Security advisories for vibe-coded apps · Updated · 13 new this week
Find the leak
before someone else does.
126 advisories across 41 AI tools: app builders, coding agents, MCP servers, models and LLM frameworks. Each one is tied to a CVE, a GitHub advisory, a vendor bulletin or published research.
Latest critical
All critical advisories → 01. 2026-10-17 · New
OpenCode Console breach exposed saved provider API keys
OpenCode said a breach of its hosted OpenCode Console affected 1.4% of Console users who had linked external providers. Their saved OpenAI and Anthropic keys may have been exposed, and Anthropic revoked Claude keys it believed were affected.
OpenCode · Anthropic Claude · OpenAI +1 02. 2026-10-16 · NewCVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands
Before 0.2.121, the Python Claude Agent SDK passed the resume session ID straight to the Claude CLI. A value starting with a dash became a CLI flag, so an attacker could inject an MCP server config and run commands.
Claude Code · MCP SDKs & servers 03. 2026-10-16 · NewCVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npx
DeepSeek Harness (dsh), DeepSeek's developer-preview agent harness, launches MCP servers by bare command name. Injected content can get the model to drop a fake executable into node_modules/.bin, which then runs every time that MCP server starts.
DeepSeek · MCP SDKs & serversCoverage
Six kinds of tool, one place to check.
01.
15 advisories · 6 tools02.
52 advisories · 12 tools03.
31 advisories · 2 tools04.
10 advisories · 7 tools05.
29 advisories · 11 tools06.
20 advisories · 3 tools
App builders
Prompt-to-app platforms that generate and host whole apps.
15 advisories · 6 tools02.IDEs & agents
AI code editors, coding agents and CLIs that read and write your repo.
52 advisories · 12 tools03.MCP
Model Context Protocol: the SDKs, servers and clients that wire tools into agents.
31 advisories · 2 tools04.Models & APIs
Foundation models and their APIs: prompt injection, jailbreaks and data leakage.
10 advisories · 7 tools05.LLM frameworks
Libraries and runtimes for building and serving LLM apps.
29 advisories · 11 tools06.Generated stack
The frameworks AI builders generate code for, where their bugs land in your app.
20 advisories · 3 toolsNew OpenCode Console breach exposed saved provider API keysNew CVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commandsNew CVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npxNew CVE-2026-88755: Z.ai ZCode starts MCP servers from a repo's config the moment you open itNew CVE-2026-111091: JetBrains Junie CLI ran code from an untrusted project’s MCP configNew CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningNew CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionNew CVE-2026-96889: Next.js image optimization RCE via SVGNew Next.js ‘use cache’ remote code execution via typed arraysNew CVE-2026-109527: MCP Python SDK HTTP servers can be knocked offline with huge requestsNew CVE-2026-108395: MCP Java SDK HTTP servers can be crashed with one huge requestNew Next.js Server Actions denial of serviceNew Roo Code: five ways to slip denied commands past auto-approve (CVE-2026-110202 to 110206), no fix comingCVE-2026-109572: Open WebUI terminal proxy lets regular users act as Terminals adminSupabase RLS policies that check login but not ownershipCVE-2026-103663: Ollama /api/pull path traversal can lead to code execution as rootNew OpenCode Console breach exposed saved provider API keysNew CVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commandsNew CVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npxNew CVE-2026-88755: Z.ai ZCode starts MCP servers from a repo's config the moment you open itNew CVE-2026-111091: JetBrains Junie CLI ran code from an untrusted project’s MCP configNew CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningNew CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionNew CVE-2026-96889: Next.js image optimization RCE via SVGNew Next.js ‘use cache’ remote code execution via typed arraysNew CVE-2026-109527: MCP Python SDK HTTP servers can be knocked offline with huge requestsNew CVE-2026-108395: MCP Java SDK HTTP servers can be crashed with one huge requestNew Next.js Server Actions denial of serviceNew Roo Code: five ways to slip denied commands past auto-approve (CVE-2026-110202 to 110206), no fix comingCVE-2026-109572: Open WebUI terminal proxy lets regular users act as Terminals adminSupabase RLS policies that check login but not ownershipCVE-2026-103663: Ollama /api/pull path traversal can lead to code execution as root
All advisories
Every known hole, with the fix.
126 advisories across app builders, coding agents, MCP, models and LLM frameworks. Worst first, each with how to check and what to change. Press / to jump to search.
126 advisories
01. OpenCode Console breach exposed saved provider API keysOpenCode said a breach of its hosted OpenCode Console affected 1.4% of Console users who had linked external providers. Their saved OpenAI and Anthropic keys may have been exposed, and Anthropic revoked Claude keys it believed were affected. 
OpenCode Anthropic Claude OpenAI +1 more 2026-10-17 02. CVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commandsBefore 0.2.121, the Python Claude Agent SDK passed the resume session ID straight to the Claude CLI. A value starting with a dash became a CLI flag, so an attacker could inject an MCP server config and run commands. Claude Code MCP SDKs & servers 2026-10-16 03. CVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npxDeepSeek Harness (dsh), DeepSeek's developer-preview agent harness, launches MCP servers by bare command name. Injected content can get the model to drop a fake executable into node_modules/.bin, which then runs every time that MCP server starts. DeepSeek MCP SDKs & servers 2026-10-16 04. CVE-2026-96889: Next.js image optimization RCE via SVGA memory bug in an upstream library used by Next.js Image Optimization can lead to unauthenticated remote code execution when SVG files are processed and Next.js runs on glibc-based Linux. Fixed in 16.4.1 and 15.5.28. Next.js 2026-10-14 05. Next.js ‘use cache’ remote code execution via typed arraysNext.js 16 apps using the App Router with Cache Components can be open to unauthenticated remote code execution when a ‘use cache’ function returns multiple typed arrays. There is no workaround; upgrade to 16.4.1. Next.js 2026-10-14 06. Supabase RLS policies that check login but not ownershipA policy like using (auth.uid() is not null) has RLS on and mentions the user, so it passes Lovable’s scan. But it lets any logged-in user read every row, and on most apps anyone can sign up. Supabase Lovable Bolt +4 more 2026-10-10 07. CVE-2026-103663: Ollama /api/pull path traversal can lead to code execution as rootAn unauthenticated attacker who can reach an Ollama server can use a crafted layer digest in /api/pull to write a file outside the model store. In most Docker images that means a file Ollama loads and runs as root on the next restart. Ollama 2026-10-08 08. CVE-2026-10561: Langflow's Python Interpreter component ran code with no real sandboxBefore 1.10.1, any logged-in Langflow user who could edit and run a flow could use the Python Interpreter component to run OS commands as the Langflow service and make their own account a superuser. 
