| 2 Jun 2026 | LibreChat MCP integration flaws leak server secrets and allow cross-agent file deletion | LibreChat | technology | other | data leak | | resolved |
| 2 Jun 2026 | CVE-2026-42073: OpenClaude MCP OAuth state check bypass allows callback server shutdown | Gitlawb | technology | coding | unknown | | resolved |
| 1 Jun 2026 | SSRF in horizon921 mcpilot 0.1.0 MCP API call endpoint (CVE-2026-10280) | horizon921 | technology | workflow | tool misuse | | reported |
| 1 Jun 2026 | Storm-3168 uses stolen Azure identities for destructive cloud attack | Microsoft | technology | other | misconfiguration | | confirmed |
| 1 Jun 2026 | Langroid SQLChatAgent prompt injection enables RCE on database host (CVE-2026-25879) | Langroid | technology | other | prompt injection | | resolved |
| 29 May 2026 | n8n-MCP flaws leak telemetry data and misroute multi-tenant n8n API calls | czlonkowski (n8n-mcp project) | technology | workflow | data leak | | resolved |
| 29 May 2026 | FastGPT SSRF and code sandbox escape flaws fixed in 4.15.0-beta1 | labring | technology | workflow | misconfiguration | | resolved |
| 29 May 2026 | CVE-2026-45555: RCE in Roslyn CodeLens MCP Server via unchecked analyzer DLL loading | MarcelRoozekrans | technology | coding | supply chain | | resolved |
| 29 May 2026 | CVE-2026-45312: RAGFlow Jinja2 template injection enables remote code execution | InfiniFlow | technology | workflow | prompt injection | | confirmed |
| 29 May 2026 | jqwik library contained hidden prompt injection telling AI coding agents to delete app output | jqwik | technology | coding | prompt injection | | reported |
| 28 May 2026 | AnythingLLM agent filesystem skills allow command execution and path escape | Mintplex Labs | technology | workflow | tool misuse | | resolved |
| 27 May 2026 | Gryph AI coding agent security layer logs sensitive file content (CVE-2026-45046) | SafeDep | technology | coding | data leak | | resolved |
| 27 May 2026 | CVE-2026-44830: Nocturne Memory MCP server auth bypass exposes agent memory | Dataojitori | technology | other | misconfiguration | | resolved |
| 26 May 2026 | LangChain and LangSmith SDK unsafe deserialization of untrusted serialized objects | LangChain | technology | other | excessive permissions | | resolved |
| 26 May 2026 | CVE-2026-44895: GitLab MCP Server HTTP transport exposes unauthenticated RPC endpoint | yoda-digital | technology | coding | misconfiguration | | resolved |
| 26 May 2026 | CVE-2026-44450: Lumiverse MCP server endpoint allows authenticated remote code execution | prolix-oc | technology | other | excessive permissions | | resolved |
| 26 May 2026 | CVE-2026-44209: SSTI to RCE in banks LLM prompt template library | masci | technology | other | misconfiguration | | resolved |
| 24 May 2026 | CVE-2026-9353: Prompt injection flaw in NousResearch hermes-agent Skills Guard | NousResearch | technology | other | prompt injection | | reported |
| 22 May 2026 | Command injection flaws in Microsoft Copilot and M365 Copilot (CVE-2026-41090, CVE-2026-42827) | Microsoft | technology | other | unknown | | confirmed |
| 22 May 2026 | CrowdSec: TanStack npm Attack Led to Theft of 170 Private GitHub Repos | CrowdSec | technology | other | supply chain | | confirmed |
| 21 May 2026 | Central Dogma Git mirror disables SSH host-key verification (CVE-2026-11745) | LINE | technology | other | misconfiguration | | confirmed |
| 15 May 2026 | CVE-2026-44717: RCE in MCP Calculate Server via unsanitized eval() | 611711Dark | technology | other | tool misuse | | resolved |
| 15 May 2026 | Microsoft APM agent dependency manager: path traversal and symlink flaws (3 CVEs) | Microsoft | technology | coding | supply chain | | resolved |
| 15 May 2026 | CVE-2026-45401: SSRF via unvalidated redirects in Open WebUI web retrieval | Open WebUI | technology | browsing | tool misuse | | resolved |
| 14 May 2026 | Multiple vulnerabilities disclosed in MCP Registry and rmcp Rust SDK | Model Context Protocol | technology | other | supply chain | | resolved |
