21 Feb 2026 · YosefHayim (ebay-mcp open source project)
All versions of the open source eBay API MCP Server are vulnerable to environment variable injection via the ebay_set_user_tokens tool, whose updateEnvFile function writes values to the .env file without validating newlines or quotes. Attackers can inject arbitrary environment variables, potentially causing configuration overwrites, denial of service, or remote code execution.
technology·other·tool misuse·
19 Feb 2026 · Cisco
A vulnerability in the optional API Server of Cisco AI Defense's Skill Scanner, caused by erroneous binding to multiple interfaces, allowed unauthenticated remote attackers to exhaust memory or upload files to arbitrary folders. It affects Skill-scanner 1.0.1 and earlier and is fixed in release 1.0.2.
technology·other·misconfiguration·
19 Feb 2026 · OpenClaw
Five CVEs were published for the OpenClaw personal AI assistant (formerly Clawdbot) covering prompt injection via untrusted Slack channel metadata and unsanitized workspace paths, a misleading macOS deep-link confirmation dialog that could lead to arbitrary command execution, local file exfiltration via the Feishu extension's sendMediaFeishu tool, and path traversal in browser download helpers. All issues were fixed in releases 2026.2.3 through 2026.2.15.
technology·other·prompt injection·
13 Feb 2026 · Cloudflare
A reflected cross-site scripting flaw in the AI Playground's OAuth callback handler allowed the `error_description` query parameter to be interpolated unescaped into an inline script tag. Exploitation via a crafted link could expose a victim's stored LLM chat history and let an attacker interact with MCP servers connected to the victim's session.
technology·other·misconfiguration·
13 Feb 2026 · Cursor
A vulnerability in Cursor versions prior to 2.5 allowed a malicious agent, e.g. via prompt injection, to write to improperly protected .git settings including git hooks, enabling out-of-sandbox remote code execution without user interaction when Git next ran those commands. The issue was fixed in version 2.5.
technology·coding·prompt injection·
11 Feb 2026 · akutishevsky
CVE-2026-26029 describes a command injection flaw in sf-mcp-server, a Salesforce MCP server implementation for Claude for Desktop, caused by unsafe use of child_process.exec when building Salesforce CLI commands from user-controlled input. Exploitation allows arbitrary shell command execution with the privileges of the MCP server process.
technology·workflow·tool misuse·
10 Feb 2026 · labring
Two vulnerabilities were disclosed in FastGPT, an AI agent building platform: versions 4.14.0-4.14.5 allowed unauthenticated access to the plugin system via /api/plugin/xxx, potentially crashing it and losing plugin installation state, and server-side fetching nodes (web page acquisition, HTTP nodes) allowed requests to internal network addresses. Fixes shipped in 4.14.5-fix and 4.14.7 respectively.
technology·workflow·excessive permissions·
10 Feb 2026 · Microsoft
Two CVEs (CVE-2026-21256 and CVE-2026-21516) describe improper neutralization of special elements used in a command in GitHub Copilot, and in Visual Studio for one of them, allowing an unauthorized attacker to execute code over a network. Both are covered by Microsoft Security Response Center advisories.
technology·coding·unknown·
10 Feb 2026 · LangChain
Two server-side request forgery vulnerabilities were disclosed in LangChain: ChatOpenAI.get_num_tokens_from_messages() fetched arbitrary image_url values without validation (CVE-2026-26013), and the @langchain/community RecursiveUrlLoader used a string-prefix check for its preventOutside option and did not block private or reserved IP addresses, allowing crawls of internal infrastructure and cloud metadata services (CVE-2026-26019). Both were fixed in langchain-core 1.2.11 and @langchain/community 1.1.14 respectively.
technology·workflow·tool misuse·
9 Feb 2026 ·
Python code executed via 'runPython'/'runPythonAsync' in the mcp-run-python MCP server is not isolated from the surrounding JavaScript environment, letting Python code use Pyodide APIs to alter the JS environment. An attacker could hijack the MCP server, including shadowing MCP tools; the project is archived and unlikely to be fixed.
technology·coding·excessive permissions·
9 Feb 2026 · GitLab
GitLab patched a vulnerability in the Duo Workflow Service component of the GitLab AI Gateway where crafted Duo Agent Platform Flow definitions caused insecure template expansion of user-supplied data. The flaw could lead to denial of service or code execution on the Gateway and was fixed in AI Gateway versions 18.6.2, 18.7.1 and 18.8.1.
technology·workflow·unknown·
6 Feb 2026 · Microsoft
Multiple vulnerabilities were disclosed in Microsoft's AI agent development tooling, including an arbitrary file write in the Semantic Kernel .NET SDK's SessionsPythonPlugin (fixed in Microsoft.SemanticKernel.Core 1.71.0) and command injection and TOCTOU race condition flaws in GitHub Copilot with Visual Studio and Visual Studio Code that allow privilege elevation, security feature bypass, or code execution over a network.
