{ "version": 1, "generated": "2026-10-19T06:40:01.048Z", "count": 126, "items": [ { "id": "opencode-console-provider-key-breach-2026", "url": "https://vibevulns.com/issues/opencode-console-provider-key-breach-2026/", "title": "OpenCode Console breach exposed saved provider API keys", "severity": "critical", "severity_basis": "VibeVulns rating: stored provider keys exposed, with reports of drained credits; vendor incident, no CVE", "date": "2026-10-17", "type": "secrets", "cve": null, "ghsa": null, "tools": [ "opencode", "anthropic", "openai", "gemini" ], "categories": [ "agents", "models" ], "summary": "OpenCode said a breach of its hosted OpenCode Console affected 1.4% of Console users who had linked external providers. Their saved OpenAI and Anthropic keys may have been exposed, and Anthropic revoked Claude keys it believed were affected.", "sources": [ { "title": "OpenCode on X: security breach statement", "url": "https://x.com/opencode/status/2111519637049319818" }, { "title": "Lydia Hallie (Anthropic) on X: affected Claude keys revoked", "url": "https://x.com/lydiahallie/status/2111563956666110287" }, { "title": "Hacker News: OpenCode: Potential provider key breach", "url": "https://news.ycombinator.com/item?id=50133006" }, { "title": "Hacker News: OpenCode Hacked: User credentials leaked (discussion)", "url": "https://news.ycombinator.com/item?id=50133401" } ] }, { "id": "cve-2026-96620-claude-agent-sdk-resume-argument-injection", "url": "https://vibevulns.com/issues/cve-2026-96620-claude-agent-sdk-resume-argument-injection/", "title": "CVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands", "severity": "critical", "severity_basis": "CVSS 4.0 score 9.2 (GitHub, via NVD)", "date": "2026-10-16", "type": "rce", "cve": "CVE-2026-96620", "ghsa": "GHSA-h4mw-j7qp-8mwm", "tools": [ "claude-code", "mcp" ], "categories": [ "agents", "mcp" ], "summary": "Before 0.2.121, the Python Claude Agent SDK passed the resume session ID straight to the Claude CLI. A value starting with a dash became a CLI flag, so an attacker could inject an MCP server config and run commands.", "sources": [ { "title": "GitHub Security Advisory GHSA-h4mw-j7qp-8mwm", "url": "https://github.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-h4mw-j7qp-8mwm" }, { "title": "NVD: CVE-2026-96620", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96620" }, { "title": "claude-agent-sdk-python v0.2.121 release", "url": "https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.2.121" } ] }, { "id": "cve-2026-95182-deepseek-harness-mcp-spawn-path-hijack", "url": "https://vibevulns.com/issues/cve-2026-95182-deepseek-harness-mcp-spawn-path-hijack/", "title": "CVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npx", "severity": "critical", "severity_basis": "CVSS 10.0 (via NVD)", "date": "2026-10-16", "type": "agent-hijack", "cve": "CVE-2026-95182", "ghsa": null, "tools": [ "deepseek", "mcp" ], "categories": [ "models", "mcp" ], "summary": "DeepSeek Harness (dsh), DeepSeek's developer-preview agent harness, launches MCP servers by bare command name. Injected content can get the model to drop a fake executable into node_modules/.bin, which then runs every time that MCP server starts.", "sources": [ { "title": "Researcher write-up for CVE-2026-95182 (lkloliver)", "url": "https://gist.github.com/lkloliver/46a88c7d619e487327a1122c20ff8e32" }, { "title": "Researcher write-up for CVE-2026-95183 (lkloliver)", "url": "https://gist.github.com/lkloliver/c54c0cc91e1ec4f16b538e0d8a1411b6" }, { "title": "NVD: CVE-2026-95182", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95182" }, { "title": "NVD: CVE-2026-95183", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95183" } ] }, { "id": "cve-2026-88755-zcode-auto-connects-repo-mcp-servers", "url": "https://vibevulns.com/issues/cve-2026-88755-zcode-auto-connects-repo-mcp-servers/", "title": "CVE-2026-88755: Z.ai ZCode starts MCP servers from a repo's config the moment you open it", "severity": "high", "severity_basis": "CVSS 7.8 (via NVD)", "date": "2026-10-16", "type": "rce", "cve": "CVE-2026-88755", "ghsa": null, "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "Z.ai's ZCode desktop client 3.11.2.6792 connects to every MCP server declared in a repository's .zcode/config.json as soon as you open the folder, with no approval prompt. A cloned repo can run any command it likes on your machine.", "sources": [ { "title": "Researcher write-up for CVE-2026-88755 (lkloliver)", "url": "https://gist.github.com/lkloliver/aac8dcf8a53fc4b3c1b0a5dfbf36ef68" }, { "title": "NVD: CVE-2026-88755", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88755" } ] }, { "id": "cve-2026-111091-junie-cli-untrusted-mcp-config-code-execution", "url": "https://vibevulns.com/issues/cve-2026-111091-junie-cli-untrusted-mcp-config-code-execution/", "title": "CVE-2026-111091: JetBrains Junie CLI ran code from an untrusted project’s MCP config", "severity": "high", "severity_basis": "CVSS 3.1 score 7.8 (JetBrains, via NVD)", "date": "2026-10-15", "type": "rce", "cve": "CVE-2026-111091", "ghsa": null, "tools": [ "junie", "mcp" ], "categories": [ "agents", "mcp" ], "summary": "Opening an untrusted project in Junie CLI before 26.8.3 could run code through the MCP server configuration that came with the project.", "sources": [ { "title": "NVD: CVE-2026-111091", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111091" }, { "title": "JetBrains: Fixed security issues", "url": "https://www.jetbrains.com/privacy-security/issues-fixed/" } ] }, { "id": "cve-2026-86063-claude-code-plugin-hash-pin-bypass-allows-bypass", "url": "https://vibevulns.com/issues/cve-2026-86063-claude-code-plugin-hash-pin-bypass-allows-bypass/", "title": "CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-10-15", "type": "access-control", "cve": "CVE-2026-86063", "ghsa": "GHSA-pq7j-f95f-qfcv", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA.", "sources": [ { "title": "GitHub Security Advisory GHSA-pq7j-f95f-qfcv", "url": "https://github.com/advisories/GHSA-pq7j-f95f-qfcv" }, { "title": "NVD: CVE-2026-86063", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86063" } ] }, { "id": "cve-2026-59951-mcp-python-sdk-unbounded-session-accumulation-in", "url": "https://vibevulns.com/issues/cve-2026-59951-mcp-python-sdk-unbounded-session-accumulation-in/", "title": "CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion", "severity": "medium", "severity_basis": "GitHub advisory severity: medium (CVSS 7.5)", "date": "2026-10-15", "type": "dos", "cve": "CVE-2026-59951", "ghsa": "GHSA-84m7-p3x7-pcfv", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion.", "sources": [ { "title": "GitHub Security Advisory GHSA-84m7-p3x7-pcfv", "url": "https://github.com/advisories/GHSA-84m7-p3x7-pcfv" }, { "title": "NVD: CVE-2026-59951", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59951" } ] }, { "id": "cve-2026-96889-next-js-image-optimization-svg-rce", "url": "https://vibevulns.com/issues/cve-2026-96889-next-js-image-optimization-svg-rce/", "title": "CVE-2026-96889: Next.js image optimization RCE via SVG", "severity": "critical", "severity_basis": "CVSS 4.0 score 9.5 (GitHub advisory)", "date": "2026-10-14", "type": "rce", "cve": "CVE-2026-96889", "ghsa": "GHSA-2464-fhr4-w9xw", "tools": [ "nextjs" ], "categories": [ "stack" ], "summary": "A memory bug in an upstream library used by Next.js Image Optimization can lead to unauthenticated remote code execution when SVG files are processed and Next.js runs on glibc-based Linux. Fixed in 16.4.1 and 15.5.28.", "sources": [ { "title": "Next.js: Security update, October 14, 2026", "url": "https://nextjs.org/blog/nextjs-security-update-october-14-2026" }, { "title": "GitHub Security Advisory GHSA-2464-fhr4-w9xw", "url": "https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw" }, { "title": "NVD: CVE-2026-96889", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96889" } ] }, { "id": "ghsa-673q-mjm6-r5xr-next-js-use-cache-typed-arrays-rce", "url": "https://vibevulns.com/issues/ghsa-673q-mjm6-r5xr-next-js-use-cache-typed-arrays-rce/", "title": "Next.js ‘use cache’ remote code execution via typed arrays", "severity": "critical", "severity_basis": "CVSS 4.0 score 9.5 (GitHub advisory)", "date": "2026-10-14", "type": "rce", "cve": null, "ghsa": "GHSA-673q-mjm6-r5xr", "tools": [ "nextjs" ], "categories": [ "stack" ], "summary": "Next.js 16 apps using the App Router with Cache Components can be open to unauthenticated remote code execution when a ‘use cache’ function returns multiple typed arrays. There is no workaround; upgrade to 16.4.1.", "sources": [ { "title": "Next.js: Security update, October 14, 2026", "url": "https://nextjs.org/blog/nextjs-security-update-october-14-2026" }, { "title": "GitHub Security Advisory GHSA-673q-mjm6-r5xr", "url": "https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr" } ] }, { "id": "cve-2026-109527-mcp-python-sdk-unbounded-request-body", "url": "https://vibevulns.com/issues/cve-2026-109527-mcp-python-sdk-unbounded-request-body/", "title": "CVE-2026-109527: MCP Python SDK HTTP servers can be knocked offline with huge requests", "severity": "high", "severity_basis": "CVSS 3.1 score 7.5 (GitHub, via NVD)", "date": "2026-10-14", "type": "dos", "cve": "CVE-2026-109527", "ghsa": "GHSA-fmmv-w9g8-j3gc", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "MCP servers built with the official Python SDK read whole HTTP request bodies into memory with no size limit on the SSE message endpoint and OAuth routes. One large request can exhaust memory and take the server down, often with no login needed.", "sources": [ { "title": "GitHub Security Advisory GHSA-fmmv-w9g8-j3gc", "url": "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc" }, { "title": "NVD: CVE-2026-109527", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109527" } ] }, { "id": "cve-2026-108395-mcp-java-sdk-unbounded-request-body", "url": "https://vibevulns.com/issues/cve-2026-108395-mcp-java-sdk-unbounded-request-body/", "title": "CVE-2026-108395: MCP Java SDK HTTP servers can be crashed with one huge request", "severity": "high", "severity_basis": "CVSS 3.1 score 7.5 (GitHub advisory)", "date": "2026-10-14", "type": "dos", "cve": "CVE-2026-108395", "ghsa": "GHSA-4x8c-5vv7-973f", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "The official MCP Java SDK’s Servlet-based HTTP transports read the whole request body into memory with no size limit. One unauthenticated chunked POST can exhaust the Java heap and take the server down.", "sources": [ { "title": "GitHub Security Advisory GHSA-4x8c-5vv7-973f", "url": "https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-4x8c-5vv7-973f" }, { "title": "NVD: CVE-2026-108395", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108395" } ] }, { "id": "ghsa-p3m5-59mp-jv5r-next-js-server-actions-dos", "url": "https://vibevulns.com/issues/ghsa-p3m5-59mp-jv5r-next-js-server-actions-dos/", "title": "Next.js Server Actions denial of service", "severity": "high", "severity_basis": "CVSS 4.0 score 8.2 (GitHub advisory)", "date": "2026-10-14", "type": "dos", "cve": null, "ghsa": "GHSA-p3m5-59mp-jv5r", "tools": [ "nextjs" ], "categories": [ "stack" ], "summary": "Crafted requests to a Next.js App Router app with at least one Server Action can cause excessive CPU use that blocks other requests in the same process. Fixed in 16.4.1 and 15.5.28.", "sources": [ { "title": "Next.js: Security update, October 14, 2026", "url": "https://nextjs.org/blog/nextjs-security-update-october-14-2026" }, { "title": "GitHub Security Advisory GHSA-p3m5-59mp-jv5r", "url": "https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r" } ] }, { "id": "roo-code-auto-approve-command-bypasses-2026", "url": "https://vibevulns.com/issues/roo-code-auto-approve-command-bypasses-2026/", "title": "Roo Code: five ways to slip denied commands past auto-approve (CVE-2026-110202 to 110206), no fix coming", "severity": "high", "severity_basis": "CVSS 3.1 score 8.8 (VulnCheck, via NVD) for each CVE", "date": "2026-10-13", "type": "prompt-injection", "cve": null, "ghsa": null, "tools": [ "roo", "cline" ], "categories": [ "agents" ], "summary": "Roo Code through 3.54.0 has five command-approval bypasses. With auto-approve on, a prompt injection can get a denied shell command run on your machine by hiding it behind an allowlisted command like echo. The project was archived in May 2026, so no patch is expected.", "sources": [ { "title": "NVD: CVE-2026-110202", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110202" }, { "title": "NVD: CVE-2026-110203", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110203" }, { "title": "NVD: CVE-2026-110204", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110204" }, { "title": "NVD: CVE-2026-110205", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110205" }, { "title": "NVD: CVE-2026-110206", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110206" }, { "title": "VulnCheck: Roo Code auto-approve bypass via command substitution at command position", "url": "https://www.vulncheck.com/advisories/roo-code-through-3.54.0-auto-approve-bypass-via-command-substitution-at-command-position" }, { "title": "Researcher write-up (7rah/oss-cve)", "url": "https://github.com/7rah/oss-cve/blob/6adb836d24ca446fd168c3acdc4c170beb77fe0f/roocode-group16-output-as-command.md" } ] }, { "id": "cve-2026-109572-open-webui-terminal-proxy-privilege-escalation", "url": "https://vibevulns.com/issues/cve-2026-109572-open-webui-terminal-proxy-privilege-escalation/", "title": "CVE-2026-109572: Open WebUI terminal proxy lets regular users act as Terminals admin", "severity": "high", "severity_basis": "CVSS 3.1 score 7.6 (VulnCheck, via NVD)", "date": "2026-10-12", "type": "access-control", "cve": "CVE-2026-109572", "ghsa": "GHSA-q46m-r89w-j74p", "tools": [ "open-webui" ], "categories": [ "frameworks" ], "summary": "In Open WebUI 0.8.6 to 0.11.3, a regular user with access to a Terminals connection could send requests through the terminal proxy with the admin’s shared key attached, then list or stop other users’ terminals and change terminal policies.", "sources": [ { "title": "GitHub Security Advisory GHSA-q46m-r89w-j74p", "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-q46m-r89w-j74p" }, { "title": "NVD: CVE-2026-109572", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109572" }, { "title": "VulnCheck advisory", "url": "https://www.vulncheck.com/advisories/open-webui-0.8.6-before-0.11.4-privilege-escalation-via-terminal-proxy" } ] }, { "id": "supabase-rls-checks-login-not-ownership", "url": "https://vibevulns.com/issues/supabase-rls-checks-login-not-ownership/", "title": "Supabase RLS policies that check login but not ownership", "severity": "critical", "severity_basis": "VibeVulns rating: anyone who signs up can read every row; RLS-enabled scans pass it", "date": "2026-10-10", "type": "access-control", "cve": null, "ghsa": null, "tools": [ "supabase", "lovable", "bolt", "v0", "replit", "cursor", "base44" ], "categories": [ "stack", "builders", "agents" ], "summary": "A policy like using (auth.uid() is not null) has RLS on and mentions the user, so it passes Lovable’s scan. But it lets any logged-in user read every row, and on most apps anyone can sign up.", "sources": [ { "title": "DEV: Lovable Security: What the Scan Won’t Catch", "url": "https://dev.to/batmanofweb/lovable-security-what-the-scan-wont-catch-4cj" }, { "title": "r/vibecoding: I audited 5 apps built with Cursor/Lovable. All 5 leaked their entire database", "url": "https://www.reddit.com/r/vibecoding/comments/1r06zp9/i_audited_5_apps_built_with_cursorlovable_all_5/" }, { "title": "r/SaaS: I audited 30 vibe-coded MVPs, here’s what I found", "url": "https://www.reddit.com/r/SaaS/comments/1tljt68/i_audited_30_vibecoded_mvps_heres_what_i_found/" }, { "title": "Supabase docs: Row Level Security", "url": "https://supabase.com/docs/guides/database/postgres/row-level-security" }, { "title": "Supabase