plaincve:~$

Topics /

AI security

LLM apps, AI gateways, agent frameworks and the model supply chain

Vulnerability · KEV
CVE-2026-90553
vLLM LlavaOnevision2 ignores trust_remote_code
AI securitySupply chainImproper trust
High7.8Not listed2026-07-11
CVE-2026-82021
Hermes Agent MCP catalog not pinned to a commit
Supply chainAI securityUnpinned dependency
Critical9.0Not listed2026-07-07
CVE-2026-45321
TanStack npm release pipeline hijack
Supply chainAI securityMalicious code injection
Critical9.6Listed2026-05-11
CVE-2026-45758
guardrails-ai malicious PyPI release
Supply chainAI securityMalicious code injection
Critical9.6Not listed2026-05-11
CVE-2026-33634
Trivy and trivy-action trojanized
Supply chainAI securityMalicious code injection
High8.8Listed2026-03-19
CVE-2026-33017
Langflow public flow unauthenticated RCE
AI securityRemote code execution
Critical9.8Listed—
CVE-2026-59822
LiteLLM MCP gateway auth bypass
AI securityAuthentication bypass
High8.2Listed2026-02-07
CVE-2026-5241
Transformers LightGlue config overrides trust_remote_code
AI securitySupply chainImproper trust
Critical9.6Not listed2025-07-25
CVE-2026-12537
Gemini CLI headless workspace trust
Supply chainAI securityImproper trust
High7.8Not listed2025-06-25
CVE-2026-26030
Semantic Kernel filter runs as code
AI securityCode injection
Critical9.9Not listed2025-06-25