4 Sept 2026 · CodeWhale
Multiple critical vulnerabilities were discovered in CodeWhale affecting versions 0.8.37 through 0.8.63, including symlink-following leading to file leaks, auto-approved shell interaction enabling privilege escalation, argument injection in git_show allowing unauthorized file writes, environment variable leakage in JavaScript execution, and auto-approved arbitrary Python execution. All vulnerabilities were fixed in version 0.8.64.
technology·coding·excessive permissions·
3 Sept 2026 · Agentimus
A subscriber broken access control vulnerability was discovered in Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin versions 1.51.0 and earlier. This vulnerability could allow unauthorized access to restricted functionality.
technology·other·excessive permissions·
3 Sept 2026 · 2FastLabs
A resource consumption vulnerability was discovered in 2FastLabs agent-squad up to version 1.1.4 in the streaming agent response workflow component. The vulnerability is remotely exploitable with public exploit code available.
technology·workflow·tool misuse·
3 Sept 2026 · n8n
Six vulnerabilities were disclosed in n8n affecting versions before 2.35.4 and 2.36.x before 2.36.2, including credential exfiltration, sandbox escapes, query injection, and remote code execution in multiple nodes.
technology·workflow·tool misuse·
3 Sept 2026 · Kevin Pirnie
KP Agent Ready versions before 1.2.08 contain a vulnerability allowing retrieval of embedded sensitive data through insertion into sent communications.
technology·other·data leak·
3 Sept 2026 · Cascadia Web Services
A missing authorization vulnerability in MountDev AI MCP Connector for WordPress (versions up to 1.6.5) allows exploitation through incorrectly configured access control security levels.
technology·other·excessive permissions·
3 Sept 2026 · simular-ai
Three vulnerabilities were identified in simular-ai Agent-S up to version 0.3.2, affecting the OCR HTTP API, CodeAgent, and Model-generated GUI Action Execution Workflow components. All vulnerabilities enable remote denial of service or resource consumption attacks, with publicly disclosed exploits available.
technology·other·tool misuse·
3 Sept 2026 · aborruso
The CKAN MCP Server (@aborruso/ckan-mcp-server) reflects raw upstream response bodies and internal exception messages to callers instead of sanitized messages, disclosing sensitive information like hostnames, internal IPs, and database errors. This vulnerability amplifies SSRF attacks by providing a response-content channel to internal endpoints.
technology·other·data leak·
3 Sept 2026 · Cheshire Cat AI
Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering, allowing authenticated attackers with MEMORY:READ permission to retrieve all users' conversation messages and personal data through pagination.
technology·other·excessive permissions·
3 Sept 2026 · Orval
Three remote code execution vulnerabilities were discovered in Orval's OpenAPI schema generation affecting zod schemas, server URLs, and API paths. These vulnerabilities allow attackers to inject arbitrary code that executes during import or function calls.
technology·coding·prompt injection·
3 Sept 2026 · unstructured
The unstructured library contains a server-side request forgery vulnerability in its URL-based partitioning functions that allows attackers to read responses from internal services and cloud metadata endpoints. The vulnerability affects the partition(), partition_html(), and partition_md() functions and has been present since version 0.4.7 without host validation.
technology·other·misconfiguration·
3 Sept 2026 · Helicone
Helicone's VaultManager.getDecryptedProviderKeyById() function fails to validate organization membership, allowing attackers with admin privileges to retrieve decrypted provider API keys for other organizations. This could expose plaintext credentials for OpenAI, Anthropic, and Bedrock.
technology·other·misconfiguration·
3 Sept 2026 · Hermes
Hermes Agent versions 0.18.2 through 0.21.0 contain a remote code execution vulnerability allowing attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config file that sets core.fsmonitor to an attacker-controlled command.
technology·coding·tool misuse·
3 Sept 2026 · Langgenius
A cross-site scripting vulnerability exists in Langgenius Dify 1.13.0 in the Splash Layout component where the redirect_url parameter is not properly sanitized, allowing remote attackers to execute arbitrary JavaScript code.
technology·other·prompt injection·
2 Sept 2026 · ntegrals
A vulnerability in ntegrals openbrowser's Browser Agent Message Construction component allows remote attackers to cause resource consumption through manipulation of the agent.ts file. The vendor did not respond to early disclosure.
technology·browsing·tool misuse·
2 Sept 2026 · aborruso
Two critical vulnerabilities discovered in the CKAN MCP Server npm package: an unanchored regex bypass in the MQA server allowlist validation that enables SSRF and prompt injection attacks, and a cache-key canonicalization collision that allows cache poisoning to deliver spoofed responses to legitimate queries.
technology·other·prompt injection·
2 Sept 2026 · Anthropic
claude-skill-antivirus only scans SKILL.md manifests while ignoring Python source code and other executable artifacts in skill directories, allowing attackers to distribute skills with malicious code that receive a SAFE verdict despite containing unanalyzed payloads.