docs: Securing Edge Functions", "url": "https://supabase.com/docs/guides/functions/auth" } ] }, { "id": "cve-2026-103663-ollama-api-pull-path-traversal-rce", "url": "https://vibevulns.com/issues/cve-2026-103663-ollama-api-pull-path-traversal-rce/", "title": "CVE-2026-103663: Ollama /api/pull path traversal can lead to code execution as root", "severity": "critical", "severity_basis": "CVSS score 9.4 (via NVD)", "date": "2026-10-08", "type": "rce", "cve": "CVE-2026-103663", "ghsa": null, "tools": [ "ollama" ], "categories": [ "frameworks" ], "summary": "An unauthenticated attacker who can reach an Ollama server can use a crafted layer digest in /api/pull to write a file outside the model store. In most Docker images that means a file Ollama loads and runs as root on the next restart.", "sources": [ { "title": "CERT Polska: Vulnerability in Ollama software", "url": "https://cert.pl/en/posts/2026/10/CVE-2026-103663/" }, { "title": "NVD: CVE-2026-103663", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103663" } ] }, { "id": "cve-2026-94483-next-js-has-server-side-request-forgery-in-image", "url": "https://vibevulns.com/issues/cve-2026-94483-next-js-has-server-side-request-forgery-in-image/", "title": "CVE-2026-94483: Next.js has Server-Side Request Forgery in Image Optimization", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 6.5)", "date": "2026-10-07", "type": "ssrf", "cve": "CVE-2026-94483", "ghsa": "GHSA-cjq9-62q9-8jv4", "tools": [ "nextjs" ], "categories": [ "stack" ], "summary": "An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.", "sources": [ { "title": "GitHub Security Advisory GHSA-cjq9-62q9-8jv4", "url": "https://github.com/advisories/GHSA-cjq9-62q9-8jv4" }, { "title": "NVD: CVE-2026-94483", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94483" } ] }, { "id": "cve-2026-10561-langflow-python-interpreter-unsandboxed-rce", "url": "https://vibevulns.com/issues/cve-2026-10561-langflow-python-interpreter-unsandboxed-rce/", "title": "CVE-2026-10561: Langflow's Python Interpreter component ran code with no real sandbox", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.9)", "date": "2026-10-06", "type": "rce", "cve": "CVE-2026-10561", "ghsa": "GHSA-8qpj-27x8-pwpq", "tools": [ "langflow" ], "categories": [ "frameworks" ], "summary": "Before 1.10.1, any logged-in Langflow user who could edit and run a flow could use the Python Interpreter component to run OS commands as the Langflow service and make their own account a superuser.", "sources": [ { "title": "GitHub Security Advisory GHSA-8qpj-27x8-pwpq", "url": "https://github.com/advisories/GHSA-8qpj-27x8-pwpq" }, { "title": "Langflow v1.10.1 release", "url": "https://github.com/langflow-ai/langflow/releases/tag/v1.10.1" }, { "title": "NVD: CVE-2026-10561", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10561" } ] }, { "id": "cve-2026-104850-mcp-typescript-sdk-oauth-client-could-send", "url": "https://vibevulns.com/issues/cve-2026-104850-mcp-typescript-sdk-oauth-client-could-send/", "title": "CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 7.5)", "date": "2026-10-06", "type": "secrets", "cve": "CVE-2026-104850", "ghsa": "GHSA-6qxp-vccf-f47h", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to.", "sources": [ { "title": "GitHub Security Advisory GHSA-6qxp-vccf-f47h", "url": "https://github.com/advisories/GHSA-6qxp-vccf-f47h" }, { "title": "NVD: CVE-2026-104850", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104850" } ] }, { "id": "langflow-mcp-stdio-command-injection-rce-2026", "url": "https://vibevulns.com/issues/langflow-mcp-stdio-command-injection-rce-2026/", "title": "Langflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)", "severity": "critical", "severity_basis": "CVSS 3.1 score 9.9 (GitHub advisories, via NVD) for both CVEs", "date": "2026-10-05", "type": "rce", "cve": "CVE-2026-105697", "ghsa": "GHSA-w794-rj3p-xv45", "tools": [ "langflow", "mcp" ], "categories": [ "frameworks", "mcp" ], "summary": "Langflow launched whatever command a user put in an MCP stdio server config, through bash -c, with no allowlist. Any user who could add an MCP server or build a flow could run OS commands on the Langflow host, and with the default auto-login no account was needed.", "sources": [ { "title": "GitHub Security Advisory GHSA-w794-rj3p-xv45", "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45" }, { "title": "GitHub Security Advisory GHSA-7w94-79vh-5mr2", "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2" }, { "title": "NVD: CVE-2026-105697", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105697" }, { "title": "NVD: CVE-2026-105740", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105740" } ] }, { "id": "cve-2026-8505-langflow-webhook-auth-bypass-unauthenticated-flow-execution", "url": "https://vibevulns.com/issues/cve-2026-8505-langflow-webhook-auth-bypass-unauthenticated-flow-execution/", "title": "CVE-2026-8505: Langflow webhooks let anyone run a flow without an API key", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2026-10-05", "type": "access-control", "cve": "CVE-2026-8505", "ghsa": "GHSA-cf6m-vc3m-7cgm", "tools": [ "langflow" ], "categories": [ "frameworks" ], "summary": "In Langflow 1.7.0 through 1.9.0, webhook endpoints skipped API key checks by default, so anyone who knew a flow's UUID could run it as the flow's owner. Flows that run Python code turn that into remote code execution.", "sources": [ { "title": "GitHub Security Advisory GHSA-cf6m-vc3m-7cgm", "url": "https://github.com/advisories/GHSA-cf6m-vc3m-7cgm" }, { "title": "Langflow fix: default WEBHOOK_AUTH_ENABLE to True (PR #12845)", "url": "https://github.com/langflow-ai/langflow/pull/12845" }, { "title": "NVD: CVE-2026-8505", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8505" } ] }, { "id": "cve-2026-103435-claude-code-symlink-toctou-file-write", "url": "https://vibevulns.com/issues/cve-2026-103435-claude-code-symlink-toctou-file-write/", "title": "CVE-2026-103435: Claude Code could be raced into writing files outside the project", "severity": "high", "severity_basis": "CVSS 4.0 score 7.7 (GitHub advisory)", "date": "2026-10-05", "type": "access-control", "cve": "CVE-2026-103435", "ghsa": "GHSA-5j29-h97v-84ch", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code checked that a file path was inside the project at permission time but resolved it again at write time. Someone who can write to a shared workspace could swap a file for a symlink and redirect Claude Code’s edits to files like your shell config.", "sources": [ { "title": "GitHub Security Advisory GHSA-5j29-h97v-84ch", "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-5j29-h97v-84ch" }, { "title": "NVD: CVE-2026-103435", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103435" } ] }, { "id": "ghsa-vcvr-r3jv-pc5j-next-js-remote-code-execution-in-next-og", "url": "https://vibevulns.com/issues/ghsa-vcvr-r3jv-pc5j-next-js-remote-code-execution-in-next-og/", "title": "Next.js: Remote Code Execution in next/og ImageResponse", "severity": "critical", "severity_basis": "GitHub advisory severity: critical", "date": "2026-09-30", "type": "rce", "cve": null, "ghsa": "GHSA-vcvr-r3jv-pc5j", "tools": [ "nextjs" ], "categories": [ "stack" ], "summary": "The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution.", "sources": [ { "title": "GitHub Security Advisory GHSA-vcvr-r3jv-pc5j", "url": "https://github.com/advisories/GHSA-vcvr-r3jv-pc5j" } ] }, { "id": "cve-2026-84377-litellm-authenticated-ssrf-and-provider", "url": "https://vibevulns.com/issues/cve-2026-84377-litellm-authenticated-ssrf-and-provider/", "title": "CVE-2026-84377: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters", "severity": "medium", "severity_basis": "GitHub advisory severity: medium (CVSS 6.5)", "date": "2026-09-30", "type": "ssrf", "cve": "CVE-2026-84377", "ghsa": "GHSA-3cv6-jpf6-8222", "tools": [ "litellm" ], "categories": [ "frameworks" ], "summary": "Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination.", "sources": [ { "title": "GitHub Security Advisory GHSA-3cv6-jpf6-8222", "url": "https://github.com/advisories/GHSA-3cv6-jpf6-8222" }, { "title": "NVD: CVE-2026-84377", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84377" } ] }, { "id": "cve-2026-102697-ollama-agent-mode-bash-approval-bypass", "url": "https://vibevulns.com/issues/cve-2026-102697-ollama-agent-mode-bash-approval-bypass/", "title": "CVE-2026-102697: Ollama agent mode's Bash approval can be bypassed with ; or &&", "severity": "high", "severity_basis": "CVSS 7.8 (VulnCheck via NVD)", "date": "2026-09-29", "type": "agent-hijack", "cve": "CVE-2026-102697", "ghsa": null, "tools": [ "ollama" ], "categories": [ "frameworks" ], "summary": "In Ollama's experimental agent mode, approving a Bash command for the session also let through anything chained onto it. A prompt injection could tack extra commands onto an approved one and run them without asking.", "sources": [ { "title": "VulnCheck: Ollama experimental agent Bash approval bypass", "url": "https://www.vulncheck.com/advisories/ollama-0.14.0-before-0.31.2-experimental-agent-bash-approval-bypass-via-prefix-based-authorization" }, { "title": "Ollama v0.31.2 release", "url": "https://github.com/ollama/ollama/releases/tag/v0.31.2" }, { "title": "NVD: CVE-2026-102697", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102697" } ] }, { "id": "upguard-16326-supabase-databases-publicly-readable", "url": "https://vibevulns.com/issues/upguard-16326-supabase-databases-publicly-readable/", "title": "UpGuard: 16,326 Supabase databases had readable tables", "severity": "critical", "severity_basis": "VibeVulns rating: personal data readable by anyone on the internet; research finding, no CVE", "date": "2026-09-25", "type": "access-control", "cve": null, "ghsa": null, "tools": [ "supabase", "claude-code", "codex", "lovable", "replit", "bolt", "v0" ], "categories": [ "stack", "agents", "builders" ], "summary": "UpGuard checked about 300,000 websites that use Supabase and found 16,326 databases with tables anyone could read. Over half showed signs of personal data, and a smaller share held passwords or auth tokens.", "sources": [ { "title": "UpGuard: Everything Everywhere: Systemic Data Exposure in Supabase Apps", "url": "https://www.upguard.com/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps" }, { "title": "TechCrunch: Some Supabase customers are publicly exposing reams of people’s data to the web", "url": "https://techcrunch.com/2026/09/25/some-supabase-customers-are-publicly-exposing-reams-of-peoples-data-to-the-web/" }, { "title": "r/pwnhub: Supabase exposes 16,000 databases with personal data", "url": "https://www.reddit.com/r/pwnhub/comments/1wqzwbn/supabase_exposes_16000_databases_with_personal/" } ] }, { "id": "cve-2026-87995-open-webui-same-origin-xss-to-account-takeover", "url": "https://vibevulns.com/issues/cve-2026-87995-open-webui-same-origin-xss-to-account-takeover/", "title": "CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.7)", "date": "2026-09-10", "type": "secrets", "cve": "CVE-2026-87995", "ghsa": "GHSA-jmc6-2wr8-h3wj", "tools": [ "open-webui" ], "categories": [ "frameworks" ], "summary": "Any authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself.", "sources": [ { "title": "GitHub Security Advisory GHSA-jmc6-2wr8-h3wj", "url": "https://github.com/advisories/GHSA-jmc6-2wr8-h3wj" }, { "title": "NVD: CVE-2026-87995", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87995" } ] }, { "id": "cve-2026-87016-open-webui-sign-in-as-another-user-via-wildcard", "url": "https://vibevulns.com/issues/cve-2026-87016-open-webui-sign-in-as-another-user-via-wildcard/", "title": "CVE-2026-87016: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.1)", "date": "2026-09-10", "type": "access-control", "cve": "CVE-2026-87016", "ghsa": "GHSA-wpmr-8h3q-fwj7", "tools": [ "open-webui" ], "categories": [ "frameworks" ], "summary": "On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match.", "sources": [ { "title": "GitHub Security Advisory GHSA-wpmr-8h3q-fwj7", "url": "https://github.com/advisories/GHSA-wpmr-8h3q-fwj7" }, { "title": "NVD: CVE-2026-87016", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87016" } ] }, { "id": "cve-2026-75604-next-js-unauthenticated-remote-code-execution-on", "url": "https://vibevulns.com/issues/cve-2026-75604-next-js-unauthenticated-remote-code-execution-on/", "title": "CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9)", "date": "2026-09-08", "type": "rce", "cve": "CVE-2026-75604", "ghsa": "GHSA-p293-qw3h-jr36", "tools": [ "nextjs" ], "categories": [ "stack" ], "summary": "A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.", "sources": [ { "title": "GitHub Security Advisory GHSA-p293-qw3h-jr36", "url": "https://github.com/advisories/GHSA-p293-qw3h-jr36" }, { "title": "NVD: CVE-2026-75604", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75604" } ] }, { "id": "ghsa-2xp9-vwfh-vxw4-next-js-unauthenticated-remote-code-execution-in", "url": "https://vibevulns.com/issues/ghsa-2xp9-vwfh-vxw4-next-js-unauthenticated-remote-code-execution-in/", "title": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used", "severity": "critical", "severity_basis": "GitHub advisory severity: critical", "date": "2026-09-08", "type": "rce", "cve": null, "ghsa": "GHSA-2xp9-vwfh-vxw4", "tools": [ "nextjs" ], "categories": [ "stack" ], "summary": "A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.", "sources": [ { "title": "GitHub Security Advisory GHSA-2xp9-vwfh-vxw4", "url": "https://github.com/advisories/GHSA-2xp9-vwfh-vxw4" } ] }, { "id": "cve-2026-37004-litellm-vulnerable-to-server-side-template", "url": "https://vibevulns.com/issues/cve-2026-37004-litellm-vulnerable-to-server-side-template/", "title": "CVE-2026-37004: LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2026-08-27", "type": "access-control", "cve": "CVE-2026-37004", "ghsa": "GHSA-6wvf-77m9-58rm", "tools": [ "litellm" ], "categories": [ "frameworks" ], "summary": "BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.", "sources": [ { "title": "GitHub Security Advisory GHSA-6wvf-77m9-58rm", "url": "https://github.com/advisories/GHSA-6wvf-77m9-58rm" }, { "title": "NVD: CVE-2026-37004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37004" } ] }, { "id": "cve-2026-70492-open-webui-stored-xss-via-unescaped-katex-render", "url": "https://vibevulns.com/issues/cve-2026-70492-open-webui-stored-xss-via-unescaped-katex-render/", "title": "CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.7)", "date": "2026-08-04", "type": "access-control", "cve": "CVE-2026-70492", "ghsa": "GHSA-pwxh-7358-jq2x", "tools": [ "open-webui" ], "categories": [ "frameworks" ], "summary": "Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error.", "sources": [ { "title": "GitHub Security Advisory GHSA-pwxh-7358-jq2x", "url": "https://github.com/advisories/GHSA-pwxh-7358-jq2x" }, { "title": "NVD: CVE-2026-70492", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70492" } ] }, { "id": "supabase-tables-readable-without-login", "url": "https://vibevulns.com/issues/supabase-tables-readable-without-login/", "title": "Supabase tables readable by anyone with no login", "severity": "critical", "severity_basis": "VibeVulns rating: users/orders data exposed to unauthenticated requests", "date": "2026-08", "type": "access-control", "cve": null, "ghsa": null, "tools": [ "lovable", "bolt", "v0", "replit", "base44", "supabase", "cursor" ], "categories": [ "builders", "stack", "agents" ], "summary": "A scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login.", "sources": [ { "title": "r/vibecoding: I scanned 30,998 live vibe-coded apps", "url": "https://www.reddit.com/r/vibecoding/comments/1w68ce4/i_scanned_30998_live_vibecoded_apps_from_the/" }, { "title": "UpGuard: Everything Everywhere: Systemic Data Exposure in Supabase