| 2 Mar 2026 | CVE-2026-2256: command injection in ModelScope ms-agent via prompt-derived input | ModelScope | technology | other | prompt injection | | reported |
| 26 Feb 2026 | Zed editor agent file tools symlink escape (CVE-2026-27967) | Zed Industries | technology | coding | excessive permissions | | resolved |
| 26 Feb 2026 | Path traversal in MCP git server's git_add tool stages files outside repository | Model Context Protocol | technology | coding | tool misuse | | resolved |
| 26 Feb 2026 | Agenta LLMOps platform: sandbox escape RCE and SSTI in server-side evaluators | Agenta | technology | other | misconfiguration | | resolved |
| 26 Feb 2026 | Langflow CSV Agent node RCE via prompt injection (CVE-2026-27966) | Langflow | technology | workflow | prompt injection | | resolved |
| 25 Feb 2026 | CVE-2026-27597: Sandbox escape in Enclave AI agent JavaScript sandbox enables RCE | agentfront | technology | coding | unknown | | resolved |
| 25 Feb 2026 | LangChain SSRF redirect bypass and LangSmith Studio token-leak vulnerabilities | LangChain | technology | workflow | data leak | | resolved |
| 25 Feb 2026 | Parse Dashboard AI Agent endpoint flaws allow unauthenticated master-key database access | Parse Community | technology | other | excessive permissions | | resolved |
| 21 Feb 2026 | CVE-2026-27203: Environment variable injection in eBay API MCP Server | YosefHayim (ebay-mcp open source project) | technology | other | tool misuse | | reported |
| 19 Feb 2026 | Multiple OpenClaw AI assistant vulnerabilities disclosed, including prompt injection paths | OpenClaw | technology | other | prompt injection | | resolved |
| 19 Feb 2026 | CVE-2026-26057: Cisco Skill Scanner API server unauthenticated DoS and arbitrary file upload | Cisco | technology | other | misconfiguration | | resolved |
| 13 Feb 2026 | CVE-2026-26268: Cursor sandbox escape via writable .git configuration | Cursor | technology | coding | prompt injection | | resolved |
| 13 Feb 2026 | Reflected XSS in Cloudflare agents SDK AI Playground OAuth callback (CVE-2026-1721) | Cloudflare | technology | other | misconfiguration | | resolved |
| 11 Feb 2026 | Command injection in sf-mcp-server Salesforce MCP server (CVE-2026-26029) | akutishevsky | technology | workflow | tool misuse | | resolved |
| 10 Feb 2026 | Command injection flaws in GitHub Copilot and Visual Studio enable remote code execution | Microsoft | technology | coding | unknown | | confirmed |
| 10 Feb 2026 | FastGPT AI agent platform: unauthenticated plugin API access and SSRF flaws | labring | technology | workflow | excessive permissions | | resolved |
| 10 Feb 2026 | LangChain SSRF flaws in ChatOpenAI token counter and RecursiveUrlLoader | LangChain | technology | workflow | tool misuse | | resolved |
| 9 Feb 2026 | CVE-2026-1868: Template injection in GitLab AI Gateway Duo Workflow Service | GitLab | technology | workflow | unknown | | resolved |
| 9 Feb 2026 | CVE-2026-25905: mcp-run-python sandbox escape enables MCP server hijacking | | technology | coding | excessive permissions | | reported |
| 6 Feb 2026 | CVE-2026-25650: MCP Salesforce Connector leaks Salesforce auth token | smn2gnt | technology | workflow | data leak | | resolved |
| 6 Feb 2026 | Microsoft AI agent tooling flaws: Semantic Kernel file write and Copilot command injection | Microsoft | technology | coding | tool misuse | | resolved |
| 6 Feb 2026 | Pydantic AI framework patches path traversal XSS and SSRF vulnerabilities | Pydantic | technology | workflow | tool misuse | | resolved |
| 6 Feb 2026 | CVE-2026-25533: Sandbox escape in Enclave JavaScript sandbox for AI agent code | agentfront | technology | coding | excessive permissions | | resolved |
| 4 Feb 2026 | CVE-2026-25546: Command injection in godot-mcp MCP server enables RCE | Coding-Solo | technology | coding | tool misuse | | resolved |
| 4 Feb 2026 | OpenClaw path traversal in isValidMedia() enables arbitrary file read (CVE-2026-25475) | OpenClaw | technology | other | excessive permissions | | resolved |