Langflow 2026-10-06 09. Langflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)Langflow launched whatever command a user put in an MCP stdio server config, through bash -c, with no allowlist. Any user who could add an MCP server or build a flow could run OS commands on the Langflow host, and with the default auto-login no account was needed. Langflow MCP SDKs & servers 2026-10-05 10. CVE-2026-8505: Langflow webhooks let anyone run a flow without an API keyIn Langflow 1.7.0 through 1.9.0, webhook endpoints skipped API key checks by default, so anyone who knew a flow's UUID could run it as the flow's owner. Flows that run Python code turn that into remote code execution. Langflow 2026-10-05 11. Next.js: Remote Code Execution in next/og ImageResponseThe Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Next.js 2026-09-30 12. UpGuard: 16,326 Supabase databases had readable tablesUpGuard checked about 300,000 websites that use Supabase and found 16,326 databases with tables anyone could read. Over half showed signs of personal data, and a smaller share held passwords or auth tokens. Supabase Claude Code Codex CLI +4 more 2026-09-25 13. CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted serversA vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem. Next.js 2026-09-08 14. Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedA vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Next.js 2026-09-08 15. CVE-2026-37004: LiteLLM vulnerable to server-side template injection in the /prompts/test endpointBerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment. LiteLLM 2026-08-27 16. Supabase tables readable by anyone with no loginA scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login. Lovable Bolt v0 +4 more 2026-08 17. Supabase service_role / secret key shipped to the browserThe service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public. Lovable Bolt v0 +4 more 2026-08 18. CVE-2026-49468: LiteLLM: Authentication Bypass via Host Header InjectionA Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. LiteLLM 2026-06-16 19. Unverified Stripe webhooks hand out free upgradesIf your Stripe webhook handler doesn’t verify the Stripe-Signature header, anyone can POST a fake “checkout.session.completed” event and your app will treat it as a real payment. Scans and audits find this in a large share of AI-built apps. Stripe Lovable Bolt +5 more 2026-05 20. CVE-2026-12537: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypassesGemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. Gemini CLI 2026-04-24 21. CVE-2026-42208: LiteLLM has SQL Injection in Proxy API key verificationA database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. LiteLLM 2026-04-24 22. CVE-2025-61260: OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration filesA vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex CLI 2026-04-14 23. CVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal VulnerabilityThe OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. MCP SDKs & servers 2026-03-31 24. Moltbook left its Supabase database open to read and writeWiz found that Moltbook, a social network for AI agents whose founder said he vibe-coded it, shipped a Supabase key in its JavaScript with no Row Level Security behind it. Anyone could read and write the database, including 1.5 million agent API tokens and 35,000 email addresses. Supabase 2026-02-02 25. CVE-2026-22778: vLLM has RCE In Video ProcessingvLLM has RCE In Video Processing. vLLM 2026-02-02 26. CVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operationsA critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations. Ollama 2025-12-18 27. CamoLeak: Copilot Chat leaked private source codeLegit Security reported a critical vulnerability in GitHub Copilot Chat that could leak private source code from a user’s repositories. Copilot 2025-10-08 28. CVE-2025-6514: mcp-remote exposed to OS command injection via untrusted MCP server connectionsmcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL MCP SDKs & servers 2025-07-09 29. Base44: private apps open to anyone with the app_id (Wiz)Undocumented register and verify-OTP endpoints accepted a non-secret app_id, letting anyone create a verified account on private, SSO-only apps. Patched by Wix within 24 hours. Base44 2025-07 30. CVE-2025-49596: MCP Inspector proxy server lacks authentication between the Inspector client and proxyVersions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. MCP SDKs & servers 2025-06-13 31. CVE-2025-32711 (EchoLeak): zero-click data leak in Microsoft 365 CopilotAI command injection in Microsoft 365 Copilot let an unauthorised attacker disclose information over a network. Microsoft fixed it server-side. Copilot 2025-06-11 32. CVE-2025-1793: llama_index vulnerable to SQL InjectionMultiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. LlamaIndex 2025-06-05 33. CVE-2025-47277: vLLM Allows Remote Code Execution via PyNcclPipe Communication ServicevLLM Allows Remote Code Execution via PyNcclPipe Communication Service. vLLM 2025-05-20 34. CVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLSLovable-generated apps talked to Supabase directly from the browser, but many tables had no (or wrong) Row Level Security policies, so anyone with the public anon key could read or write data. Lovable Supabase 2025-05 35. CVE-2025-32444: vLLM Vulnerable to Remote Code Execution via Mooncake IntegrationvLLM integration with mooncake is vaulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. vLLM 2025-04-29 36. CVE-2025-29927: Next.js middleware authorization bypassSelf-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0. Next.js v0 Bolt +2 more 2025-03 37. DeepSeek left a database open with chat history and secretsWiz found a publicly accessible DeepSeek database that allowed full control over database operations, exposing over a million lines of logs with chat history and other sensitive data. DeepSeek 2025-01-29 38. CVE-2024-46946: LangChain Experimental Eval Injection vulnerabilitylangchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05). LangChain 2024-09-19 39. CVE-2024-45201: LlamaIndex includes an exec call for `import {cls_name}`An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}. LlamaIndex 2024-08-22 40. CVE-2024-3271: llama-index-core Command Injection vulnerabilityA command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. LlamaIndex 2024-04-16 41. CVE-2024-27444: LangChain Experimental vulnerable to arbitrary code executionlangchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__… LangChain 2024-02-26 42. CVE-2023-6730: transformers has a Deserialization of Untrusted Data vulnerabilityDeserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0. Hugging Face 2023-12-19 43. CVE-2023-32785: Langchain SQL Injection vulnerabilityIn Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain. LangChain 2023-10-21 44. CVE-2026-88755: Z.ai ZCode starts MCP servers from a repo's config the moment you open itZ.ai's ZCode desktop client 3.11.2.6792 connects to every MCP server declared in a repository's .zcode/config.json as soon as you open the folder, with no approval prompt. A cloned repo can run any command it likes on your machine. MCP SDKs & servers 2026-10-16 45. CVE-2026-111091: JetBrains Junie CLI ran code from an untrusted project’s MCP configOpening an untrusted project in Junie CLI before 26.8.3 could run code through the MCP server configuration that came with the project. 