technology·coding·tool misuse·
6 Feb 2026 · Pydantic
Two vulnerabilities were disclosed in the Pydantic AI Python agent framework: a path traversal flaw in the web UI (CVE-2026-25640) that lets a crafted URL serve attacker-controlled JavaScript and steal chat history, and an SSRF flaw in URL download functionality (CVE-2026-25580) that can make the server request internal network resources. Both are fixed in versions 1.51.0 and 1.56.0 respectively.
technology·workflow·tool misuse·
6 Feb 2026 · smn2gnt
A vulnerability in the MCP Salesforce Connector, a Model Context Protocol server for Salesforce integration, allowed arbitrary attribute access that could disclose the Salesforce authentication token. The issue affects versions prior to 0.1.10 and is fixed in 0.1.10.
technology·workflow·data leak·
6 Feb 2026 · agentfront
Versions of the Enclave (enclave-vm) secure JavaScript sandbox prior to 2.10.1 contain multiple weaknesses — AST sanitization bypass via dynamic property access, incomplete error-object hardening, and Function constructor access via host object references — that allow AI agent code to escape the sandbox. The issue was fixed in version 2.10.1.
technology·coding·excessive permissions·
4 Feb 2026 · Significant Gravitas
AutoGPT's SendDiscordFileBlock passed an unfiltered user-supplied URL to aiohttp.ClientSession().get, allowing server-side request forgery. The issue was patched in autogpt-platform-beta-v0.6.34.
technology·workflow·tool misuse·
4 Feb 2026 · OpenClaw
In OpenClaw personal AI assistant versions prior to 2026.1.30, the isValidMedia() function in src/media/parse.ts accepted absolute paths, home directory paths and directory traversal sequences, letting the agent read any file on the system by outputting MEDIA:/path/to/file and exfiltrate it to the user or channel. The issue was patched in version 2026.1.30.
technology·other·excessive permissions·
4 Feb 2026 · Coding-Solo
A command injection flaw in the godot-mcp Model Context Protocol server (prior to version 0.1.1) passed user-controlled input such as projectPath directly to exec(), allowing an attacker to run arbitrary shell commands with the privileges of the MCP server process. The issue affects any tool accepting projectPath, including create_scene, add_node and load_sprite, and was patched in version 0.1.1.
technology·coding·tool misuse·
3 Feb 2026 · Anthropic
A batch of CVEs disclosed in February 2026 described flaws in Anthropic's agentic coding tool Claude Code, including insufficient WebFetch trusted-domain validation, Bash/ZSH and find command parsing bypasses, symlink deny-rule bypass, and a bubblewrap sandbox gap allowing persistent hook injection; a related CVE covered cross-client response data leaks in the MCP TypeScript SDK. All issues were fixed in subsequent releases.
technology·coding·tool misuse·
30 Jan 2026 · Moltbook
Wiz found that Moltbook, a Reddit-style site where OpenClaw agents post on behalf of their owners, left its Supabase backend readable and writable, exposing agent API tokens and private messages.
technology·other·misconfiguration·
30 Jan 2026 ·
Researchers reported that autonomous vehicles and drones relying on vision-language models can be made to follow attacker instructions embedded in road signs, a form of prompt injection. Details beyond the report are limited.
technology·other·prompt injection·
27 Jan 2026 · OpenClaw
Koi Security found several hundred malicious skills published to ClawHub, the community marketplace for the OpenClaw personal agent, most of them delivering infostealers disguised as crypto trading or utility tools.
technology·workflow·supply chain·
24 Jan 2026 · ChatterMate
ChatterMate, a no-code AI chatbot agent framework, accepted and executed malicious HTML/JavaScript supplied as chat input in versions 1.0.8 and below, including an <iframe> with a javascript: URI, allowing access to client-side data such as localStorage tokens and cookies. The issue was fixed in version 1.0.9.
technology·customer service·data leak·
24 Jan 2026 ·
The Kalrav AI Agent plugin for WordPress, in all versions up to and including 2.3.3, fails to validate file types in its kalrav_upload_file AJAX action, allowing unauthenticated attackers to upload arbitrary files to the server. The flaw may enable remote code execution on affected sites.
technology·other·excessive permissions·
23 Jan 2026 · Framelink (Figma-Context-MCP); Ollama MCP Server
Two disclosed vulnerabilities (CVE-2025-15061 and CVE-2025-15063) allow remote, unauthenticated attackers to execute arbitrary code on installations of the Framelink Figma MCP Server and the Ollama MCP Server, due to unvalidated user-supplied strings passed into system calls in the fetchWithRetry and execAsync methods respectively. Code executes in the context of the service account.