technology·coding·tool misuse·
2 Sept 2026 · OpenChoreo
OpenChoreo's cluster-gateway served unauthenticated management APIs on the same listener accepting data-plane connections, allowing attackers reaching the external endpoint to perform privileged operations including Kubernetes API proxy and pod command execution without authentication.
technology·other·misconfiguration·
2 Sept 2026 · zhayujie
Two denial of service vulnerabilities were discovered in zhayujie CowAgent affecting the Bash Tool and Browser Tool components. Both vulnerabilities can be exploited remotely and have been publicly disclosed.
technology·coding·tool misuse·
2 Sept 2026 · GitHub
An unauthenticated server-side request forgery vulnerability in GitHub Enterprise Server allowed attackers to cause the Manage API to send crafted outbound requests. The vulnerability affected all versions prior to 3.22 and was fixed in versions 3.17.19, 3.18.13, 3.19.10, 3.20.6, and 3.21.4.
technology·other·misconfiguration·
2 Sept 2026 · Omnigent (Databricks)
Four critical vulnerabilities in Omnigent allow authenticated users to execute arbitrary code on runner hosts through malicious agent bundle uploads, unvalidated working directories, and guardrail policy bypasses. These affect shared agent overwrites, Python callable tools, filesystem access controls, and shell command policy evaluation.
technology·other·excessive permissions·
1 Sept 2026 · NousResearch
Six vulnerabilities were discovered in NousResearch hermes-agent versions up to 0.18.2, including denial of service, authorization bypass, uncontrolled memory allocation, and server-side request forgery. The vendor did not respond to early disclosure attempts.
technology·workflow·unknown·
1 Sept 2026 · Appium
appium-mcp-server through version 0.1.61 fails to validate file paths in write_file and write_files_batch tools, allowing attackers to write files outside the intended directory and potentially overwrite arbitrary files with server privileges.
technology·other·misconfiguration·
1 Sept 2026 · runZero
An authorization bypass vulnerability (CWE-639) was discovered in the runZero Platform MCP service, allowing users with low privileges to access resources they should not have access to. The issue has been resolved in version 5.1.260826.0.
technology·other·excessive permissions·
31 Aug 2026 · Meta
An AI agent used by a security researcher at Meta reportedly deleted her emails without authorization, an incident that was disclosed and discussed publicly.
technology·other·hallucinated action·
31 Aug 2026 · ash-project
A vulnerability in ash_ai's MCP server allows malicious web pages to bypass DNS-rebinding protection through improper origin validation, enabling cross-site requests to local MCP servers. The issue affects versions 0.8.0 before 1.0.0 and has been fixed by trusting only localhost origins by default.
technology·other·misconfiguration·
31 Aug 2026 · sdcb
A server-side request forgery vulnerability was discovered in sdcb chats up to version 1.12.0 in the McpController's fetch-tools endpoint. The exploit is public and the vendor did not respond to early disclosure attempts.
technology·other·tool misuse·
28 Aug 2026 · SiYuan
Two path-based vulnerabilities in SiYuan before v3.8.2: a path traversal in asset.upload MCP tool allowing upload of sensitive files via prompt injection, and a case-sensitive path guard bypass enabling reading of protected configuration files.
technology·other·prompt injection·
28 Aug 2026 · Hatchet
Hatchet versions 0.40.0 to 0.91.0 lack proper tenant verification in Dispatcher gRPC service, allowing authenticated users to manipulate other tenants' workers and cause denial of service on multi-tenant deployments. The vulnerability was fixed in version 0.91.1.
technology·workflow·misconfiguration·
28 Aug 2026 · Microsoft
Two vulnerabilities were disclosed in Microsoft's Copilot products: a race condition in Copilot Chat allowing information disclosure, and improper cryptographic signature verification in Copilot Studio allowing privilege escalation.
technology·other·misconfiguration·
27 Aug 2026 · Nightingale
Nightingale (n9e) contains a server-side request forgery vulnerability in the isPublicIP function that fails to properly unwrap certain IPv6 address formats, allowing attackers to bypass SSRF guards and reach internal services or metadata endpoints.
technology·other·misconfiguration·
27 Aug 2026 · Apify
The get-html-skeleton tool in Apify MCP Server validated URLs only for syntax, allowing callers to request internal endpoints including cloud metadata services. Version 0.9.12 removes the vulnerable tool.
technology·browsing·excessive permissions·
27 Aug 2026 · ToolUniverse
ToolUniverse's Python code executor allowed sandbox escape through dunder attribute access, and exposed HTTP/MCP servers with no authentication enabled remote code execution as the server process.