Apps", "url": "https://www.upguard.com/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps" }, { "title": "Escape: State of Security of Vibe Coded Apps 2025 (PDF)", "url": "https://26857953.fs1.hubspotusercontent-eu1.net/hubfs/26857953/State-Security-Vibe%20Coded%20Apps%20Report%202025%20Escape.pdf" }, { "title": "Supabase docs: Securing your data", "url": "https://supabase.com/docs/guides/database/secure-data" } ] }, { "id": "supabase-service-role-key-in-frontend", "url": "https://vibevulns.com/issues/supabase-service-role-key-in-frontend/", "title": "Supabase service_role / secret key shipped to the browser", "severity": "critical", "severity_basis": "VibeVulns rating: key bypasses all RLS (Supabase docs)", "date": "2026-08", "type": "secrets", "cve": null, "ghsa": null, "tools": [ "lovable", "bolt", "v0", "replit", "base44", "supabase", "cursor" ], "categories": [ "builders", "stack", "agents" ], "summary": "The service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public.", "sources": [ { "title": "Supabase docs: Securing your data", "url": "https://supabase.com/docs/guides/database/secure-data" }, { "title": "Supabase docs: API keys", "url": "https://supabase.com/docs/guides/getting-started/api-keys" }, { "title": "r/vibecoding: 30,998-app scan", "url": "https://www.reddit.com/r/vibecoding/comments/1w68ce4/i_scanned_30998_live_vibecoded_apps_from_the/" } ] }, { "id": "next-public-env-secret-leak", "url": "https://vibevulns.com/issues/next-public-env-secret-leak/", "title": "Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variables", "severity": "high", "severity_basis": "VibeVulns rating: exposes paid API keys (OpenAI, Stripe, AWS)", "date": "2026-08", "type": "secrets", "cve": null, "ghsa": null, "tools": [ "lovable", "bolt", "v0", "replit", "base44", "nextjs", "cursor" ], "categories": [ "builders", "stack", "agents" ], "summary": "Prefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way.", "sources": [ { "title": "KeyDrift: Supabase JWT exposed in a Next.js app", "url": "https://keydrift.dev/fix/supabase-service-role-exposed-in-nextjs" }, { "title": "r/vibecoding: 30,998-app scan", "url": "https://www.reddit.com/r/vibecoding/comments/1w68ce4/i_scanned_30998_live_vibecoded_apps_from_the/" }, { "title": "Escape: State of Security of Vibe Coded Apps 2025 (PDF)", "url": "https://26857953.fs1.hubspotusercontent-eu1.net/hubfs/26857953/State-Security-Vibe%20Coded%20Apps%20Report%202025%20Escape.pdf" } ] }, { "id": "cve-2026-55607-claude-code-sandbox-escape-via-git-worktree-path", "url": "https://vibevulns.com/issues/cve-2026-55607-claude-code-sandbox-escape-via-git-worktree-path/", "title": "CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-07-24", "type": "prompt-injection", "cve": "CVE-2026-55607", "ghsa": "GHSA-7835-87q9-rgvv", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code's worktree handling allowed creation of worktrees named \".git\" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks.", "sources": [ { "title": "GitHub Security Advisory GHSA-7835-87q9-rgvv", "url": "https://github.com/advisories/GHSA-7835-87q9-rgvv" }, { "title": "NVD: CVE-2026-55607", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55607" } ] }, { "id": "cve-2026-59950-mcp-python-sdk-websocket-server-transport-does", "url": "https://vibevulns.com/issues/cve-2026-59950-mcp-python-sdk-websocket-server-transport-does/", "title": "CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validation", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-07-16", "type": "access-control", "cve": "CVE-2026-59950", "ghsa": "GHSA-vj7q-gjh5-988w", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "In affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation.", "sources": [ { "title": "GitHub Security Advisory GHSA-vj7q-gjh5-988w", "url": "https://github.com/advisories/GHSA-vj7q-gjh5-988w" }, { "title": "NVD: CVE-2026-59950", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59950" } ] }, { "id": "cve-2026-52869-mcp-python-sdk-http-transports-serve-session", "url": "https://vibevulns.com/issues/cve-2026-52869-mcp-python-sdk-http-transports-serve-session/", "title": "CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 7.1)", "date": "2026-07-16", "type": "secrets", "cve": "CVE-2026-52869", "ghsa": "GHSA-jpw9-pfvf-9f58", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session.", "sources": [ { "title": "GitHub Security Advisory GHSA-jpw9-pfvf-9f58", "url": "https://github.com/advisories/GHSA-jpw9-pfvf-9f58" }, { "title": "NVD: CVE-2026-52869", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52869" } ] }, { "id": "cve-2026-52870-mcp-python-sdk-experimental-task-handlers-allow", "url": "https://vibevulns.com/issues/cve-2026-52870-mcp-python-sdk-experimental-task-handlers-allow/", "title": "CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 7.6)", "date": "2026-07-16", "type": "access-control", "cve": "CVE-2026-52870", "ghsa": "GHSA-hvrp-rf83-w775", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "In affected versions, the default request handlers installed by the experimental tasks feature (server.experimental.enable_tasks()) did not check which session created a task before acting on it.", "sources": [ { "title": "GitHub Security Advisory GHSA-hvrp-rf83-w775", "url": "https://github.com/advisories/GHSA-hvrp-rf83-w775" }, { "title": "NVD: CVE-2026-52870", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52870" } ] }, { "id": "cve-2026-49468-litellm-authentication-bypass-via-host-header", "url": "https://vibevulns.com/issues/cve-2026-49468-litellm-authentication-bypass-via-host-header/", "title": "CVE-2026-49468: LiteLLM: Authentication Bypass via Host Header Injection", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2026-06-16", "type": "access-control", "cve": "CVE-2026-49468", "ghsa": "GHSA-4xpc-pv4p-pm3w", "tools": [ "litellm" ], "categories": [ "frameworks" ], "summary": "A Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes.", "sources": [ { "title": "GitHub Security Advisory GHSA-4xpc-pv4p-pm3w", "url": "https://github.com/advisories/GHSA-4xpc-pv4p-pm3w" }, { "title": "NVD: CVE-2026-49468", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49468" } ] }, { "id": "cve-2026-45672-open-webui-jupyter-code-execution-works-despite", "url": "https://vibevulns.com/issues/cve-2026-45672-open-webui-jupyter-code-execution-works-despite/", "title": "CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.8)", "date": "2026-05-14", "type": "rce", "cve": "CVE-2026-45672", "ghsa": "GHSA-482j-2pq6-q5w4", "tools": [ "open-webui" ], "categories": [ "frameworks" ], "summary": "The /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says \"disabled\" but code still executes.", "sources": [ { "title": "GitHub Security Advisory GHSA-482j-2pq6-q5w4", "url": "https://github.com/advisories/GHSA-482j-2pq6-q5w4" }, { "title": "NVD: CVE-2026-45672", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45672" } ] }, { "id": "cve-2026-44578-next-js-vulnerable-to-server-side-request-forgery", "url": "https://vibevulns.com/issues/cve-2026-44578-next-js-vulnerable-to-server-side-request-forgery/", "title": "CVE-2026-44578: Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.6)", "date": "2026-05-11", "type": "ssrf", "cve": "CVE-2026-44578", "ghsa": "GHSA-c4j6-fc7j-m34r", "tools": [ "nextjs" ], "categories": [ "stack" ], "summary": "Self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests.", "sources": [ { "title": "GitHub Security Advisory GHSA-c4j6-fc7j-m34r", "url": "https://github.com/advisories/GHSA-c4j6-fc7j-m34r" }, { "title": "NVD: CVE-2026-44578", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44578" } ] }, { "id": "cve-2026-44574-next-js-has-a-middleware-proxy-bypass-through", "url": "https://vibevulns.com/issues/cve-2026-44574-next-js-has-a-middleware-proxy-bypass-through/", "title": "CVE-2026-44574: Next.js has a Middleware / Proxy bypass through dynamic route parameter