Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Oct 26, 2026Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted reCVE-2026-116843 · Other software · mistralai · reported by VulnCheckHigh 8.7
Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.
- Product
- mistral-vibe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substCVE-2026-109429 · Other software · mistralai · reported by VulnCheckHigh 8.7
Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as embedding a command substitution within a single-quoted variable and re-expanding it with the ${var@P} prompt-transform operator so bash's promptvars feature executes the hidden command at runtime while only the trailing allowlisted command is classified, resulting in silent arbitrary command execution with the privileges of the agent's terminal session.
- Product
- mistral-vibe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing CVE-2026-109428 · Other software · mistralai · reported by VulnCheckHigh 8.7
Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the _extract_commands() function of bash.py. Attackers can craft a command string where tree-sitter-bash extracts only an allowlisted prefix such as cd while bash joins the line continuation into a materially different and hidden command such as a curl request, causing resolve_permission to grant ALWAYS permission while bash executes unauthorized arbitrary commands.
- Product
- mistral-vibe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2026Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation.CVE-2026-93993 · Other software · mistralai · reported by VulnCheckHigh 8.6
Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.
- Product
- mistral-vibe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally alloweCVE-2026-87988 · Other software · mistralai · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cCritical 10
An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval.
- Product
- mistral-vibe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments precedinCVE-2026-87987 · Other software · mistralai · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cCritical 10
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.
- Product
- mistral-vibe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interCVE-2026-87986 · Other software · mistralai · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cCritical 10
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval.
- Product
- mistral-vibe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments.CVE-2026-87985 · Other software · mistralai · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cCritical 10
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval.
- Product
- mistral-vibe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspaceCVE-2026-87984 · Other software · mistralai · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cCritical 9.3
An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to write to arbitrary paths accessible to the Vibe process.
- Product
- mistral-vibe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute patCVE-2026-87983 · Other software · mistralai · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cCritical 9.2
An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace to be read without user approval.
- Product
- mistral-vibe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmoCVE-2026-67623 · Other software · mistralai · reported by VulnCheckHigh 8.6
Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim's full privileges when any vibe command is run inside that repository.
- Product
- mistral-vibe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.