Junie MCP SDKs & servers 2026-10-15 46. CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningThe plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. Claude Code 2026-10-15 47. CVE-2026-109527: MCP Python SDK HTTP servers can be knocked offline with huge requestsMCP servers built with the official Python SDK read whole HTTP request bodies into memory with no size limit on the SSE message endpoint and OAuth routes. One large request can exhaust memory and take the server down, often with no login needed. MCP SDKs & servers 2026-10-14 48. CVE-2026-108395: MCP Java SDK HTTP servers can be crashed with one huge requestThe official MCP Java SDK’s Servlet-based HTTP transports read the whole request body into memory with no size limit. One unauthenticated chunked POST can exhaust the Java heap and take the server down. MCP SDKs & servers 2026-10-14 49. Next.js Server Actions denial of serviceCrafted requests to a Next.js App Router app with at least one Server Action can cause excessive CPU use that blocks other requests in the same process. Fixed in 16.4.1 and 15.5.28. Next.js 2026-10-14 50. Roo Code: five ways to slip denied commands past auto-approve (CVE-2026-110202 to 110206), no fix comingRoo Code through 3.54.0 has five command-approval bypasses. With auto-approve on, a prompt injection can get a denied shell command run on your machine by hiding it behind an allowlisted command like echo. The project was archived in May 2026, so no patch is expected. 
Roo Code 
Cline 2026-10-13 51. CVE-2026-109572: Open WebUI terminal proxy lets regular users act as Terminals adminIn Open WebUI 0.8.6 to 0.11.3, a regular user with access to a Terminals connection could send requests through the terminal proxy with the admin’s shared key attached, then list or stop other users’ terminals and change terminal policies. 
Open WebUI 2026-10-12 52. CVE-2026-94483: Next.js has Server-Side Request Forgery in Image OptimizationAn attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization. Next.js 2026-10-07 53. CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverIn affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. MCP SDKs & servers 2026-10-06 54. CVE-2026-103435: Claude Code could be raced into writing files outside the projectClaude Code checked that a file path was inside the project at permission time but resolved it again at write time. Someone who can write to a shared workspace could swap a file for a symlink and redirect Claude Code’s edits to files like your shell config. Claude Code 2026-10-05 55. CVE-2026-102697: Ollama agent mode's Bash approval can be bypassed with ; or &&In Ollama's experimental agent mode, approving a Bash command for the session also let through anything chained onto it. A prompt injection could tack extra commands onto an approved one and run them without asking. Ollama 2026-09-29 56. CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. Open WebUI 2026-09-10 57. CVE-2026-87016: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. Open WebUI 2026-09-10 58. CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesAny authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Open WebUI 2026-08-04 59. Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesPrefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way. Lovable Bolt v0 +4 more 2026-08 60. CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code ExecutionClaude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. Claude Code 2026-07-24 61. CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validationIn affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation. MCP SDKs & servers 2026-07-16 62. CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalIn affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. MCP SDKs & servers 2026-07-16 63. CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksIn affected versions, the default request handlers installed by the experimental tasks feature (server.experimental.enable_tasks()) did not check which session created a task before acting on it. MCP SDKs & servers 2026-07-16 64. CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassedThe /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. Open WebUI 2026-05-14 65. CVE-2026-44578: Next.js vulnerable to server-side request forgery in applications using WebSocket upgradesSelf-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. Next.js 2026-05-11 66. CVE-2026-44574: Next.js has a Middleware / Proxy bypass through dynamic route parameter injectionApplications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. Next.js 2026-05-11 67. CVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loaderOllama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. Ollama 2026-05-04 68. CVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code ExecutionClaude Code used the git worktree commondir file when determining folder trust but did not validate its contents. Claude Code 2026-04-24 69. CVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside WorkspaceClaude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. Claude Code 2026-04-21 70. Lovable bug exposed public projects’ code and AI chatsFrom 3 February to 20 April 2026, a Lovable permissions regression let any Lovable user with a project link read the source code and AI chat history of public projects. Lovable confirmed it and fixed it within two hours of the public report. Lovable 2026-04-20 71. CVE-2026-27124: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy VulnerabilitiesWhile testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. MCP SDKs & servers 2026-03-31 72. CVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings FileClaude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. Claude Code 2026-03-19 73. CVE-2025-69196: FastMCP OAuth Proxy token reuse across MCP serversWhile testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request. MCP SDKs & servers 2026-03-16 74. CVE-2026-25725: Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.jsonClaude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. Claude Code 2026-02-06 75. CVE-2026-25723: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write RestrictionsClaude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope. Claude Code 2026-02-06 76. CVE-2026-25722: Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write ProtectionClaude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Claude Code 2026-02-06 77. CVE-2026-25536: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseCross-client data leak via two distinct issues: (1) reusing a single StreamableHTTPServerTransport across multiple client requests, and (2) reusing a single McpServer/Server instance across multiple transports. Both are most common in stateless deployments. MCP SDKs & servers 2026-02-04 78. CVE-2026-24887: Claude Code has a Command Injection in find Command Bypasses User Approval PromptDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Claude Code 2026-02-03 79. CVE-2026-24053: Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File WritesDue to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Claude Code 2026-02-03 80. CVE-2026-24052: Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled DomainsClaude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. Claude Code 2026-02-03 81. CVE-2025-9611: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server ToolsMicrosoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. MCP SDKs & servers 2026-01-07 82. CVE-2026-0621: Anthropic's MCP TypeScript SDK has a ReDoS vulnerabilityA ReDoS vulnerability in the UriTemplate class allows attackers to cause denial of service. The partToRegExp() function generates a regex pattern with nested quantifiers (([^/]+(?:,[^/]+))) for