injection", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.1)", "date": "2026-05-11", "type": "access-control", "cve": "CVE-2026-44574", "ghsa": "GHSA-492v-c6pp-mqqv", "tools": [ "nextjs" ], "categories": [ "stack" ], "summary": "Applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass.", "sources": [ { "title": "GitHub Security Advisory GHSA-492v-c6pp-mqqv", "url": "https://github.com/advisories/GHSA-492v-c6pp-mqqv" }, { "title": "NVD: CVE-2026-44574", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44574" } ] }, { "id": "cve-2026-7482-ollama-contains-a-heap-out-of-bounds-read", "url": "https://vibevulns.com/issues/cve-2026-7482-ollama-contains-a-heap-out-of-bounds-read/", "title": "CVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 9.1)", "date": "2026-05-04", "type": "secrets", "cve": "CVE-2026-7482", "ghsa": "GHSA-x8qc-fggm-mpqg", "tools": [ "ollama" ], "categories": [ "frameworks" ], "summary": "Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader.", "sources": [ { "title": "GitHub Security Advisory GHSA-x8qc-fggm-mpqg", "url": "https://github.com/advisories/GHSA-x8qc-fggm-mpqg" }, { "title": "NVD: CVE-2026-7482", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7482" } ] }, { "id": "stripe-webhooks-without-signature-verification", "url": "https://vibevulns.com/issues/stripe-webhooks-without-signature-verification/", "title": "Unverified Stripe webhooks hand out free upgrades", "severity": "critical", "severity_basis": "VibeVulns rating: anyone can forge a payment event; Stripe docs warn this can grant access or fulfil orders", "date": "2026-05", "type": "access-control", "cve": null, "ghsa": null, "tools": [ "stripe", "lovable", "bolt", "replit", "cursor", "v0", "base44", "supabase" ], "categories": [ "stack", "builders", "agents" ], "summary": "If your Stripe webhook handler doesn’t verify the Stripe-Signature header, anyone can POST a fake “checkout.session.completed” event and your app will treat it as a real payment. Scans and audits find this in a large share of AI-built apps.", "sources": [ { "title": "Security Scanner: We probed 6,000 web apps for Stripe webhook signature checks. 1,542 don’t bother", "url": "https://securityscanner.dev/blog/stripe-webhook-signature-bypass-1500-apps" }, { "title": "r/netsec: We probed 6,000 web apps for Stripe webhook signature checks", "url": "https://www.reddit.com/r/netsec/comments/1t45sa6/we_probed_6000_web_apps_for_stripe_webhook/" }, { "title": "r/SaaS: I audited 30 vibe-coded MVPs, here’s what I found", "url": "https://www.reddit.com/r/SaaS/comments/1tljt68/i_audited_30_vibecoded_mvps_heres_what_i_found/" }, { "title": "Stripe docs: Receive Stripe events in your webhook endpoint", "url": "https://docs.stripe.com/webhooks" } ] }, { "id": "cve-2026-12537-gemini-cli-remote-code-execution-via-workspace", "url": "https://vibevulns.com/issues/cve-2026-12537-gemini-cli-remote-code-execution-via-workspace/", "title": "CVE-2026-12537: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 10)", "date": "2026-04-24", "type": "rce", "cve": "CVE-2026-12537", "ghsa": "GHSA-wpqr-6v78-jr5g", "tools": [ "gemini-cli" ], "categories": [ "agents" ], "summary": "Gemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions.", "sources": [ { "title": "GitHub Security Advisory GHSA-wpqr-6v78-jr5g", "url": "https://github.com/advisories/GHSA-wpqr-6v78-jr5g" }, { "title": "NVD: CVE-2026-12537", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12537" } ] }, { "id": "cve-2026-42208-litellm-has-sql-injection-in-proxy-api-key", "url": "https://vibevulns.com/issues/cve-2026-42208-litellm-has-sql-injection-in-proxy-api-key/", "title": "CVE-2026-42208: LiteLLM has SQL Injection in Proxy API key verification", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2026-04-24", "type": "secrets", "cve": "CVE-2026-42208", "ghsa": "GHSA-r75f-5x8p-qvmc", "tools": [ "litellm" ], "categories": [ "frameworks" ], "summary": "A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter.", "sources": [ { "title": "GitHub Security Advisory GHSA-r75f-5x8p-qvmc", "url": "https://github.com/advisories/GHSA-r75f-5x8p-qvmc" }, { "title": "NVD: CVE-2026-42208", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42208" } ] }, { "id": "cve-2026-40068-claude-code-trust-dialog-bypass-via-git-worktree", "url": "https://vibevulns.com/issues/cve-2026-40068-claude-code-trust-dialog-bypass-via-git-worktree/", "title": "CVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-04-24", "type": "rce", "cve": "CVE-2026-40068", "ghsa": "GHSA-q5hj-mxqh-vv77", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code used the git worktree commondir file when determining folder trust but did not validate its contents.", "sources": [ { "title": "GitHub Security Advisory GHSA-q5hj-mxqh-vv77", "url": "https://github.com/advisories/GHSA-q5hj-mxqh-vv77" }, { "title": "NVD: CVE-2026-40068", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40068" } ] }, { "id": "cve-2026-39861-claude-code-sandbox-escape-via-symlink-following", "url": "https://vibevulns.com/issues/cve-2026-39861-claude-code-sandbox-escape-via-symlink-following/", "title": "CVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 10)", "date": "2026-04-21", "type": "prompt-injection", "cve": "CVE-2026-39861", "ghsa": "GHSA-vp62-r36r-9xqp", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace.", "sources": [ { "title": "GitHub Security Advisory GHSA-vp62-r36r-9xqp", "url": "https://github.com/advisories/GHSA-vp62-r36r-9xqp" }, { "title": "NVD: CVE-2026-39861", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39861" } ] }, { "id": "lovable-public-project-code-and-chat-exposure-2026", "url": "https://vibevulns.com/issues/lovable-public-project-code-and-chat-exposure-2026/", "title": "Lovable bug exposed public projects’ code and AI chats", "severity": "high", "severity_basis": "VibeVulns rating: source code and chat histories (which can hold pasted credentials) readable by any account; vendor-confirmed, no CVE", "date": "2026-04-20", "type": "data-leak", "cve": null, "ghsa": null, "tools": [ "lovable" ], "categories": [ "builders" ], "summary": "From 3 February to 20 April 2026, a Lovable permissions regression let any Lovable user with a project link read the source code and AI chat history of public projects. Lovable confirmed it and fixed it within two hours of the public report.", "sources": [ { "title": "Lovable: Our response to the April 2026 incident", "url": "https://lovable.dev/blog/our-response-to-the-april-2026-incident" }, { "title": "The Register: Lovable denies data leak, cites ‘intentional behavior’, then blames HackerOne", "url": "https://www.theregister.com/security/2026/04/21/lovable-denies-data-leak-cites-intentional-behavior/5226233" }, { "title": "r/nocode: Lovable just exposed source code, database…", "url": "https://www.reddit.com/r/nocode/comments/1sshgcl/lovable_just_exposed_source_code_database/" } ] }, { "id": "cve-2025-61260-openai-codex-cli-enables-code-execution-through", "url": "https://vibevulns.com/issues/cve-2025-61260-openai-codex-cli-enables-code-execution-through/", "title": "CVE-2025-61260: OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2026-04-14", "type": "rce", "cve": "CVE-2025-61260", "ghsa": "GHSA-xrxf-jgv3-qmrm", "tools": [ "codex" ], "categories": [ "agents" ], "summary": "A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository.", "sources": [ { "title": "GitHub Security Advisory GHSA-xrxf-jgv3-qmrm", "url": "https://github.com/advisories/GHSA-xrxf-jgv3-qmrm" }, { "title": "NVD: CVE-2025-61260", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61260" } ] }, { "id": "cve-2026-32871-fastmcp-openapi-provider-has-an-ssrf-path", "url": "https://vibevulns.com/issues/cve-2026-32871-fastmcp-openapi-provider-has-an-ssrf-path/", "title": "CVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 10)", "date": "2026-03-31", "type": "ssrf", "cve": "CVE-2026-32871", "ghsa": "GHSA-vv7q-7jx5-f767", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "The OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service.", "sources": [ { "title": "GitHub Security Advisory GHSA-vv7q-7jx5-f767", "url": "https://github.com/advisories/GHSA-vv7q-7jx5-f767" }, { "title": "NVD: CVE-2026-32871", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32871" } ] }, { "id": "cve-2026-27124-fastmcp-missing-consent-verification-in-oauth", "url": "https://vibevulns.com/issues/cve-2026-27124-fastmcp-missing-consent-verification-in-oauth/", "title": "CVE-2026-27124: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-03-31", "type": "access-control", "cve": "CVE-2026-27124", "ghsa": "GHSA-rww4-4w9c-7733", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "While testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub.", "sources": [ { "title": "GitHub Security Advisory GHSA-rww4-4w9c-7733", "url": "https://github.com/advisories/GHSA-rww4-4w9c-7733" }, { "title": "NVD: CVE-2026-27124", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27124" } ] }, { "id": "cve-2026-33068-claude-code-has-a-workspace-trust-dialog-bypass", "url": "https://vibevulns.com/issues/cve-2026-33068-claude-code-has-a-workspace-trust-dialog-bypass/", "title": "CVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-03-19", "type": "rce", "cve": "CVE-2026-33068", "ghsa": "GHSA-mmgp-wc2j-qcv7", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog.", "sources": [ { "title": "GitHub Security Advisory GHSA-mmgp-wc2j-qcv7", "url": "https://github.com/advisories/GHSA-mmgp-wc2j-qcv7" }, { "title": "NVD: CVE-2026-33068", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33068" } ] }, { "id": "cve-2025-69196-fastmcp-oauth-proxy-token-reuse-across-mcp", "url": "https://vibevulns.com/issues/cve-2025-69196-fastmcp-oauth-proxy-token-reuse-across-mcp/", "title": "CVE-2025-69196: FastMCP OAuth Proxy token reuse across MCP servers", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-03-16", "type": "secrets", "cve": "CVE-2025-69196", "ghsa": "GHSA-5h2m-4q8j-pqpj", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "While testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request.", "sources": [ { "title": "GitHub Security Advisory GHSA-5h2m-4q8j-pqpj", "url": "https://github.com/advisories/GHSA-5h2m-4q8j-pqpj" }, { "title": "NVD: CVE-2025-69196", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69196" } ] }, { "id": "cve-2026-25725-claude-code-has-sandbox-escape-via-persistent", "url": "https://vibevulns.com/issues/cve-2026-25725-claude-code-has-sandbox-escape-via-persistent/", "title": "CVE-2026-25725: Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-02-06", "type": "rce", "cve": "CVE-2026-25725", "ghsa": "GHSA-ff64-7w26-62rf", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup.", "sources": [ { "title": "GitHub Security Advisory GHSA-ff64-7w26-62rf", "url": "https://github.com/advisories/GHSA-ff64-7w26-62rf" }, { "title": "NVD: CVE-2026-25725", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25725" } ] }, { "id": "cve-2026-25723-claude-code-vulnerable-to-command-injection-via", "url": "https://vibevulns.com/issues/cve-2026-25723-claude-code-vulnerable-to-command-injection-via/", "title": "CVE-2026-25723: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-02-06", "type": "rce", "cve": "CVE-2026-25723", "ghsa": "GHSA-mhg7-666j-cqg4", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope.", "sources": [ { "title": "GitHub Security Advisory GHSA-mhg7-666j-cqg4", "url": "https://github.com/advisories/GHSA-mhg7-666j-cqg4" }, { "title": "NVD: CVE-2026-25723", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25723" } ] }, { "id": "cve-2026-25722-claude-code-vulnerable-to-command-injection-via", "url": "https://vibevulns.com/issues/cve-2026-25722-claude-code-vulnerable-to-command-injection-via/", "title": "CVE-2026-25722: Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-02-06", "type": "rce", "cve": "CVE-2026-25722", "ghsa": "GHSA-66q4-vfjg-2qhh", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation.", "sources": [ { "title": "GitHub Security Advisory GHSA-66q4-vfjg-2qhh", "url": "https://github.com/advisories/GHSA-66q4-vfjg-2qhh" }, { "title": "NVD: CVE-2026-25722", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25722" } ] }, { "id": "cve-2026-25536-modelcontextprotocol-sdk-has-cross-client-data", "url": "https://vibevulns.com/issues/cve-2026-25536-modelcontextprotocol-sdk-has-cross-client-data/", "title": "CVE-2026-25536: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 7.1)", "date": "2026-02-04", "type": "data-leak", "cve": "CVE-2026-25536", "ghsa": "GHSA-345p-7cg4-v4c7", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "Cross-client data leak via two distinct issues: (1) reusing a single StreamableHTTPServerTransport across multiple client requests, and (2) reusing a single McpServer/Server instance across multiple transports. Both are most common in stateless deployments.", "sources": [ { "title": "GitHub Security Advisory GHSA-345p-7cg4-v4c7", "url": "https://github.com/advisories/GHSA-345p-7cg4-v4c7" }, { "title": "NVD: CVE-2026-25536", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25536" } ] }, { "id": "cve-2026-24887-claude-code-has-a-command-injection-in-find", "url": "https://vibevulns.com/issues/cve-2026-24887-claude-code-has-a-command-injection-in-find/", "title": "CVE-2026-24887: Claude Code has a Command Injection in find Command Bypasses User Approval Prompt", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-02-03", "type": "rce", "cve": "CVE-2026-24887", "ghsa": "GHSA-qgqw-h4xq-7w8w", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window.", "sources": [ { "title": "GitHub Security Advisory GHSA-qgqw-h4xq-7w8w", "url": "https://github.com/advisories/GHSA-qgqw-h4xq-7w8w" }, { "title": "NVD: CVE-2026-24887", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24887" } ] }, { "id": "cve-2026-24053-claude-code-has-a-path-restriction-bypass-via-zsh", "url": "https://vibevulns.com/issues/cve-2026-24053-claude-code-has-a-path-restriction-bypass-via-zsh/", "title": "CVE-2026-24053: Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-02-03", "type": "access-control", "cve": "CVE-2026-24053", "ghsa": "GHSA-q728-gf8j-w49r", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts.", "sources": [ { "title": "GitHub Security Advisory GHSA-q728-gf8j-w49r", "url": "https://github.com/advisories/GHSA-q728-gf8j-w49r" }, { "title": "NVD: CVE-2026-24053", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24053" } ] }, { "id": "cve-2026-24052-claude-code-has-a-domain-validation-bypass-which", "url": "https://vibevulns.com/issues/cve-2026-24052-claude-code-has-a-domain-validation-bypass-which/", "title": "CVE-2026-24052: Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-02-03", "type": "data-leak", "cve": "CVE-2026-24052", "ghsa": "GHSA-vhw5-3g5m-8ggf", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests.", "sources": [ { "title": "GitHub Security Advisory GHSA-vhw5-3g5m-8ggf", "url": "https://github.com/advisories/GHSA-vhw5-3g5m-8ggf" }, { "title": "NVD: CVE-2026-24052", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24052" } ] }, { "id": "moltbook-supabase-database-exposed", "url": "https://vibevulns.com/issues/moltbook-supabase-database-exposed/", "title": "Moltbook left its Supabase database open to read and write", "severity": "critical", "severity_basis": "VibeVulns rating: full unauthenticated read and write, credentials exposed; researcher finding (Wiz), no CVE", "date": "2026-02-02", "type": "access-control", "cve": null, "ghsa": null, "tools": [ "supabase" ], "categories": [ "stack" ], "summary": "Wiz found that Moltbook, a social network for AI agents whose founder said he vibe-coded it, shipped a Supabase key in its JavaScript with no Row Level Security behind it. Anyone could read and write the database, including 1.5 million agent API tokens and 35,000 email addresses.", "sources": [ { "title": "Wiz: Hacking Moltbook: exposed database reveals millions of API