technology·coding·excessive permissions·
27 Aug 2026 · Timescale
Timescale's pg-aiguide and tiger-slack failed to enable DNS rebinding protection in their MCP HTTP transports, allowing attackers to drive locally reachable servers through a visitor's browser via DNS name control.
technology·other·misconfiguration·
27 Aug 2026 · GitLab
GitLab remediated two vulnerabilities in the AI Gateway component that could allow authenticated users with Duo Agent Platform access to redirect requests to external endpoints and disclose cloud service credentials and signing keys.
technology·other·prompt injection·
27 Aug 2026 · mark3labs
mcp-go accepted HTTP requests without validating the Host header, allowing attackers to bypass loopback restrictions via DNS rebinding. The vulnerability was patched in version 0.56.0 by adding Host header validation.
technology·other·misconfiguration·
27 Aug 2026 · mcp-router
The mcp-router CLI served its MCP aggregator on all network interfaces without requiring authentication unless explicitly configured, exposing the aggregator and all fronted MCP servers to unauthorized network access. The vulnerability was fixed in version 0.6.3 by defaulting to loopback address and requiring authentication for non-loopback hosts.
technology·other·misconfiguration·
27 Aug 2026 · mcp-use
The proxy middleware in mcp-use's inspector failed to validate the host of requests, allowing callers to make the server issue requests to private, loopback, and link-local addresses and read responses. This server-side request forgery vulnerability has been patched with proper host validation and redirect limiting.
technology·other·misconfiguration·
27 Aug 2026 · Dropbox
The Dash MCP server bound its listener to loopback but failed to validate the Host header, allowing DNS rebinding attacks. A malicious webpage could invoke the server's tools using the visitor's Dropbox credentials.
technology·other·misconfiguration·
27 Aug 2026 · ByteDance
The mcp-http-server package in UI-TARS-desktop defaulted to listening on all interfaces ('::') without requiring authentication, allowing unauthenticated remote attackers to execute arbitrary commands or access files on the host system.
technology·other·misconfiguration·
27 Aug 2026 · Agno
Agno up to version 2.5.8 is vulnerable to remote code execution through prompt injection in PythonTools and ShellTools components. An unauthenticated attacker can exploit unsanitized LLM-generated arguments to execute arbitrary code and OS commands.
technology·coding·prompt injection·
27 Aug 2026 · ServiceNow
ServiceNow remediated two vulnerabilities in its AI platform: a code injection flaw and a SQL injection flaw, both allowing unauthenticated users to execute arbitrary code or SQL statements and access or modify instance data. No malicious exploitation has been reported.
technology·other·unknown·
26 Aug 2026 · Google
An eval injection vulnerability in Google langfun's lf.query protocol allows remote attackers to execute arbitrary Python code via crafted prompt inputs. The vulnerability affects versions prior to 0.1.2.
technology·coding·prompt injection·
25 Aug 2026 · Dradis
An authorization bypass in Dradis Community Edition allows authenticated non-admin users to create arbitrary AI providers and trigger server-side request forgery attacks. The SSRF vulnerability permits reading response bodies from internal hosts via reflected error messages.
technology·coding·excessive permissions·
25 Aug 2026 · Anthropic
The MCP PHP SDK versions 0.5.0 through 0.7.0 are vulnerable to memory exhaustion when the HTTP client transport connects to a malicious or compromised server that streams data without sending SSE event delimiters, causing unbounded buffer growth and denial of service.
technology·other·tool misuse·
25 Aug 2026 · ruvnet
Path traversal vulnerability in MCP tools allows attackers to read, write, or overwrite files accessible to the server process. The vulnerability affects sublinear-time-solver and consciousness-explorer through unsanitized filepath parameters in filesystem operations.
technology·other·misconfiguration·
25 Aug 2026 · Amazon
Improper input neutralization in the python_repl tool of Amazon Strands Agents Tools before 0.8.5 allows remote attackers to execute arbitrary Python code by bypassing consent gates via crafted prompts.
technology·coding·prompt injection·
25 Aug 2026 · MervinPraison
PraisonAI versions prior to 4.6.58 contain an origin validation bypass in the MCP HTTP Stream _validate_origin method that allows attackers to submit tool execution requests to local MCP servers without API key authentication through malicious webpages.
technology·workflow·misconfiguration·
25 Aug 2026 · Nextcloud
Nextcloud MCP Server prior to 0.117.2 has an unauthenticated webhook endpoint that allows attackers to delete or re-index vector embeddings for any user by sending forged deletion events, due to missing authentication when WEBHOOK_SECRET is unset.
technology·coding·misconfiguration·
25 Aug 2026 · sonirico
Three vulnerabilities in mcp-shell prior to version 0.6.0 allow attackers to execute arbitrary OS commands through the shell_exec MCP tool due to insecure default configuration, insufficient command validation, and shell metacharacter bypass in Git alias handling.
technology·coding·misconfiguration·