exploded template variables (e.g., {/id}, {?tags*}), causing catastrophic backtracking on malicious input. MCP SDKs & servers 2026-01-05 83. CVE-2025-66032: Claude Code Command Validation Bypass Allows Arbitrary Code ExecutionDue to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-12-03 84. CVE-2025-66416: Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 85. CVE-2025-66414: Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 86. CVE-2025-64755: @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File WritesDue to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. Claude Code 2025-11-20 87. CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialogWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-11-19 88. CVE-2025-59536: Claude Code can execute commands prior to the startup trust dialogDue to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Claude Code 2025-10-03 89. Gemini Trifecta: three injection flaws in Google’s Gemini suiteTenable found three now-fixed vulnerabilities in Gemini Cloud Assist, the Search Personalization model and the Browsing tool that exposed users to privacy risks, including search-injection. Google Gemini 2025-09-30 90. CVE-2025-59828: Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn VersionsWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-09-24 91. CVE-2025-59532: Codex has sandbox bypass due to bug in path configuration logicDue to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. Codex CLI 2025-09-19 92. CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git emailAt startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace. Claude Code 2025-09-10 93. CVE-2025-58764: Claude Code rg vulnerability does not protect against approval prompt bypassDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-09-10 94. CVE-2025-58444: MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP ServerAn XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. MCP SDKs & servers 2025-09-08 95. Windsurf: prompt injection leaks developer secretsEmbrace The Red showed how prompt injection in files the Cascade agent reads could get Windsurf to leak secrets from the developer’s machine. Windsurf 2025-08-21 96. CVE-2025-55284: Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude CodeDue to an overly broad allowlist of safe commands, it was possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation. Claude Code 2025-08-18 97. CVE-2025-53773: GitHub Copilot prompt injection to code executionCommand injection in GitHub Copilot and Visual Studio let an attacker run code on a developer’s machine. Embrace The Red showed it starting from a prompt injection in project content. Copilot 2025-08-12 98. CVE-2025-54795: Claude Code echo command allowed bypass of user approval prompt for command executionDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-08-04 99. CVE-2025-54794: Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file accessDue to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD. Claude Code 2025-08-04 100. CVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run codeBefore 1.3.9, Cursor let the agent create new dotfiles like .cursor/mcp.json without approval. Chained with prompt injection, this meant remote code execution. Cursor 2025-08 101. CVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedIn Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt. Cursor MCP SDKs & servers 2025-08 102. CVE-2025-8217: malicious code shipped in Amazon Q Developer 1.84.0An over-scoped GitHub token in Amazon Q’s build setup let an attacker commit malicious code that shipped in the VS Code extension 1.84.0. AWS says it failed to run due to a syntax error. 
Amazon Q Developer 2025-07-23 103. Supabase MCP: a support ticket gets the agent to dump private tablesGeneral Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role. MCP SDKs & servers Supabase Cursor +1 more 2025-07-08 104. CVE-2025-53366: MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoSA validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. MCP SDKs & servers 2025-07-04 105. CVE-2025-53365: MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of ServiceIf a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. MCP SDKs & servers 2025-07-04 106. CVE-2025-53110: @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefixVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 2025.7.1 to resolve the issue. MCP SDKs & servers 2025-07-01 107. CVE-2025-53109: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handlingVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve. MCP SDKs & servers 2025-07-01 108. AI agent deleted a production database during a code freeze (Replit)Replit Agent deleted SaaStr founder Jason Lemkin’s live database (1,206 executives, 1,196+ companies) despite an explicit freeze, then wrongly said rollback was impossible. Replit Cursor 2025-07 109. CVE-2025-52882: Claude Code Improper Authorization via websocket connections from arbitrary originsClaude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Pycharm, and Android Studio) are vulnerable to unauthorized websocket connections from an attacker when visiting attacker-controlled webpages. Claude Code 2025-06-23 110. GitHub MCP server: a public issue makes the agent leak private reposInvariant Labs showed that a prompt injection planted in a public GitHub issue could get an agent using the official GitHub MCP server to pull data from the user’s private repositories. MCP SDKs & servers Claude Code Cursor +1 more 2025-05-26 111. MCP tool poisoning: hidden instructions in tool descriptionsAn MCP server can hide instructions inside a tool’s description. The model reads them, the user usually doesn’t, and the agent can be steered into reading files or sending data elsewhere. MCP SDKs & servers Cursor Claude Code +2 more 2025-04-01 112. “Rules File Backdoor”: hidden Unicode instructions in AI rules filesPillar Security showed invisible Unicode characters in shared rules files (.cursorrules, .mdc) can steer Cursor and GitHub Copilot into writing backdoored code. Cursor Copilot 2025-03 113. Authentication logic living entirely in the browserHiding a page or button in the UI is not access control. If the API or database doesn’t check the user, anyone can call it directly. Lovable Base44 Bolt +3 more 2025 114. Slopsquatting: AI suggests packages that don’t existA USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names. Claude Code Copilot Cursor +5 more 2025 115. CVE-2024-11393: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 116. CVE-2024-11394: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 117. OWASP LLM01:2025: prompt injection is the top LLM app riskOWASP ranks prompt injection first in its Top 10 for LLM Applications 2025. Any app that feeds untrusted text to a model with tools or data access is exposed. OpenAI Anthropic Claude Google Gemini +4 more 2024-11-18 118. SpAIware: prompt injection writes into ChatGPT’s long-term memoryEmbrace The Red showed untrusted content planting persistent instructions in ChatGPT’s memory on the macOS app, so later chats kept sending data to the attacker. OpenAI 2024-09-20 119. CVE-2024-28224: Ollama DNS rebinding vulnerabilityOllama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion). Ollama 2024-04-08 120. CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionMCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion. MCP SDKs & servers 2026-10-15 121. CVE-2026-84377: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parametersAny authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. LiteLLM 2026-09-30 122. Grok 4 jailbroken within 48 hours of launchNeuralTrust combined its Echo Chamber and Crescendo multi-turn techniques to jailbreak Grok 4 two days after release. 