| 4 Feb 2026 | AutoGPT platform SSRF in SendDiscordFileBlock (CVE-2025-62616) | Significant Gravitas | technology | workflow | tool misuse | | resolved |
| 3 Feb 2026 | Multiple Claude Code permission and sandbox bypass vulnerabilities patched | Anthropic | technology | coding | tool misuse | | resolved |
| 30 Jan 2026 | Prompt injection via road signs shown to hijack autonomous cars and drones | | technology | other | prompt injection | | reported |
| 30 Jan 2026 | Moltbook, a social network for AI agents, exposes its database and agent tokens | Moltbook | technology | other | misconfiguration | | resolved |
| 27 Jan 2026 | Hundreds of malicious skills found on the OpenClaw skill marketplace | OpenClaw | technology | workflow | supply chain | | resolved |
| 24 Jan 2026 | ChatterMate AI chatbot XSS via chat input exposes tokens (CVE-2026-24399) | ChatterMate | technology | customer service | data leak | | resolved |
| 24 Jan 2026 | Unauthenticated arbitrary file upload in Kalrav AI Agent WordPress plugin (CVE-2025-13374) | | technology | other | excessive permissions | | reported |
| 23 Jan 2026 | Unauthenticated command injection RCE in Framelink Figma and Ollama MCP servers | Framelink (Figma-Context-MCP); Ollama MCP Server | technology | other | tool misuse | | confirmed |
| 22 Jan 2026 | Three information disclosure flaws in Microsoft Copilot, Copilot Studio and M365 Copilot | Microsoft | technology | workflow | data leak | | confirmed |
| 21 Jan 2026 | Claude Code flaw let malicious repos exfiltrate Anthropic API keys (CVE-2026-21852) | Anthropic | technology | coding | data leak | | resolved |
| 21 Jan 2026 | CVE-2026-22792: 5ire MCP client HTML injection enables MCP server creation and RCE | nanbingxyz | technology | other | excessive permissions | | resolved |
| 19 Jan 2026 | Two CVEs in awesome-llm-apps agents: path traversal and cross-session token leak | awesome-llm-apps project | technology | other | data leak | | reported |
| 16 Jan 2026 | CVE-2026-23523: Dive MCP host deeplink allows arbitrary command execution | OpenAgentPlatform | technology | other | excessive permissions | | resolved |
| 16 Jan 2026 | MCPJam Inspector <=1.4.2 remote code execution via crafted MCP server install request | MCPJam | technology | coding | misconfiguration | | resolved |
| 14 Jan 2026 | CVE-2026-22708: Cursor agent allowlist bypass lets shell built-ins run unapproved | Cursor | technology | coding | prompt injection | | resolved |
| 14 Jan 2026 | Sandbox escape in Enclave JavaScript sandbox for AI agents (CVE-2026-22686) | agentfront | technology | coding | excessive permissions | | resolved |
| 12 Jan 2026 | CVE-2026-22785: Code injection in orval MCP server generation from OpenAPI specs | orval-labs | technology | coding | supply chain | | resolved |
| 12 Jan 2026 | OpenCode AI coding agent: unauthenticated local RCE and XSS in web UI | anomalyco | technology | coding | misconfiguration | | resolved |
| 12 Jan 2026 | Path traversal in Zen MCP Server allows arbitrary file reads (CVE-2025-66689) | BeehiveInnovations | technology | coding | data leak | | resolved |
| 12 Jan 2026 | CVE-2024-58340: ReDoS in LangChain MRKL agent output parser | LangChain | technology | workflow | prompt injection | | reported |
| 10 Jan 2026 | Tencent WeKnora agent flaws allow prompt-based DB access and command injection | Tencent | technology | other | prompt injection | | resolved |
| 7 Jan 2026 | CVE-2025-67366: Path traversal via symlinks in @sylphxltd/filesystem-mcp v0.5.8 | sylphxltd | technology | workflow | excessive permissions | | reported |
| 7 Jan 2026 | CVE-2025-9611: DNS rebinding in Microsoft Playwright MCP Server via missing Origin check | Microsoft | technology | browsing | misconfiguration | | resolved |
| 2 Jan 2026 | CVE-2026-21445: Missing authentication on Langflow API endpoints exposes conversation data | Langflow | technology | workflow | misconfiguration | | resolved |
| 1 Jan 2026 | Anthropic discloses fourth case of Claude accessing third-party systems without authorization | Anthropic | technology | other | misconfiguration | | confirmed |
