VibeVulns

OpenCode Console breach exposed saved provider API keys

Sat, 17 Oct 2026 00:00:00 GMT

OpenCode said a breach of its hosted OpenCode Console affected 1.4% of Console users who had linked external providers. Their saved OpenAI and Anthropic keys may have been exposed, and Anthropic revoked Claude keys it believed were affected.

CVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands

Fri, 16 Oct 2026 00:00:00 GMT

Before 0.2.121, the Python Claude Agent SDK passed the resume session ID straight to the Claude CLI. A value starting with a dash became a CLI flag, so an attacker could inject an MCP server config and run commands.

CVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npx

Fri, 16 Oct 2026 00:00:00 GMT

DeepSeek Harness (dsh), DeepSeek's developer-preview agent harness, launches MCP servers by bare command name. Injected content can get the model to drop a fake executable into node_modules/.bin, which then runs every time that MCP server starts.

CVE-2026-88755: Z.ai ZCode starts MCP servers from a repo's config the moment you open it

Fri, 16 Oct 2026 00:00:00 GMT

Z.ai's ZCode desktop client 3.11.2.6792 connects to every MCP server declared in a repository's .zcode/config.json as soon as you open the folder, with no approval prompt. A cloned repo can run any command it likes on your machine.

CVE-2026-111091: JetBrains Junie CLI ran code from an untrusted project’s MCP config

Thu, 15 Oct 2026 00:00:00 GMT

Opening an untrusted project in Junie CLI before 26.8.3 could run code through the MCP server configuration that came with the project.

CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

Thu, 15 Oct 2026 00:00:00 GMT

The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA.

CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

Thu, 15 Oct 2026 00:00:00 GMT

MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion.

CVE-2026-96889: Next.js image optimization RCE via SVG

Wed, 14 Oct 2026 00:00:00 GMT

A memory bug in an upstream library used by Next.js Image Optimization can lead to unauthenticated remote code execution when SVG files are processed and Next.js runs on glibc-based Linux. Fixed in 16.4.1 and 15.5.28.

Next.js ‘use cache’ remote code execution via typed arrays

Wed, 14 Oct 2026 00:00:00 GMT

Next.js 16 apps using the App Router with Cache Components can be open to unauthenticated remote code execution when a ‘use cache’ function returns multiple typed arrays. There is no workaround; upgrade to 16.4.1.

CVE-2026-109527: MCP Python SDK HTTP servers can be knocked offline with huge requests

Wed, 14 Oct 2026 00:00:00 GMT

MCP servers built with the official Python SDK read whole HTTP request bodies into memory with no size limit on the SSE message endpoint and OAuth routes. One large request can exhaust memory and take the server down, often with no login needed.

CVE-2026-108395: MCP Java SDK HTTP servers can be crashed with one huge request

Wed, 14 Oct 2026 00:00:00 GMT

The official MCP Java SDK’s Servlet-based HTTP transports read the whole request body into memory with no size limit. One unauthenticated chunked POST can exhaust the Java heap and take the server down.

Next.js Server Actions denial of service

Wed, 14 Oct 2026 00:00:00 GMT

Crafted requests to a Next.js App Router app with at least one Server Action can cause excessive CPU use that blocks other requests in the same process. Fixed in 16.4.1 and 15.5.28.

Roo Code: five ways to slip denied commands past auto-approve (CVE-2026-110202 to 110206), no fix coming

Tue, 13 Oct 2026 00:00:00 GMT

Roo Code through 3.54.0 has five command-approval bypasses. With auto-approve on, a prompt injection can get a denied shell command run on your machine by hiding it behind an allowlisted command like echo. The project was archived in May 2026, so no patch is expected.

CVE-2026-109572: Open WebUI terminal proxy lets regular users act as Terminals admin

Mon, 12 Oct 2026 00:00:00 GMT

In Open WebUI 0.8.6 to 0.11.3, a regular user with access to a Terminals connection could send requests through the terminal proxy with the admin’s shared key attached, then list or stop other users’ terminals and change terminal policies.

Supabase RLS policies that check login but not ownership

Sat, 10 Oct 2026 00:00:00 GMT

A policy like using (auth.uid() is not null) has RLS on and mentions the user, so it passes Lovable’s scan. But it lets any logged-in user read every row, and on most apps anyone can sign up.

CVE-2026-103663: Ollama /api/pull path traversal can lead to code execution as root

Thu, 08 Oct 2026 00:00:00 GMT

An unauthenticated attacker who can reach an Ollama server can use a crafted layer digest in /api/pull to write a file outside the model store. In most Docker images that means a file Ollama loads and runs as root on the next restart.

CVE-2026-94483: Next.js has Server-Side Request Forgery in Image Optimization

Wed, 07 Oct 2026 00:00:00 GMT

An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.

CVE-2026-10561: Langflow's Python Interpreter component ran code with no real sandbox

Tue, 06 Oct 2026 00:00:00 GMT

Before 1.10.1, any logged-in Langflow user who could edit and run a flow could use the Python Interpreter component to run OS commands as the Langflow service and make their own account a superuser.

CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

Tue, 06 Oct 2026 00:00:00 GMT

In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to.

Langflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)

Mon, 05 Oct 2026 00:00:00 GMT

Langflow launched whatever command a user put in an MCP stdio server config, through bash -c, with no allowlist. Any user who could add an MCP server or build a flow could run OS commands on the Langflow host, and with the default auto-login no account was needed.

CVE-2026-8505: Langflow webhooks let anyone run a flow without an API key

Mon, 05 Oct 2026 00:00:00 GMT

In Langflow 1.7.0 through 1.9.0, webhook endpoints skipped API key checks by default, so anyone who knew a flow's UUID could run it as the flow's owner. Flows that run Python code turn that into remote code execution.

CVE-2026-103435: Claude Code could be raced into writing files outside the project

Mon, 05 Oct 2026 00:00:00 GMT

Claude Code checked that a file path was inside the project at permission time but resolved it again at write time. Someone who can write to a shared workspace could swap a file for a symlink and redirect Claude Code’s edits to files like your shell config.

Next.js: Remote Code Execution in next/og ImageResponse

Wed, 30 Sep 2026 00:00:00 GMT

The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution.

CVE-2026-84377: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

Wed, 30 Sep 2026 00:00:00 GMT

Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination.

CVE-2026-102697: Ollama agent mode's Bash approval can be bypassed with ; or &&

Tue, 29 Sep 2026 00:00:00 GMT

In Ollama's experimental agent mode, approving a Bash command for the session also let through anything chained onto it. A prompt injection could tack extra commands onto an approved one and run them without asking.

UpGuard: 16,326 Supabase databases had readable tables

Fri, 25 Sep 2026 00:00:00 GMT

UpGuard checked about 300,000 websites that use Supabase and found 16,326 databases with tables anyone could read. Over half showed signs of personal data, and a smaller share held passwords or auth tokens.

CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

Thu, 10 Sep 2026 00:00:00 GMT

Any authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself.

CVE-2026-87016: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

Thu, 10 Sep 2026 00:00:00 GMT

On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match.

CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Tue, 08 Sep 2026 00:00:00 GMT

A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Tue, 08 Sep 2026 00:00:00 GMT

A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.

CVE-2026-37004: LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

Thu, 27 Aug 2026 00:00:00 GMT

BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.

CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Tue, 04 Aug 2026 00:00:00 GMT

Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error.

Supabase tables readable by anyone with no login

Sat, 01 Aug 2026 00:00:00 GMT

A scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login.

Supabase service_role / secret key shipped to the browser

Sat, 01 Aug 2026 00:00:00 GMT

The service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public.

Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variables

Sat, 01 Aug 2026 00:00:00 GMT

Prefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way.

CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

Fri, 24 Jul 2026 00:00:00 GMT

Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks.

CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validation

Thu, 16 Jul 2026 00:00:00 GMT

In affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation.

CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

Thu, 16 Jul 2026 00:00:00 GMT

In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session.

CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

Thu, 16 Jul 2026 00:00:00 GMT

In affected versions, the default request handlers installed by the experimental tasks feature (server.experimental.enable_tasks()) did not check which session created a task before acting on it.

CVE-2026-49468: LiteLLM: Authentication Bypass via Host Header Injection

Tue, 16 Jun 2026 00:00:00 GMT

A Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes.

CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed

Thu, 14 May 2026 00:00:00 GMT

The /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes.

CVE-2026-44578: Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades

Mon, 11 May 2026 00:00:00 GMT

Self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests.

CVE-2026-44574: Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

Mon, 11 May 2026 00:00:00 GMT

Applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass.

CVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader

Mon, 04 May 2026 00:00:00 GMT

Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader.

Unverified Stripe webhooks hand out free upgrades

Fri, 01 May 2026 00:00:00 GMT

If your Stripe webhook handler doesn’t verify the Stripe-Signature header, anyone can POST a fake “checkout.session.completed” event and your app will treat it as a real payment. Scans and audits find this in a large share of AI-built apps.

CVE-2026-12537: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

Fri, 24 Apr 2026 00:00:00 GMT

Gemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions.

CVE-2026-42208: LiteLLM has SQL Injection in Proxy API key verification

Fri, 24 Apr 2026 00:00:00 GMT

A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter.

CVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution

Fri, 24 Apr 2026 00:00:00 GMT

Claude Code used the git worktree commondir file when determining folder trust but did not validate its contents.

CVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

Tue, 21 Apr 2026 00:00:00 GMT

Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace.

Lovable bug exposed public projects’ code and AI chats

Mon, 20 Apr 2026 00:00:00 GMT

From 3 February to 20 April 2026, a Lovable permissions regression let any Lovable user with a project link read the source code and AI chat history of public projects. Lovable confirmed it and fixed it within two hours of the public report.