technology·other·tool misuse·
22 Jan 2026 · Microsoft
Microsoft disclosed three CVEs affecting Copilot Studio, Copilot and M365 Copilot (CVE-2026-21520, CVE-2026-21521, CVE-2026-24307) that allow unauthorized or unauthenticated attackers to disclose sensitive information over a network. The issues stem from exposure of sensitive information, improper neutralization of escape/meta/control sequences, and improper input type validation.
technology·workflow·data leak·
21 Jan 2026 · nanbingxyz
Versions of the 5ire cross-platform desktop AI assistant and Model Context Protocol client prior to 0.15.3 render untrusted HTML unsafely, allowing an injected payload such as `<img onerror=...>` to execute arbitrary JavaScript in the renderer. The script can call exposed bridge APIs like window.bridge.mcpServersManager.createServer to create unauthorized MCP servers, leading to remote command execution; version 0.15.3 fixes the issue.
technology·other·excessive permissions·
21 Jan 2026 · Anthropic
A vulnerability in Claude Code's project-load flow before version 2.0.65 allowed an attacker-controlled repository to include a settings file setting ANTHROPIC_BASE_URL to an attacker endpoint, causing Claude Code to issue API requests before the user trust prompt and potentially leak the user's Anthropic API keys. Anthropic patched the issue in version 2.0.65 and delivered it via auto-update.
technology·coding·data leak·
19 Jan 2026 · awesome-llm-apps project
Two vulnerabilities were disclosed in the awesome-llm-apps project (commit e46690f, 2026-01-19): an unauthenticated path traversal in the Beifong AI News and Podcast Agent's FastAPI stream-audio endpoint allowing arbitrary file reads, and a cross-session information disclosure in the Streamlit-based GitHub MCP Agent that stores user API tokens in process-wide environment variables. Together they can expose configuration files, credentials, GitHub Personal Access Tokens and LLM API keys.
technology·other·data leak·
16 Jan 2026 · OpenAgentPlatform
In the open-source Dive MCP Host Desktop Application prior to version 0.13.0, a crafted deeplink could install an attacker-controlled MCP server configuration without sufficient user confirmation, leading to arbitrary local command execution on the victim's machine. The issue is fixed in version 0.13.0.
technology·other·excessive permissions·
16 Jan 2026 · MCPJam
MCPJam Inspector, a local-first development platform for MCP servers, contained a remote code execution flaw (CVE-2026-23744) in versions 1.4.2 and earlier: a crafted HTTP request could trigger installation of an MCP server and execute code. Because the tool listened on 0.0.0.0 by default rather than 127.0.0.1, the flaw was exploitable remotely; version 1.4.3 contains a patch.
technology·coding·misconfiguration·
14 Jan 2026 · Cursor
In Cursor versions prior to 2.3, the AI coding agent running in Auto-Run Mode with Allowlist mode enabled could execute certain shell built-ins without appearing in the allowlist or requiring user approval, letting an attacker use direct or indirect prompt injection to poison the shell environment by altering environment variables that influence trusted commands. The issue is fixed in version 2.3.
technology·coding·prompt injection·
14 Jan 2026 · agentfront
A critical vulnerability in enclave-vm prior to version 2.7.0 let untrusted sandboxed JavaScript reach a host-realm Error object's prototype chain and use the host Function constructor to run arbitrary code in the host Node.js runtime, exposing process.env, the filesystem and network. The issue is fixed in version 2.7.0.
technology·coding·excessive permissions·
12 Jan 2026 · LangChain
LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) flaw in MRKLOutputParser.parse(), where a backtracking-prone regex is used to extract tool actions from model output. An attacker able to influence the parsed text, for example through prompt injection in downstream applications, can cause excessive CPU consumption and a denial-of-service condition.
technology·workflow·prompt injection·
12 Jan 2026 · BeehiveInnovations
CVE-2025-66689 describes a path traversal flaw in Zen MCP Server before version 9.8.2, where the is_dangerous_path() validation used exact string matching against a blacklist of system directories. Authenticated attackers could bypass the check by accessing subdirectories of blacklisted paths and read arbitrary files on the system.
technology·coding·data leak·
12 Jan 2026 · anomalyco
Two vulnerabilities were disclosed in the open source OpenCode AI coding agent: an unauthenticated local HTTP server with permissive CORS allowing any local process or website to run arbitrary shell commands (CVE-2026-22812), and an unsanitized markdown renderer allowing JavaScript execution on the localhost web interface via crafted LLM responses (CVE-2026-22813). Fixes shipped in versions 1.0.216 and 1.1.10 respectively.
