This week

AI summaryPillow's libtiff encoder can leak memory contents or crash (segfault) when it handles crafted TIFF tags.

AI summaryStorybook's preview doesn't check where messages come from, so malicious websites may inject code. Affects developers running Storybook.

AI summaryOpenStack Manila lets users change public-share and export-metadata settings on shares belonging to other projects.

AI summarysharp before 0.35.4 bundles a vulnerable libheif; apps processing untrusted AVIF/HEIF images on glibc Linux may face code execution.

AI summaryuv before 0.11.15 lets a malicious wheel's entry-point names write executables outside the scripts directory, e.g. into PATH.

AI summaryHKUDS Vibe-Trading before 0.1.7 skips authentication when API_AUTH_KEY is unset, exposing its API and potentially root shell access.

AI summaryHKUDS Vibe-Trading before 0.1.7: instructions hidden in documents or web pages can make the agent run shell commands as root.

AI summaryHKUDS Vibe-Trading before 0.1.7 lets the LLM agent's file-read tools be prompted to read sensitive server files outside the sandbox.

AI summaryTrigger.dev CLI 3.0.0–4.5.3 'dev --mcp' server lacks auth and listens on all interfaces, so LAN hosts or web pages can call MCP tools.

AI summaryvLLM before 0.31.0 lets clients pick which model processor code revision is loaded when trust_remote_code is enabled, risking untrusted code.

AI summaryuv before 0.8.22 can be tricked by a malicious source distribution's symlinks into writing files outside the extraction directory.

AI summaryOracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 Core flaw lets unauthenticated attackers compromise it via HTTP.

AI summarydjust's MCP tool find_handlers_for_template reads any existing absolute path without restriction; affects 0.9.0 up to fixed releases.

AI summaryHelidon 4.0.0–4.5.5 (microprofile-security) has a flaw that unauthenticated attackers can exploit over HTTP.

AI summary@fastify/middie 9.0.0–9.3.5 may compute path-scoped middleware paths that differ from Fastify routes, so middleware may not run.

AI summaryKiro Crew's WhatsApp group channel lacks authorization, so any member of a configured group can control other agent sessions and run commands on the host.

AI summaryMCP TypeScript SDK server bearer auth accepted tokens issued for other services, weakening MCP server access control.

AI summaryuv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised, weakening TLS trust for uv users.

AI summarycertifi, the widely used Python CA bundle, has a critical update that removes the emSign root certificate; users should update.

AI summaryArgo CD 2.1.0+ with --enable-helm for kustomize lets a repository control Helm's config/data dirs; fixed in 3.3.15/3.4.10/3.5.4.

AI summaryArgo CD 2.7.0+ passes remote Kustomize ref/version values to git fetch unsafely, allowing option injection; fixed in 3.3.15/3.4.10/3.5.4.

AI summaryMCP TypeScript SDK: experimental tasks were not bound to the session that created them, affecting servers using that feature.

AI summaryMCP TypeScript client SDK: HTTP transports and OAuth requests followed cross-origin redirects and re-sent custom headers and bodies.

AI summaryArgo CD 0.9.0 to before 3.3.15/3.4.10/3.5.4/3.6.0-rc2: the repo-server's Jsonnet imports are not confined to the repository root.

AI summaryfollow-redirects 1.16.0: flaw in removing credential headers (Authorization, Cookie, etc.) when following redirects; upgrade to 1.16.1.

AI summary@google/adk 0.4.0 to before 0.6.0: path traversal in FileArtifactService can read, or (via saveArtifact) write, files outside artifact storage.

AI summarynetworknt light-4j 2.1.5 to before 2.4.0: attackers can log in as LDAP/AD-delegated users with an empty password via BasicAuthHandler.

AI summaryA2A Java SDK before 1.3.0.Final: a malicious remote agent can make the default client forward a configured API key to a third party.

AI summaryApache Tomcat: a large non-blocking write can split a response into the next request on the connection, possibly leaking data (AJP).

AI summaryTomcat's HTTP/2 handling of async servlets can mix up requests or responses between users after an error (11.0.22–11.0.26, 10.1.55–10.1.60, 9.0.118+).

AI summaryApache Tomcat servers whose JNDI realm uses a non-GSSAPI SASL mechanism may let attackers log in without the correct password.

