuration. A successful exploit of this vulnerability may lead to information disclosure or denial of service.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Apr 7, 2026text-generation-webui is an open-source web interface for running Large Language Models.CVE-2026-35487 · Other software · oobabooga · reported by GitHubMedium 5.3
text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_prompt() allows reading any .txt file on the server filesystem. The file content is returned verbatim in the API response. This vulnerability is fixed in 4.3.
- Product
- text-generation-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026text-generation-webui is an open-source web interface for running Large Language Models.CVE-2026-35486 · Other software · oobabooga · reported by GitHubHigh 7.5
text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, he superbooga and superboogav2 RAG extensions fetch user-supplied URLs via requests.get() with zero validation — no scheme check, no IP filtering, no hostname allowlist. An attacker can access cloud metadata endpoints, steal IAM credentials, and probe internal services. The fetched content is exfiltrated through the RAG pipeline. This vulnerability is fixed in 4.3.
- Product
- text-generation-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026text-generation-webui is an open-source web interface for running Large Language Models.CVE-2026-35485 · Other software · oobabooga · reported by GitHubHigh 7.5
text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_grammar() allows reading any file on the server filesystem with no extension restriction. Gradio does not server-side validate dropdown values, so an attacker can POST directory traversal payloads (e.g., ../../../etc/passwd) via the API and receive the full file contents in the response. This vulnerability is fixed in 4.3.
- Product
- text-generation-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026text-generation-webui is an open-source web interface for running Large Language Models.CVE-2026-35484 · Other software · oobabooga · reported by GitHubMedium 5.3
text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_preset() allows reading any .yaml file on the server filesystem. The parsed YAML key-value pairs (including passwords, API keys, connection strings) are returned in the API response. This vulnerability is fixed in 4.3.
- Product
- text-generation-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026text-generation-webui is an open-source web interface for running Large Language Models.CVE-2026-35483 · Other software · oobabooga · reported by GitHubMedium 5.3
text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_template() allows reading files with .jinja, .jinja2, .yaml, or .yml extensions from anywhere on the server filesystem. For .jinja files the content is returned verbatim; for .yaml files a parsed key is extracted. This vulnerability is fixed in 4.3.
- Product
- text-generation-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts.CVE-2026-33866 · Other software · Mlflow · reported by cvd@cert.plMedium 5.3
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a user without permissions to a given experiment can directly query this endpoint and retrieve model artifacts they are not authorized to access. This issue affects MLflow version through 3.10.1
- Product
- Mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface.CVE-2026-33865 · Other software · Mlflow · reported by cvd@cert.plMedium 5.1
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim. This issue affects MLflow version through 3.10.1
- Product
- Mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026text-generation-webui is an open-source web interface for running Large Language Models.CVE-2026-35050 · Other software · oobabooga · reported by GitHubCritical 9.1
text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.1.1, users can save extention settings in "py" format and in the app root directory. This allows to overwrite python files, for instance the "download-model.py" file could be overwritten. Then, this python file can be triggered to get executed from "Model" menu when requesting to download a new model. This vulnerability is fixed in 4.1.1.
- Product
- text-generation-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2026-35044 · Other software · bentoml · reported by GitHubHigh 8.8
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the Dockerfile generation function generate_containerfile() in src/bentoml/_internal/container/generate.py uses an unsandboxed jinja2.Environment with the jinja2.ext.do extension to render user-provided dockerfile_template files. When a victim imports a malicious bento archive and runs bentoml containerize, attacker-controlled Jinja2 template code executes arbitrary Python directly on the host machine, bypassing all container isolation. This vulnerability is fixed in 1.4.38.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2026-35043 · Other software · bentoml · reported by GitHubHigh 7.8
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the cloud deployment path in src/bentoml/_internal/cloud/deployment.py was not included in the fix for CVE-2026-33744. Line 1648 interpolates system_packages directly into a shell command using an f-string without any quoting. The generated script is uploaded to BentoCloud as setup.sh and executed on the cloud build infrastructure during deployment, making this a remote code execution on the CI/CD tier. This vulnerability is fixed in 1.4.38.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026vLLM is an inference and serving engine for large language models (LLMs).CVE-2026-34756 · Other software · vllm-project · reported by GitHubMedium 6.5
vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the n parameter in the ChatCompletionRequest and CompletionRequest Pydantic models, an unauthenticated attacker can send a single HTTP request with an astronomically large n value. This completely blocks the Python asyncio event loop and causes immediate Out-Of-Memory crashes by allocating millions of request object copies in the heap before the request even reaches the scheduling queue. This vulnerability is fixed in 0.19.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026vLLM is an inference and serving engine for large language models (LLMs).CVE-2026-34755 · Other software · vllm-project · reported by GitHubMedium 6.5
vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19.0, the VideoMediaIO.load_base64() method at vllm/multimodal/media/video.py splits video/jpeg data URLs by comma to extract individual JPEG frames, but does not enforce a frame count limit. The num_frames parameter (default: 32), which is enforced by the load_bytes() code path, is completely bypassed in the video/jpeg base64 path. An attacker can send a single API request containing thousands of comma-separated base64-encoded JPEG frames, causing the server to decode all frames into memory and crash with OOM. This vulnerability is fixed in 0.19.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Apr 6, 2026vLLM is an inference and serving engine for large language models (LLMs).CVE-2026-34753 · Other software · vllm-project · reported by GitHubMedium 5.4
vLLM is an inference and serving engine for large language models (LLMs). From 0.16.0 to before 0.19.0, a server-side request forgery (SSRF) vulnerability in download_bytes_from_url allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain restrictions. This can be used to target internal services (e.g. cloud metadata endpoints or internal HTTP APIs) reachable from the vLLM host. This vulnerability is fixed in 0.19.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026vLLM is an inference and serving engine for large language models (LLMs).CVE-2026-34760 · Other software · vllm-project · reported by GitHubMedium 5.9
vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa defaults to using numpy.mean for mono downmixing (to_mono), while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results in inconsistency between audio heard by humans (e.g., through headphones/regular speakers) and audio processed by AI models (Which infra via Librosa, such as vllm, transformer). This issue has been patched in version 0.18.0.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026The Go MCP SDK used Go's standard encoding/json.CVE-2026-34742 · Other software · modelcontextprotocol · reported by GitHubHigh 7.6
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or SSEHandler, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. This issue has been patched in version 1.4.0.
- Product
- go-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-tCVE-2026-34526 · Other software · SillyTavern · reported by GitHubMedium 5
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, in src/endpoints/search.js, the hostname is checked against /^\d+\.\d+\.\d+\.\d+$/. This only matches literal dotted-quad IPv4 (e.g. 127.0.0.1, 10.0.0.1). It does not catch: localhost (hostname, not dotted-quad), [::1] (IPv6 loopback), and DNS names resolving to internal addresses (e.g. localtest.me -> 127.0.0.1). A separate port check (urlObj.port !== '') limits exploitation to services on default ports (80/443), making this lower severity than a fully unrestricted SSRF. This issue has been patched in version 1.17.0.
- Product
- SillyTavern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-tCVE-2026-34524 · Other software · SillyTavern · reported by GitHubHigh 8.3
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in chat endpoints allows an authenticated attacker to read and delete arbitrary files under their user data root (for example secrets.json and settings.json) by supplying avatar_url="..". This issue has been patched in version 1.17.0.
- Product
- SillyTavern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-tCVE-2026-34523 · Other software · SillyTavern · reported by GitHubMedium 5.3
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in the static file route handler allows any unauthenticated user to determine whether files exist anywhere on the server's filesystem. by sending percent-encoded "../" sequences (%2E%2E%2F) in requests to static file routes, an attacker can check for the existence of files. This issue has been patched in version 1.17.0.
- Product
- SillyTavern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-tCVE-2026-34522 · Other software · SillyTavern · reported by GitHubHigh 8.1
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in /api/chats/import allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into character_name. This issue has been patched in version 1.17.0.
- Product
- SillyTavern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary PythCVE-2026-35002 · Other software · Agno · reported by VulnCheckCritical 9.3
Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.
- Product
- Agno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026llama.cpp is an inference of several LLM models in C/C++.CVE-2026-34159 · Other software · ggml-org · reported by GitHubCritical 9.8
llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backend's deserialize_tensor() skips all bounds validation when a tensor's buffer field is 0. An unauthenticated attacker can read and write arbitrary process memory via crafted GRAPH_COMPUTE messages. Combined with pointer leaks from ALLOC_BUFFER/BUFFER_GET_BASE, this gives full ASLR bypass and remote code execution. No authentication required, just TCP access to the RPC server port. This issue has been patched in version b8492.
- Product
- llama.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker.CVE-2026-33990 · Other software · docker · reported by GitHubMedium 6.8
Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Prior to version 1.1.25, Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model, Model Runner follows the realm URL from the registry's WWW-Authenticate header without validating the scheme, hostname, or IP range. A malicious OCI registry can set the realm to an internal URL (e.g., http://127.0.0.1:3000/), causing Model Runner running on the host to make arbitrary GET requests to internal services and reflect the full response body back to the caller. Additionally, the token exchange mechanism can relay data from internal services back to the attacker-controlled registry via the Authorization: Bearer header. This issue has been patched in version 1.1.25. For Docker Desktop users, enabling Enhanced Container Isolation (ECI) blocks container access to Model Runner, preventing exploitation. However, if the Docker Model Runner is exposed to localhost over TCP in specific configurations, the vulnerability is still exploitable.