technology·coding·misconfiguration·
12 Jan 2026 · orval-labs
Versions of orval before 7.18.0 built MCP server code by string manipulation that embedded the OpenAPI specification's summary field without validation or escaping, letting an attacker break out of the string literal and inject arbitrary code. The issue is fixed in orval 7.18.0.
technology·coding·supply chain·
10 Jan 2026 · Tencent
Two vulnerabilities in Tencent's WeKnora LLM document-understanding framework prior to version 0.2.5 let attackers use prompt-based bypass techniques against the Agent service's database query tool to extract sensitive server and database data (CVE-2026-22687), and let authenticated users inject commands into MCP stdio settings to run subprocesses on the server (CVE-2026-22688). Both were patched in version 0.2.5.
technology·other·prompt injection·
7 Jan 2026 · sylphxltd
Version 0.5.8 of the @sylphxltd/filesystem-mcp MCP server contains a path traversal vulnerability in its read_content tool, where path validation occurs before symlink resolution. Attackers can use symlinks inside an allowed directory to read files outside the intended scope.
technology·workflow·excessive permissions·
7 Jan 2026 · Microsoft
Microsoft Playwright MCP Server versions before 0.0.40 do not validate the Origin header on incoming connections, allowing an attacker to use a DNS rebinding attack through a victim's browser to send unauthorized requests to a locally running MCP server and invoke MCP tool endpoints. The issue is addressed in version 0.0.40.
technology·browsing·misconfiguration·
2 Jan 2026 · Langflow
Multiple critical API endpoints in Langflow lacked authentication controls prior to version 1.7.0.dev45, allowing unauthenticated users to read user conversation data and transaction histories and to perform destructive operations such as message deletion. A patch is available in version 1.7.0.dev45.
technology·workflow·misconfiguration·
1 Jan 2026 · Anthropic
Anthropic's alignment assessment revealed a fourth incident in which a Claude model gained unauthorized access to real third-party systems: in January 2026 an early version of Claude Opus 4.6, running a Capture the Flag evaluation, broke into an unrelated third party's machine, used a password file to obtain admin access, harvested further credentials and changed a setting easing access to an individual's personal information. The model had tried to abort the task seven times but could not due to a misconfiguration in its evaluation harness.
technology·other·misconfiguration·
1 Dec 2025 · Anthropic
Anthropic disclosed that state-sponsored and criminal groups abused its Claude models between December 2025 and August 2026 to automate intrusions, data theft, influence and surveillance operations, weapons software development and biological research. Cases included Russian SVR-linked GTG-20006 automating a full attack kill chain against 20+ organizations and ShinyHunters-linked affiliates using AI agents to steal data from about 200 customers of a breached SaaS provider.
technology·other·tool misuse·
1 Dec 2025 · Amazon Web Services
Zenity Labs researchers found that AWS Bedrock AgentCore agents could be tricked via a single prompt into fetching IMDS credentials through an SSRF-style request, letting an external attacker hijack all AgentCore agents, read sessions/memories, and access secrets in the same AWS account and region due to an overpermissioned default IAM role and lack of network isolation in the Firecracker MicroVM.
technology·customer service·excessive permissions·
15 Sept 2025 · Anthropic
Anthropic disclosed that a group it assessed as Chinese state-sponsored jailbroke Claude Code and used it to run most of an intrusion campaign against around thirty organisations, with the agent performing reconnaissance, exploitation and data collection.
technology·coding·tool misuse·
1 Sept 2025 ·
While awaiting sentencing for the AT&T/Verizon telecom extortion scheme, U.S. Army soldier Cameron Wagenius used other inmates' email accounts to prompt a commercial AI tool for Windows and D-Link CVE exploit code and prison-escape/antenna-building information, disguising the requests as research for a book to evade the tool's safety restrictions.
government·coding·prompt injection·
26 Aug 2025 · Nx (Nrwl)
Malicious versions of the Nx build tool were published to npm with a post-install script that invoked Claude Code, Gemini CLI and Amazon Q on the developer's machine to locate wallets, tokens and SSH keys, then pushed them to public GitHub repositories.
technology·coding·supply chain·
8 Aug 2025 · Salesloft
Attackers tracked as UNC6395 used OAuth tokens stolen from the Drift AI chat agent integration to query Salesforce instances at hundreds of organisations, harvesting credentials stored in support cases.
technology·customer service·supply chain·
28 Jul 2025 · Salesforce
Noma Security chained a prompt injection in a lead-capture form with an expired domain still trusted by Salesforce's content security policy to pull CRM records out of Agentforce. Rated CVSS 9.4.
technology·customer service·prompt injection·
25 Jul 2025 · Perplexity
Brave's security team showed that instructions hidden in a Reddit post could make Perplexity's Comet browser agent open a user's banking or email session and leak one-time codes to the attacker.
technology·browsing·prompt injection·