AI summarymcp-ripgrep MCP server up to 0.4.0 has OS command injection via the fileType argument of its search tool (local attack).

AI summaryIn RingRTC before 2.72.0 (used by Signal), a call peer can flood a queue so a local hangup may fail to end the call and its audio/video.

AI summaryLetta through 0.16.8's default compose leaves all API routes unauthenticated, letting remote attackers run Python and reach a default-password DB.

AI summaryDB-GPT through 0.8.2's default docker-compose uses a fixed MySQL root password and exposes port 3306, allowing full database access.

AI summaryDB-GPT through 0.8.2 lets unauthenticated callers use the ReAct agent endpoint as admin and make it run code on the server.

AI summaryEvoScientist 0.1.0–0.2.4: instructions planted in fetched content can bypass approval and run host commands via async sub-agents.

AI summaryAix-DB 1.2.4: authenticated non-admin users can make the ChatBI agent run OS commands via chat input or uploaded documents.

AI summaryLangchain-Chatchat through 0.3.1.3 exposes an unauthenticated /tools/call API that can run the built-in shell tool as the server user.

AI summaryJoySafeter through 1.0.0 lets self-registered users make the Copilot agent run OS commands via an unsandboxed execute tool.

AI summarypiflow 2.0.0–2.0.1: unauthenticated chat endpoints let anyone tell the agent to run shell commands with no human approval.

AI summaryLangAlpha through 2026.09.07: instructions hidden in web content the agent reads can make it run shell commands or Python.

AI summaryPlex Media Server before 1.43.3.10861 has an SSRF in /player/timeline that forces the server to POST to an attacker-chosen URL.

AI summaryPlex Media Server before 1.43.3.10861 lets an authenticated user make the server request arbitrary internal or external addresses (SSRF).

AI summaryAll Siemens Software Center versions load DLLs from an uncontrolled path, letting an authenticated local attacker plant a malicious DLL.

AI summarySiteGuard Server Edition has an OS command injection flaw that may let attackers run commands as root/SYSTEM; listed as exploited.

AI summaryPlex Media Server before 1.43.3.10861 mishandles URLs in searchOne, letting attackers call other plugins' functions; exploited in the wild.

AI summaryPlex Media Server before 1.43.3.10861 lets an admin user write arbitrary files that may run on load; listed as exploited (KEV).

AI summaryMLflow 3.17.1 and earlier using the FileStore backend let unauthenticated users control file paths via crafted trace IDs.

AI summaryCognition before 0.13.0 runs agent code locally by default and its API has no authentication, so anyone who can reach it can run code.

AI summarySome Rank Math SEO PRO 3.0.123 packages downloaded/updated Oct 15–16, 2026 (UTC) contained malware that could compromise WordPress sites.

AI summaryaiohttp before 3.14.4 can leak file descriptors on crafted multipart requests, letting unauthenticated attackers exhaust server resources.

AI summaryEnvoy AI Gateway agent-router doesn't verify subject on MCP session resume; default Helm seed makes session IDs forgeable.

AI summarycrewai-tools ≤1.15.28 SeleniumScrapingTool skips private-address checks, so prompt injection can make agents fetch internal resources.

AI summarydocTR ≤1.1.0 loads checkpoints with unsafe torch.load; loading an attacker-controlled checkpoint can run arbitrary Python code.

AI summaryApache Camel's camel-hazelcast component has an unsafe deserialization flaw (4.0.0 to 4.22.0). Upgrade to 4.18.5 or 4.22.1.

AI summaryApache Johnzon 1.0.0 to before 2.2.0 loads and initializes a class named in untrusted JSON (unsafe reflection); upgrade to 2.2.0.

AI summaryApache Answer reaction API bypasses authorization for restricted content.

AI summaryApache Answer's MCP answer retrieval can expose content from non-public questions.

AI summaryESPnet up to 202610.post2 has an unsafe deserialization flaw via the _target_ argument in its inference model handler's build_model.

AI summaryLlama-Chinese up to commit 6fa0fff has a flaw in an example Gradio chat script that can dynamically load module code via base_model_name_or_path.

AI summaryGoogle OSS Agent Mesh (SAM) 0.1.0 alpha versions have missing authorization in the MCP proxy and insecure defaults in OIDC registration.