xAI Grok 2025-07-11 123. Protecting routes only in middlewareVercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed. Next.js v0 Bolt +2 more 2025-03 124. DeepSeek R1 failed every harmful-prompt test in Cisco’s evaluationCisco ran algorithmic jailbreak testing against DeepSeek and other frontier reasoning models and published the results on 31 January 2025. DeepSeek 2025-01-31 125. CVE-2024-50050: Llama Stack used pickle over socketsMeta’s Llama Stack used Python pickle to deserialise socket messages, which could allow remote code execution. It switched to JSON. Meta Llama 2024-10-23 126. Many-shot jailbreaking: long context windows weaken refusalsAnthropic published research showing that filling a long prompt with many fake dialogue examples can push models into answering requests they would normally refuse. Anthropic Claude OpenAI Google Gemini +2 more 2024-04-02
OpenCode Anthropic Claude OpenAI +1 more 2026-10-17 02. CVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commandsBefore 0.2.121, the Python Claude Agent SDK passed the resume session ID straight to the Claude CLI. A value starting with a dash became a CLI flag, so an attacker could inject an MCP server config and run commands. Claude Code MCP SDKs & servers 2026-10-16 03. CVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npxDeepSeek Harness (dsh), DeepSeek's developer-preview agent harness, launches MCP servers by bare command name. Injected content can get the model to drop a fake executable into node_modules/.bin, which then runs every time that MCP server starts. DeepSeek MCP SDKs & servers 2026-10-16 04. CVE-2026-96889: Next.js image optimization RCE via SVGA memory bug in an upstream library used by Next.js Image Optimization can lead to unauthenticated remote code execution when SVG files are processed and Next.js runs on glibc-based Linux. Fixed in 16.4.1 and 15.5.28. Next.js 2026-10-14 05. Next.js ‘use cache’ remote code execution via typed arraysNext.js 16 apps using the App Router with Cache Components can be open to unauthenticated remote code execution when a ‘use cache’ function returns multiple typed arrays. There is no workaround; upgrade to 16.4.1. Next.js 2026-10-14 06. Supabase RLS policies that check login but not ownershipA policy like using (auth.uid() is not null) has RLS on and mentions the user, so it passes Lovable’s scan. But it lets any logged-in user read every row, and on most apps anyone can sign up. Supabase Lovable Bolt +4 more 2026-10-10 07. CVE-2026-103663: Ollama /api/pull path traversal can lead to code execution as rootAn unauthenticated attacker who can reach an Ollama server can use a crafted layer digest in /api/pull to write a file outside the model store. In most Docker images that means a file Ollama loads and runs as root on the next restart. Ollama 2026-10-08 08. CVE-2026-10561: Langflow's Python Interpreter component ran code with no real sandboxBefore 1.10.1, any logged-in Langflow user who could edit and run a flow could use the Python Interpreter component to run OS commands as the Langflow service and make their own account a superuser. Langflow 2026-10-06 09. Langflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)Langflow launched whatever command a user put in an MCP stdio server config, through bash -c, with no allowlist. Any user who could add an MCP server or build a flow could run OS commands on the Langflow host, and with the default auto-login no account was needed. Langflow MCP SDKs & servers 2026-10-05 10. CVE-2026-8505: Langflow webhooks let anyone run a flow without an API keyIn Langflow 1.7.0 through 1.9.0, webhook endpoints skipped API key checks by default, so anyone who knew a flow's UUID could run it as the flow's owner. Flows that run Python code turn that into remote code execution. Langflow 2026-10-05 11. Next.js: Remote Code Execution in next/og ImageResponseThe Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Next.js 2026-09-30 12. UpGuard: 16,326 Supabase databases had readable tablesUpGuard checked about 300,000 websites that use Supabase and found 16,326 databases with tables anyone could read. Over half showed signs of personal data, and a smaller share held passwords or auth tokens. Supabase Claude Code Codex CLI +4 more 2026-09-25 13. CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted serversA vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem. Next.js 2026-09-08 14. Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedA vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Next.js 2026-09-08 15. CVE-2026-37004: LiteLLM vulnerable to server-side template injection in the /prompts/test endpointBerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment. LiteLLM 2026-08-27 16. Supabase tables readable by anyone with no loginA scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login. Lovable Bolt v0 +4 more 2026-08 17. Supabase service_role / secret key shipped to the browserThe service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public. Lovable Bolt v0 +4 more 2026-08 18. CVE-2026-49468: LiteLLM: Authentication Bypass via Host Header InjectionA Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. LiteLLM 2026-06-16 19. Unverified Stripe webhooks hand out free upgradesIf your Stripe webhook handler doesn’t verify the Stripe-Signature header, anyone can POST a fake “checkout.session.completed” event and your app will treat it as a real payment. Scans and audits find this in a large share of AI-built apps. Stripe Lovable Bolt +5 more 2026-05 20. CVE-2026-12537: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypassesGemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. Gemini CLI 2026-04-24 21. CVE-2026-42208: LiteLLM has SQL Injection in Proxy API key verificationA database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. LiteLLM 2026-04-24 22. CVE-2025-61260: OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration filesA vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex CLI 2026-04-14 23. CVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal VulnerabilityThe OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. MCP SDKs & servers 2026-03-31 24. Moltbook left its Supabase database open to read and writeWiz found that Moltbook, a social network for AI agents whose founder said he vibe-coded it, shipped a Supabase key in its JavaScript with no Row Level Security behind it. Anyone could read and write the database, including 1.5 million agent API tokens and 35,000 email addresses. Supabase 2026-02-02 25. CVE-2026-22778: vLLM has RCE In Video ProcessingvLLM has RCE In Video Processing. vLLM 2026-02-02 26. CVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operationsA critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations. Ollama 