- Product
- model-runner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients.CVE-2026-34237 · Other software · modelcontextprotocol · reported by GitHubMedium 6.1
MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.
- Product
- java-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`.CVE-2026-0596 · Other software · mlflow · reported by security@huntr.devHigh 7.8
A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shell metacharacters, such as `$()` or backticks, it allows for command substitution and execution of attacker-controlled commands. This vulnerability affects the latest version of mlflow/mlflow and can lead to privilege escalation if a higher-privileged service serves models from a directory writable by lower-privileged users.
- Product
- mlflow/mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable fiCVE-2026-21715 · Other software · nodejs · reported by support@hackerone.comLow 3.3
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all compaCVE-2026-21711 · Other software · nodejs · reported by support@hackerone.comMedium 5.3
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` funCVE-2025-15379 · Other software · mlflow · reported by security@huntr.devCritical 10
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.2.
- Product
- mlflow/mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/KCVE-2026-33980 · Other software · pab1it0 · reported by GitHubHigh 8.3
Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases through standardized interfaces. Versions up to and including 0.1.1 contain KQL (Kusto Query Language) injection vulnerabilities in three MCP tool handlers: `get_table_schema`, `sample_table_data`, and `get_table_details`. The `table_name` parameter is interpolated directly into KQL queries via f-strings without any validation or sanitization, allowing an attacker (or a prompt-injected AI agent) to execute arbitrary KQL queries against the Azure Data Explorer cluster. Commit 0abe0ee55279e111281076393e5e966335fffd30 patches the issue.
- Product
- adx-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients.CVE-2026-33946 · Other software · modelcontextprotocol · reported by GitHubHigh 8.2
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data. Version 0.9.2 contains a patch.
- Product
- ruby-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and evaluation of medical imaging AI models across heaCVE-2026-33879 · Other software · londonaicentre · reported by GitHubLow 2.7
Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and evaluation of medical imaging AI models across healthcare institutions. The FLIP login page in versions 0.1.1 and prior has no rate limiting or CAPTCHA, enabling brute-force and credential-stuffing attacks. FLIP users are external to the organization, increasing credential reuse risk. As of time of publication, it is unclear if a patch is available.
- Product
- FLIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages CVE-2026-22742 · Other software · Spring · reported by security@vmware.comHigh 8.6
Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows an attacker to induce the server to issue HTTP requests to unintended internal or external destinations. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.
- Product
- Spring AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2026-33744 · Other software · bentoml · reported by GitHubHigh 7.8
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the `docker.system_packages` field in `bentofile.yaml` accepts arbitrary strings that are interpolated directly into Dockerfile `RUN` commands without sanitization. Since `system_packages` is semantically a list of OS package names (data), users do not expect values to be interpreted as shell commands. A malicious `bentofile.yaml` achieves arbitrary command execution during `bentoml containerize` / `docker build`. Version 1.4.37 fixes the issue.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026vLLM is an inference and serving engine for large language models (LLMs).CVE-2026-27893 · Other software · vllm-project · reported by GitHubHigh 8.8
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust. Version 0.18.0 patches the issue.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbitrCVE-2025-15101 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.6
An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbitrary system commands via a crafted parameter. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe deserialization by proviCVE-2026-24141 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe deserialization by providing a specially crafted input file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
- Product
- NVIDIA Model Optimizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Mar 23, 2026llama.cpp is an inference of several LLM models in C/C++.CVE-2026-33298 · Other software · ggml-org · reported by GitHubHigh 7.8
llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the `ggml_nbytes` function allows an attacker to bypass memory validation by crafting a GGUF file with specific tensor dimensions. This causes `ggml_nbytes` to return a significantly smaller size than required (e.g., 4MB instead of Exabytes), leading to a heap-based buffer overflow when the application subsequently processes the tensor. This vulnerability allows potential Remote Code Execution (RCE) via memory corruption. b7824 contains a fix.
- Product
- llama.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface.CVE-2026-33286 · Other software · graphiti-api · reported by GitHubCritical 9.1
Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execution vulnerability that affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary relationship names to invoke any public method on the underlying model instance, class or its associations. Any application exposing Graphiti write endpoints (create/update/delete) to untrusted users is affected. The `Graphiti::Util::ValidationResponse#all_valid?` method recursively calls `model.send(name)` using relationship names taken directly from user-supplied JSONAPI payloads, without validating them against the resource's configured sideloads. This allows an attacker to potentially run any public method on a given model instance, on the instance class or associated instances or classes, including destructive operations. This is patched in Graphiti v1.10.2. Users should upgrade as soon as possible. Some workarounds are available. Ensure Graphiti write endpoints (create/update) are not accessible to untrusted users and/or apply strong authentication and authorization checks before any w
- Product
- graphiti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.