AI summaryYOLOv9 0.1 can be hit by code injection via names/stride metadata in ONNX model files when loaded by DetectMultiBackend; avoid untrusted models.

AI summaryOmnigent 0.3.0 to before 0.14.0 lets authenticated users escape the agent workspace via nested sub-agent working directory settings.

AI summaryLearnPress for WordPress up to 4.4.10 deserializes untrusted input from the checkout 'checkout-email' parameter, allowing PHP Object Injection.

AI summaryText::CSV_XS 1.46 to before 1.65 has a use-after-free when bind_columns is used and skip_empty_rows skips an empty line in getline.

AI summaryClaude Agent SDK (Python) before 0.2.121 doesn't validate the resume option, so an attacker could inject an MCP server config and run commands.

AI summaryApache Kylin's metastore cleanup function can be called without authentication.

AI summaryApache Kylin allows unauthenticated metadata broadcast from inside the internal network.

AI summaryLangChat (through commit 2a6285a) lacks auth on its REST APIs, exposing plaintext passwords and LLM provider API keys to anyone.

AI summaryFreeRTOS-Plus-TCP before V4.4.2 doesn't verify IPv6 Router Advertisement sources, so remote parties may alter gateway and address settings.

AI summaryDeepSeek Harness (dsh)'s context-compaction feature can be hit by prompt injection through crafted external content.

AI summaryZ.ai ZCode auto-connects to MCP servers declared in a repo's workspace config, so opening a crafted repo may run arbitrary code.

AI summarySome Apache Kylin cache API endpoints are missing authentication.

AI summaryApache Kylin has unsafe Java deserialization when handling data from Redis.

AI summaryApache Kylin's system metadata dump is missing authorization checks and path confinement.

AI summarySGLang 0.5.10–0.5.22 lets remote attackers run Python code via a crafted filter sent to the unauthenticated /dumper/configure endpoint.

AI summaryWSP MCP AI Agents Connector WordPress plugin up to 2.9.5 exposes an MCP tool without capability checks, leaking sensitive info.

AI summaryNezha 2.1.0 to before 2.3.15 builds MCP file transfer URLs from an unvalidated Host header, so uploads may be redirected.

AI summaryBeyondTrust Remote Support components don't validate message origin; under certain conditions attackers may perform file operations on the appliance.

AI summaryA path traversal flaw in Fortinet FortiOS, FortiPAM and other products is actively exploited; news reports it was used to deploy malware.

AI summaryApache Airflow's SSH hook accepts any server key by default, so SSH/SFTP connections without host_key set are open to MITM attacks.

AI summaryArchon 0.2.13–0.11.1 exposes an unauthenticated API on all interfaces, letting network attackers drive its permission-bypassing AI coding agent.

AI summaryGoogle Chrome before 155.0.8059.84 may let a crafted web page run code outside the sandbox; update Chrome.

AI summaryBefore runwasi 0.6.1, containerd-shim-wasmtime may load precompiled bytes from an OCI image layer as trusted native code.

AI summaryundici's WebSocket client, including the one bundled in Node.js, can be made to exhaust memory by a malicious or compromised server.

AI summaryundici's EventSource client (6.5.0–6.29.0, 7.0.0–7.30.0, 8.0.0–8.12.1) can be made to exhaust memory by a malicious SSE server.

AI summaryundici fetch() in versions 6.23.0–6.29.0, 7.18.0–7.30.0 and 8.0.0–8.12.1 can crash Node.js when a malicious server sends a crafted response.

AI summaryundici 7.0–7.30 and 8.0–8.12.1 may key cache entries wrongly when redirect and cache interceptors share a cache store.

AI summaryundici Agent in many 4.x–8.x versions deep-clones options via JSON, silently dropping function-valued options before per-origin pools.

AI summaryjoserfc before 1.7.4 treats a JWS JSON message with an empty signatures array as authenticated; Python apps using it should upgrade.

AI summaryJetBrains TeamCity before 2026.2/2026.1.4/2025.11.8 allows remote code execution via a build-messages whitelist bypass; upgrade.

AI summaryJetBrains Junie CLI before 26.8.3 could execute code via an untrusted project's MCP server configuration. Update the CLI.

AI summaryLinux kernel IPv4 stack didn't validate checksum_start; packets with bad checksum metadata could corrupt the network header.