2025-12-18 27. CamoLeak: Copilot Chat leaked private source codeLegit Security reported a critical vulnerability in GitHub Copilot Chat that could leak private source code from a user’s repositories. Copilot 2025-10-08 28. CVE-2025-6514: mcp-remote exposed to OS command injection via untrusted MCP server connectionsmcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL MCP SDKs & servers 2025-07-09 29. Base44: private apps open to anyone with the app_id (Wiz)Undocumented register and verify-OTP endpoints accepted a non-secret app_id, letting anyone create a verified account on private, SSO-only apps. Patched by Wix within 24 hours. Base44 2025-07 30. CVE-2025-49596: MCP Inspector proxy server lacks authentication between the Inspector client and proxyVersions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. MCP SDKs & servers 2025-06-13 31. CVE-2025-32711 (EchoLeak): zero-click data leak in Microsoft 365 CopilotAI command injection in Microsoft 365 Copilot let an unauthorised attacker disclose information over a network. Microsoft fixed it server-side. Copilot 2025-06-11 32. CVE-2025-1793: llama_index vulnerable to SQL InjectionMultiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. LlamaIndex 2025-06-05 33. CVE-2025-47277: vLLM Allows Remote Code Execution via PyNcclPipe Communication ServicevLLM Allows Remote Code Execution via PyNcclPipe Communication Service. vLLM 2025-05-20 34. CVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLSLovable-generated apps talked to Supabase directly from the browser, but many tables had no (or wrong) Row Level Security policies, so anyone with the public anon key could read or write data. Lovable Supabase 2025-05 35. CVE-2025-32444: vLLM Vulnerable to Remote Code Execution via Mooncake IntegrationvLLM integration with mooncake is vaulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. vLLM 2025-04-29 36. CVE-2025-29927: Next.js middleware authorization bypassSelf-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0. Next.js v0 Bolt +2 more 2025-03 37. DeepSeek left a database open with chat history and secretsWiz found a publicly accessible DeepSeek database that allowed full control over database operations, exposing over a million lines of logs with chat history and other sensitive data. DeepSeek 2025-01-29 38. CVE-2024-46946: LangChain Experimental Eval Injection vulnerabilitylangchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05). LangChain 2024-09-19 39. CVE-2024-45201: LlamaIndex includes an exec call for `import {cls_name}`An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}. LlamaIndex 2024-08-22 40. CVE-2024-3271: llama-index-core Command Injection vulnerabilityA command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. LlamaIndex 2024-04-16 41. CVE-2024-27444: LangChain Experimental vulnerable to arbitrary code executionlangchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__… LangChain 2024-02-26 42. CVE-2023-6730: transformers has a Deserialization of Untrusted Data vulnerabilityDeserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0. Hugging Face 2023-12-19 43. CVE-2023-32785: Langchain SQL Injection vulnerabilityIn Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain. LangChain 2023-10-21 44. CVE-2026-88755: Z.ai ZCode starts MCP servers from a repo's config the moment you open itZ.ai's ZCode desktop client 3.11.2.6792 connects to every MCP server declared in a repository's .zcode/config.json as soon as you open the folder, with no approval prompt. A cloned repo can run any command it likes on your machine. MCP SDKs & servers 2026-10-16 45. CVE-2026-111091: JetBrains Junie CLI ran code from an untrusted project’s MCP configOpening an untrusted project in Junie CLI before 26.8.3 could run code through the MCP server configuration that came with the project. Junie MCP SDKs & servers 2026-10-15 46. CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningThe plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. Claude Code 2026-10-15 47. CVE-2026-109527: MCP Python SDK HTTP servers can be knocked offline with huge requestsMCP servers built with the official Python SDK read whole HTTP request bodies into memory with no size limit on the SSE message endpoint and OAuth routes. One large request can exhaust memory and take the server down, often with no login needed. MCP SDKs & servers 2026-10-14 48. CVE-2026-108395: MCP Java SDK HTTP servers can be crashed with one huge requestThe official MCP Java SDK’s Servlet-based HTTP transports read the whole request body into memory with no size limit. One unauthenticated chunked POST can exhaust the Java heap and take the server down. MCP SDKs & servers 2026-10-14 49. Next.js Server Actions denial of serviceCrafted requests to a Next.js App Router app with at least one Server Action can cause excessive CPU use that blocks other requests in the same process. Fixed in 16.4.1 and 15.5.28. Next.js 2026-10-14 50. Roo Code: five ways to slip denied commands past auto-approve (CVE-2026-110202 to 110206), no fix comingRoo Code through 3.54.0 has five command-approval bypasses. With auto-approve on, a prompt injection can get a denied shell command run on your machine by hiding it behind an allowlisted command like echo. The project was archived in May 2026, so no patch is expected. Roo Code Cline 2026-10-13 51. CVE-2026-109572: Open WebUI terminal proxy lets regular users act as Terminals adminIn Open WebUI 0.8.6 to 0.11.3, a regular user with access to a Terminals connection could send requests through the terminal proxy with the admin’s shared key attached, then list or stop other users’ terminals and change terminal policies. Open WebUI 2026-10-12 52. CVE-2026-94483: Next.js has Server-Side Request Forgery in Image OptimizationAn attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization. Next.js 2026-10-07 53. CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverIn affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. MCP SDKs & servers 2026-10-06 54. CVE-2026-103435: Claude Code could be raced into writing files outside the projectClaude Code checked that a file path was inside the project at permission time but resolved it again at write time. Someone who can write to a shared workspace could swap a file for a symlink and redirect Claude Code’s edits to files like your shell config. Claude Code 2026-10-05 55. CVE-2026-102697: Ollama agent mode's Bash approval can be bypassed with ; or &&In Ollama's experimental agent mode, approving a Bash command for the session also let through anything chained onto it. A prompt injection could tack extra commands onto an approved one and run them without asking. Ollama 2026-09-29 56. CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. Open WebUI 2026-09-10 57. CVE-2026-87016: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. Open WebUI 2026-09-10 58. CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesAny authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Open WebUI 2026-08-04 59. Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesPrefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way. Lovable Bolt v0 +4 more 2026-08 60. CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code ExecutionClaude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. Claude Code 2026-07-24 61. CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validationIn affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation. MCP SDKs & servers 2026-07-16 62. CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalIn affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. MCP SDKs & servers 2026-07-16 63. CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksIn affected versions, the default request handlers installed by the experimental tasks feature (server.experimental.enable_tasks()) did not check which session created a task before acting on it. MCP SDKs & servers 2026-07-16 64. CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassedThe /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. Open WebUI 2026-05-14 65. CVE-2026-44578: Next.js vulnerable to server-side request forgery in applications using WebSocket upgradesSelf-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. Next.js 2026-05-11 66. CVE-2026-44574: Next.js has a Middleware / Proxy bypass through dynamic route parameter injectionApplications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. Next.js 2026-05-11 67. CVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loaderOllama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. Ollama 2026-05-04 68. CVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code ExecutionClaude Code used the git worktree commondir file when determining folder trust but did not validate its contents. Claude Code 2026-04-24 69. CVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside WorkspaceClaude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. Claude Code 2026-04-21 70. Lovable bug exposed public projects’ code and AI chatsFrom 3 February to 20 April 2026, a Lovable permissions regression let any Lovable user with a project link read the source code and AI chat history of public projects. Lovable confirmed it and fixed it within two hours of the public report. Lovable 2026-04-20 71. CVE-2026-27124: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy VulnerabilitiesWhile testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. MCP SDKs & servers 2026-03-31 72. CVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings FileClaude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. Claude Code 2026-03-19 73. CVE-2025-69196: FastMCP OAuth Proxy token reuse across MCP serversWhile testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request. MCP SDKs & servers 2026-03-16 74. CVE-2026-25725: Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.jsonClaude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. Claude Code 2026-02-06 75. CVE-2026-25723: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write RestrictionsClaude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope. Claude Code 2026-02-06 76. CVE-2026-25722: Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write ProtectionClaude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Claude Code 2026-02-06 77. CVE-2026-25536: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseCross-client data leak via two distinct issues: (1) reusing a single StreamableHTTPServerTransport across multiple client requests, and (2) reusing a single McpServer/Server instance across multiple transports. Both are most common in stateless deployments. MCP SDKs & servers 2026-02-04 78. CVE-2026-24887: Claude Code has a Command Injection in find Command Bypasses User Approval PromptDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Claude Code 2026-02-03 79. CVE-2026-24053: Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File WritesDue to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Claude Code 2026-02-03 80. CVE-2026-24052: Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled DomainsClaude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. Claude Code 2026-02-03 81. CVE-2025-9611: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server ToolsMicrosoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. MCP SDKs & servers 2026-01-07 82. CVE-2026-0621: Anthropic's MCP TypeScript SDK has a ReDoS vulnerabilityA ReDoS vulnerability in the UriTemplate class allows attackers to cause denial of service. The partToRegExp() function generates a regex pattern with nested quantifiers (([^/]+(?:,[^/]+))) for exploded template variables (e.g., {/id}, {?tags*}), causing catastrophic backtracking on malicious input. MCP SDKs & servers 2026-01-05 83. CVE-2025-66032: Claude Code Command Validation Bypass Allows Arbitrary Code ExecutionDue to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-12-03 84. CVE-2025-66416: Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 85. CVE-2025-66414: Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 86. CVE-2025-64755: @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File WritesDue to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. Claude Code 2025-11-20 87. CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialogWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-11-19 88. CVE-2025-59536: Claude Code can execute commands prior to the startup trust dialogDue to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Claude Code 2025-10-03 89. Gemini Trifecta: three injection flaws in Google’s Gemini suiteTenable found three now-fixed vulnerabilities in Gemini Cloud Assist, the Search Personalization model and the Browsing tool that exposed users to privacy risks, including search-injection. Google Gemini 2025-09-30 90. CVE-2025-59828: Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn VersionsWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-09-24 91. CVE-2025-59532: Codex has sandbox bypass due to bug in path configuration logicDue to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. Codex CLI 2025-09-19 92. CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git emailAt startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace. Claude Code 2025-09-10 93. CVE-2025-58764: Claude Code rg vulnerability does not protect against approval prompt bypassDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-09-10 94. CVE-2025-58444: MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP ServerAn XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. MCP