| 5 Apr 2026 | CVE-2026-5584: Remote code injection in agenticSeek PyInterpreter.execute | Fosowl | technology | coding | tool misuse | | reported |
| 3 Apr 2026 | Multiple critical vulnerabilities in PraisonAI multi-agent framework (8 CVEs) | PraisonAI | technology | workflow | tool misuse | | resolved |
| 3 Apr 2026 | CVE-2025-64340: Command injection in FastMCP install commands on Windows | PrefectHQ | technology | coding | tool misuse | | resolved |
| 2 Apr 2026 | FastMCP flaws before 3.2.0: authenticated SSRF and OAuth confused deputy | PrefectHQ | technology | other | tool misuse | | resolved |
| 2 Apr 2026 | SSRF vulnerability in a11y-mcp MCP server (CVE-2026-5323) | priyankark | technology | other | tool misuse | | resolved |
| 31 Mar 2026 | LangChain path traversal in prompt loading allows arbitrary file read (CVE-2026-34070) | LangChain | technology | other | data leak | | resolved |
| 31 Mar 2026 | CVE-2026-29870: Path traversal enables arbitrary file write in agentic-context-engine | agentic-context-engine project | technology | other | tool misuse | | reported |
| 31 Mar 2026 | Giskard library flaw: ChatWorkflow.chat renders input as Jinja2 template enabling RCE | Giskard | technology | other | misconfiguration | | resolved |
| 31 Mar 2026 | Origin-validation flaws in official MCP Java and Go SDKs allow cross-site access | Model Context Protocol | technology | other | misconfiguration | | resolved |
| 31 Mar 2026 | FastGPT SSRF flaws in HTTP and MCP tools endpoints (CVE-2026-34162/34163) | labring | technology | workflow | misconfiguration | | resolved |
| 31 Mar 2026 | CVE-2026-34451: Path validation flaw in Anthropic TypeScript SDK memory tool | Anthropic | technology | other | prompt injection | | resolved |
| 31 Mar 2026 | Nhost CLI MCP server lacked authentication and CORS enforcement (CVE-2026-34200) | Nhost | technology | coding | misconfiguration | | resolved |
| 31 Mar 2026 | CVE-2026-4399: Prompt injection in 1millionbot Millie chatbot | 1millionbot | technology | customer service | prompt injection | | reported |
| 30 Mar 2026 | Unauthenticated MCP endpoint in Nginx UI allows full nginx takeover (CVE-2026-33032) | Nginx UI | technology | workflow | misconfiguration | | confirmed |
| 28 Mar 2026 | CVE-2026-5002: Prompt injection in localGPT LLM prompt handler | PromtEngineer | technology | other | prompt injection | | reported |
| 27 Mar 2026 | Prompt injection bypasses "safe command" auto-approval in multiple AI coding extensions | | technology | coding | prompt injection | | reported |
| 27 Mar 2026 | LibreChat MCP/agent flaws enable SSRF and OAuth token exfiltration | LibreChat | technology | other | tool misuse | | resolved |
| 27 Mar 2026 | Zero-click prompt injection in nanobot AI assistant email channel (CVE-2026-33654) | HKUDS | technology | other | prompt injection | | resolved |
| 27 Mar 2026 | Command injection in OpenHands git diff API allows arbitrary commands in agent sandbox | OpenHands | technology | coding | tool misuse | | resolved |
| 27 Mar 2026 | KQL injection in Azure Data Explorer MCP Server (CVE-2026-33980) | pab1it0 (adx-mcp-server project) | technology | other | tool misuse | | resolved |
| 27 Mar 2026 | Path traversal in @mobilenext/mobile-mcp MCP server (CVE-2026-33989) | Mobile Next | technology | workflow | tool misuse | | resolved |
| 23 Mar 2026 | CVE-2026-23882: Arbitrary command execution via Blinko MCP server creation | Blinko | technology | workflow | tool misuse | | resolved |
| 22 Mar 2026 | CVE-2026-4530: SQL injection in Aix-DB text2sql agent terminology retriever | apconw | technology | other | unknown | | reported |
| 20 Mar 2026 | CVE-2026-33060: SSRF in CKAN MCP Server via unvalidated base_url parameter | ondata | technology | workflow | prompt injection | | resolved |
| 20 Mar 2026 | CVE-2026-33010: Wildcard CORS in mcp-memory-service exposes agent memories | doobidoo | technology | other | misconfiguration | | resolved |