| 14 May 2026 | Hatchet cross-tenant data exposure via missing authorization (CVE-2026-42572) | Hatchet | technology | workflow | misconfiguration | | resolved |
| 13 May 2026 | Vercel CLI leaked auth tokens in AI-agent non-interactive command output (CVE-2026-44479) | Vercel | technology | coding | data leak | | resolved |
| 13 May 2026 | GitHub Copilot CLI arbitrary code execution via nested bare git repository (CVE-2026-45033) | GitHub | technology | coding | tool misuse | | resolved |
| 12 May 2026 | CVE-2026-44246: Prompt injection in nnU-Net GitHub issue-triage agent workflow | MIC-DKFZ | technology | workflow | prompt injection | | resolved |
| 12 May 2026 | Unauthenticated RCE in Code Runner MCP Server HTTP transport (CVE-2026-5029) | | technology | coding | excessive permissions | | reported |
| 12 May 2026 | CVE-2026-44220: ciguard symlink traversal exposes files outside scan root | Jo-Jo98 (ciguard project) | technology | coding | data leak | | resolved |
| 12 May 2026 | Langflow path traversal in Knowledge Bases API allows arbitrary directory deletion | Langflow | technology | workflow | excessive permissions | | resolved |
| 12 May 2026 | CVE-2025-65719: Remote code execution in Kubectl MCP Server v1.1.1 | Open Source Kubectl MCP Server (rohitg00) | technology | other | unknown | | reported |
| 12 May 2026 | CVE-2026-42045: LobeChat artifact XSS chains to arbitrary command execution | LobeHub | technology | other | prompt injection | | resolved |
| 12 May 2026 | JunoClaw agent platform: shell command injection and SSRF flaws (CVE-2026-43990/43993) | JunoClaw | technology | workflow | tool misuse | | resolved |
| 12 May 2026 | JunoClaw agentic AI platform patches three MCP tool vulnerabilities | JunoClaw | technology | other | data leak | | resolved |
| 12 May 2026 | CVE-2026-42260: SSRF in Open-WebSearch MCP server URL safety checks | Aas-ee | technology | browsing | misconfiguration | | resolved |
| 12 May 2026 | OpenAI agent swarm tied to May 2026 RubyGems supply chain attack | OpenAI | technology | other | supply chain | | confirmed |
| 11 May 2026 | CVE-2026-42869: Hardcoded JWT secret in SOCFortress CoPilot allows admin token forgery | SOCFortress | technology | other | misconfiguration | | resolved |
| 11 May 2026 | CVE-2026-30635: Command injection in automagik-genie 2.5.27 MCP server | | technology | other | tool misuse | | reported |
| 11 May 2026 | CVE-2026-8319: Remote resource exhaustion in aiwaves-cn agents memory recall function | aiwaves-cn | technology | other | unknown | | reported |
| 11 May 2026 | CVE-2026-43901: Wireshark MCP server allows arbitrary export path via unsandboxed tool | bx33661 (Wireshark-MCP project) | technology | other | excessive permissions | | confirmed |
| 11 May 2026 | CVE-2026-31246: Command injection in GPT-Pilot Executor.run() enables RCE | Pythagora-io | technology | coding | tool misuse | | reported |
| 11 May 2026 | DeepChat CVE-2026-43899: external URL handler bypass enables code execution | ThinkInAIXYZ | technology | other | misconfiguration | | resolved |
| 8 May 2026 | PraisonAI MCP server path traversal enables arbitrary file write and code execution | PraisonAI | technology | workflow | tool misuse | | resolved |
| 8 May 2026 | Multiple vulnerabilities disclosed in FastGPT AI agent platform, including sandbox RCE | labring | technology | workflow | misconfiguration | | confirmed |
| 8 May 2026 | LiteLLM MCP preview endpoints allow authenticated users to run commands on proxy host | BerriAI | technology | other | excessive permissions | | resolved |
| 8 May 2026 | PromptHub SSRF via IPv6 bypass in skills fetch-remote endpoint (CVE-2026-42261) | PromptHub | technology | workflow | misconfiguration | | resolved |
| 7 May 2026 | Microsoft discloses multiple Copilot injection and access control CVEs (May 2026) | Microsoft | technology | other | prompt injection | | confirmed |
| 6 May 2026 | Multiple OpenClaw MCP and gateway vulnerabilities patched (CVE-2026-44118, -44995, -45001) | OpenClaw | technology | other | excessive permissions | | resolved |