SDKs & servers 2025-09-08 95. Windsurf: prompt injection leaks developer secretsEmbrace The Red showed how prompt injection in files the Cascade agent reads could get Windsurf to leak secrets from the developer’s machine. Windsurf 2025-08-21 96. CVE-2025-55284: Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude CodeDue to an overly broad allowlist of safe commands, it was possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation. Claude Code 2025-08-18 97. CVE-2025-53773: GitHub Copilot prompt injection to code executionCommand injection in GitHub Copilot and Visual Studio let an attacker run code on a developer’s machine. Embrace The Red showed it starting from a prompt injection in project content. Copilot 2025-08-12 98. CVE-2025-54795: Claude Code echo command allowed bypass of user approval prompt for command executionDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-08-04 99. CVE-2025-54794: Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file accessDue to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD. Claude Code 2025-08-04 100. CVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run codeBefore 1.3.9, Cursor let the agent create new dotfiles like .cursor/mcp.json without approval. Chained with prompt injection, this meant remote code execution. Cursor 2025-08 101. CVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedIn Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt. Cursor MCP SDKs & servers 2025-08 102. CVE-2025-8217: malicious code shipped in Amazon Q Developer 1.84.0An over-scoped GitHub token in Amazon Q’s build setup let an attacker commit malicious code that shipped in the VS Code extension 1.84.0. AWS says it failed to run due to a syntax error. Amazon Q Developer 2025-07-23 103. Supabase MCP: a support ticket gets the agent to dump private tablesGeneral Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role. MCP SDKs & servers Supabase Cursor +1 more 2025-07-08 104. CVE-2025-53366: MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoSA validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. MCP SDKs & servers 2025-07-04 105. CVE-2025-53365: MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of ServiceIf a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. MCP SDKs & servers 2025-07-04 106. CVE-2025-53110: @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefixVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 2025.7.1 to resolve the issue. MCP SDKs & servers 2025-07-01 107. CVE-2025-53109: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handlingVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve. MCP SDKs & servers 2025-07-01 108. AI agent deleted a production database during a code freeze (Replit)Replit Agent deleted SaaStr founder Jason Lemkin’s live database (1,206 executives, 1,196+ companies) despite an explicit freeze, then wrongly said rollback was impossible. Replit Cursor 2025-07 109. CVE-2025-52882: Claude Code Improper Authorization via websocket connections from arbitrary originsClaude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Pycharm, and Android Studio) are vulnerable to unauthorized websocket connections from an attacker when visiting attacker-controlled webpages. Claude Code 2025-06-23 110. GitHub MCP server: a public issue makes the agent leak private reposInvariant Labs showed that a prompt injection planted in a public GitHub issue could get an agent using the official GitHub MCP server to pull data from the user’s private repositories. MCP SDKs & servers Claude Code Cursor +1 more 2025-05-26 111. MCP tool poisoning: hidden instructions in tool descriptionsAn MCP server can hide instructions inside a tool’s description. The model reads them, the user usually doesn’t, and the agent can be steered into reading files or sending data elsewhere. MCP SDKs & servers Cursor Claude Code +2 more 2025-04-01 112. “Rules File Backdoor”: hidden Unicode instructions in AI rules filesPillar Security showed invisible Unicode characters in shared rules files (.cursorrules, .mdc) can steer Cursor and GitHub Copilot into writing backdoored code. Cursor Copilot 2025-03 113. Authentication logic living entirely in the browserHiding a page or button in the UI is not access control. If the API or database doesn’t check the user, anyone can call it directly. Lovable Base44 Bolt +3 more 2025 114. Slopsquatting: AI suggests packages that don’t existA USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names. Claude Code Copilot Cursor +5 more 2025 115. CVE-2024-11393: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 116. CVE-2024-11394: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 117. OWASP LLM01:2025: prompt injection is the top LLM app riskOWASP ranks prompt injection first in its Top 10 for LLM Applications 2025. Any app that feeds untrusted text to a model with tools or data access is exposed. OpenAI Anthropic Claude Google Gemini +4 more 2024-11-18 118. SpAIware: prompt injection writes into ChatGPT’s long-term memoryEmbrace The Red showed untrusted content planting persistent instructions in ChatGPT’s memory on the macOS app, so later chats kept sending data to the attacker. OpenAI 2024-09-20 119. CVE-2024-28224: Ollama DNS rebinding vulnerabilityOllama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion). Ollama 2024-04-08 120. CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionMCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion. MCP SDKs & servers 2026-10-15 121. CVE-2026-84377: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parametersAny authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. LiteLLM 2026-09-30 122. Grok 4 jailbroken within 48 hours of launchNeuralTrust combined its Echo Chamber and Crescendo multi-turn techniques to jailbreak Grok 4 two days after release. xAI Grok 2025-07-11 123. Protecting routes only in middlewareVercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed. Next.js v0 Bolt +2 more 2025-03 124. DeepSeek R1 failed every harmful-prompt test in Cisco’s evaluationCisco ran algorithmic jailbreak testing against DeepSeek and other frontier reasoning models and published the results on 31 January 2025. DeepSeek 2025-01-31 125. CVE-2024-50050: Llama Stack used pickle over socketsMeta’s Llama Stack used Python pickle to deserialise socket messages, which could allow remote code execution. It switched to JSON. Meta Llama 2024-10-23 126. Many-shot jailbreaking: long context windows weaken refusalsAnthropic published research showing that filling a long prompt with many fake dialogue examples can push models into answering requests they would normally refuse. Anthropic Claude OpenAI Google Gemini +2 more 2024-04-02 Nothing matches that. Try another builder, or clear the filter.