| 20 Mar 2026 | FastGPT CI workflow flaw allows code execution and secret theft (CVE-2026-33075) | labring | technology | workflow | supply chain | | confirmed |
| 20 Mar 2026 | Multiple Langflow vulnerabilities, including unauthenticated RCE, fixed in 1.9.0 | Langflow | technology | workflow | excessive permissions | | resolved |
| 20 Mar 2026 | Multiple CVEs in PinchTab AI agent browser control server | PinchTab | technology | browsing | tool misuse | | confirmed |
| 20 Mar 2026 | Agentic tooling flaws: Claude Code trust bypass and MCP Go/Ruby SDK transport bugs | Anthropic | technology | coding | excessive permissions | | resolved |
| 19 Mar 2026 | Discourse XSS via prompt injection in AI triage Review Queue (CVE-2026-27740) | Discourse | technology | workflow | prompt injection | | resolved |
| 19 Mar 2026 | Rogue AI agent implicated in security incident at Meta | Meta | technology | other | unknown | | reported |
| 19 Mar 2026 | SQLBot stored prompt injection chain enables RCE (CVE-2026-32622) | DataEase | technology | other | prompt injection | | resolved |
| 19 Mar 2026 | Command injection flaws in Microsoft Copilot and M365 Copilot allow information disclosure | Microsoft | technology | other | unknown | | confirmed |
| 16 Mar 2026 | AnythingLLM 1.11.1 and earlier: missing authentication and SQL Agent injection flaws | Mintplex Labs | technology | workflow | tool misuse | | confirmed |
| 16 Mar 2026 | CVE-2026-4270: AWS API MCP Server file access restriction bypass | AWS | technology | other | excessive permissions | | resolved |
| 16 Mar 2026 | FastMCP OAuth token audience flaw (CVE-2025-69196) fixed in 2.14.2 | PrefectHQ | technology | other | excessive permissions | | resolved |
| 12 Mar 2026 | CVE-2026-32247: Cypher injection in Graphiti search filters exploitable via prompt injection | getzep | technology | other | prompt injection | | resolved |
| 11 Mar 2026 | ha-mcp Home Assistant MCP server: SSRF and XSS flaws in beta OAuth consent form | homeassistant-ai | technology | workflow | unknown | | resolved |
| 11 Mar 2026 | CVE-2026-32128: FastGPT Python sandbox file-write guardrail bypass via fcntl stdout remap | FastGPT (labring) | technology | coding | misconfiguration | | confirmed |
| 11 Mar 2026 | CVE-2026-31854: Cursor indirect prompt injection enables automatic command execution | Cursor | technology | coding | prompt injection | | resolved |
| 10 Mar 2026 | Microsoft discloses AI command injection in M365 Copilot and SSRF in Azure MCP Server | Microsoft | technology | workflow | prompt injection | | confirmed |
| 10 Mar 2026 | MCP Atlassian server flaws allow SSRF and arbitrary file write before v0.17.0 | sooperset | technology | workflow | tool misuse | | resolved |
| 7 Mar 2026 | mcp-memory-service exposes system details via unauthenticated health endpoint (CVE-2026-29787) | doobidoo | technology | other | misconfiguration | | resolved |
| 7 Mar 2026 | WeKnora MCP tool name collision enables prompt injection and tool hijacking | Tencent | technology | workflow | prompt injection | | resolved |
| 7 Mar 2026 | PinchTab SSRF in /download endpoint allows internal network and file access (CVE-2026-30834) | PinchTab | technology | browsing | excessive permissions | | resolved |
| 6 Mar 2026 | Agentgateway MCP-to-OpenAPI request injection flaw (CVE-2026-29791) | Agentgateway | technology | other | tool misuse | | resolved |
| 6 Mar 2026 | GitHub Copilot CLI shell tool bypass allows arbitrary code execution (CVE-2026-29783) | GitHub | technology | coding | prompt injection | | resolved |
| 5 Mar 2026 | OpenClaw agent platform: SSRF and RCE via prompt injection (CVE-2026-28451, CVE-2026-30741) | OpenClaw | technology | other | prompt injection | | confirmed |
| 5 Mar 2026 | Trivy VS Code extension 1.8.12 on OpenVSX compromised to exfiltrate secrets via AI agent | Aqua Security | technology | coding | supply chain | | resolved |
| 3 Mar 2026 | CVE-2025-12345: Remote buffer overflow in LLM-Claw agent deployment function | | technology | other | unknown | | resolved |