keys", "url": "https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys" }, { "title": "Reuters: Moltbook, social media site for AI agents, had big security hole, cyber firm Wiz says", "url": "https://www.reuters.com/legal/litigation/moltbook-social-media-site-ai-agents-had-big-security-hole-cyber-firm-wiz-says-2026-02-02/" } ] }, { "id": "cve-2026-22778-vllm-has-rce-in-video", "url": "https://vibevulns.com/issues/cve-2026-22778-vllm-has-rce-in-video/", "title": "CVE-2026-22778: vLLM has RCE In Video Processing", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2026-02-02", "type": "rce", "cve": "CVE-2026-22778", "ghsa": "GHSA-4r2x-xpjr-7cvv", "tools": [ "vllm" ], "categories": [ "frameworks" ], "summary": "vLLM has RCE In Video Processing.", "sources": [ { "title": "GitHub Security Advisory GHSA-4r2x-xpjr-7cvv", "url": "https://github.com/advisories/GHSA-4r2x-xpjr-7cvv" }, { "title": "NVD: CVE-2026-22778", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22778" } ] }, { "id": "cve-2025-9611-microsoft-playwright-mcp-server-vulnerable-to-dns", "url": "https://vibevulns.com/issues/cve-2025-9611-microsoft-playwright-mcp-server-vulnerable-to-dns/", "title": "CVE-2025-9611: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-01-07", "type": "ssrf", "cve": "CVE-2025-9611", "ghsa": "GHSA-6fg3-hvw7-2fwq", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections.", "sources": [ { "title": "GitHub Security Advisory GHSA-6fg3-hvw7-2fwq", "url": "https://github.com/advisories/GHSA-6fg3-hvw7-2fwq" }, { "title": "NVD: CVE-2025-9611", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9611" } ] }, { "id": "cve-2026-0621-anthropic-s-mcp-typescript-sdk-has-a-redos", "url": "https://vibevulns.com/issues/cve-2026-0621-anthropic-s-mcp-typescript-sdk-has-a-redos/", "title": "CVE-2026-0621: Anthropic's MCP TypeScript SDK has a ReDoS vulnerability", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2026-01-05", "type": "dos", "cve": "CVE-2026-0621", "ghsa": "GHSA-8r9q-7v3j-jr4g", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "A ReDoS vulnerability in the UriTemplate class allows attackers to cause denial of service. The partToRegExp() function generates a regex pattern with nested quantifiers (([^/]+(?:,[^/]+))) for exploded template variables (e.g., {/id}, {?tags*}), causing catastrophic backtracking on malicious input.", "sources": [ { "title": "GitHub Security Advisory GHSA-8r9q-7v3j-jr4g", "url": "https://github.com/advisories/GHSA-8r9q-7v3j-jr4g" }, { "title": "NVD: CVE-2026-0621", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0621" } ] }, { "id": "cve-2025-63389-ollama-platform-has-missing-authentication", "url": "https://vibevulns.com/issues/cve-2025-63389-ollama-platform-has-missing-authentication/", "title": "CVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operations", "severity": "critical", "severity_basis": "GitHub advisory severity: critical", "date": "2025-12-18", "type": "access-control", "cve": "CVE-2025-63389", "ghsa": "GHSA-f6mr-38g8-39rg", "tools": [ "ollama" ], "categories": [ "frameworks" ], "summary": "A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.", "sources": [ { "title": "GitHub Security Advisory GHSA-f6mr-38g8-39rg", "url": "https://github.com/advisories/GHSA-f6mr-38g8-39rg" }, { "title": "NVD: CVE-2025-63389", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63389" } ] }, { "id": "cve-2025-66032-claude-code-command-validation-bypass-allows", "url": "https://vibevulns.com/issues/cve-2025-66032-claude-code-command-validation-bypass-allows/", "title": "CVE-2025-66032: Claude Code Command Validation Bypass Allows Arbitrary Code Execution", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-12-03", "type": "rce", "cve": "CVE-2025-66032", "ghsa": "GHSA-xq4m-mc3c-vvg3", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window.", "sources": [ { "title": "GitHub Security Advisory GHSA-xq4m-mc3c-vvg3", "url": "https://github.com/advisories/GHSA-xq4m-mc3c-vvg3" }, { "title": "NVD: CVE-2025-66032", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66032" } ] }, { "id": "cve-2025-66416-model-context-protocol-mcp-python-sdk-does-not", "url": "https://vibevulns.com/issues/cve-2025-66416-model-context-protocol-mcp-python-sdk-does-not/", "title": "CVE-2025-66416: Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-12-02", "type": "ssrf", "cve": "CVE-2025-66416", "ghsa": "GHSA-9h52-p55h-vw2f", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "The Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers.", "sources": [ { "title": "GitHub Security Advisory GHSA-9h52-p55h-vw2f", "url": "https://github.com/advisories/GHSA-9h52-p55h-vw2f" }, { "title": "NVD: CVE-2025-66416", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66416" } ] }, { "id": "cve-2025-66414-model-context-protocol-mcp-typescript-sdk-does", "url": "https://vibevulns.com/issues/cve-2025-66414-model-context-protocol-mcp-typescript-sdk-does/", "title": "CVE-2025-66414: Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-12-02", "type": "ssrf", "cve": "CVE-2025-66414", "ghsa": "GHSA-w48q-cv73-mx4w", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers.", "sources": [ { "title": "GitHub Security Advisory GHSA-w48q-cv73-mx4w", "url": "https://github.com/advisories/GHSA-w48q-cv73-mx4w" }, { "title": "NVD: CVE-2025-66414", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66414" } ] }, { "id": "cve-2025-64755-anthropic-ai-claude-code-has-sed-command", "url": "https://vibevulns.com/issues/cve-2025-64755-anthropic-ai-claude-code-has-sed-command/", "title": "CVE-2025-64755: @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-11-20", "type": "access-control", "cve": "CVE-2025-64755", "ghsa": "GHSA-7mv8-j34q-vp7q", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system.", "sources": [ { "title": "GitHub Security Advisory GHSA-7mv8-j34q-vp7q", "url": "https://github.com/advisories/GHSA-7mv8-j34q-vp7q" }, { "title": "NVD: CVE-2025-64755", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64755" } ] }, { "id": "cve-2025-65099-claude-code-vulnerable-to-command-execution-prior", "url": "https://vibevulns.com/issues/cve-2025-65099-claude-code-vulnerable-to-command-execution-prior/", "title": "CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialog", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-11-19", "type": "rce", "cve": "CVE-2025-65099", "ghsa": "GHSA-5hhx-v7f6-x7gv", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "When using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version.", "sources": [ { "title": "GitHub Security Advisory GHSA-5hhx-v7f6-x7gv", "url": "https://github.com/advisories/GHSA-5hhx-v7f6-x7gv" }, { "title": "NVD: CVE-2025-65099", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65099" } ] }, { "id": "camoleak-copilot-chat", "url": "https://vibevulns.com/issues/camoleak-copilot-chat/", "title": "CamoLeak: Copilot Chat leaked private source code", "severity": "critical", "severity_basis": "Researcher rating (Legit Security); no CVE listed", "date": "2025-10-08", "type": "data-leak", "cve": null, "ghsa": null, "tools": [ "copilot" ], "categories": [ "agents" ], "summary": "Legit Security reported a critical vulnerability in GitHub Copilot Chat that could leak private source code from a user’s repositories.", "sources": [ { "title": "Legit Security: CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code", "url": "https://www.legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code" } ] }, { "id": "cve-2025-59536-claude-code-can-execute-commands-prior-to-the", "url": "https://vibevulns.com/issues/cve-2025-59536-claude-code-can-execute-commands-prior-to-the/", "title": "CVE-2025-59536: Claude Code can execute commands prior to the startup trust dialog", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-10-03", "type": "rce", "cve": "CVE-2025-59536", "ghsa": "GHSA-4fgq-fpq9-mr3g", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory.", "sources": [ { "title": "GitHub Security Advisory GHSA-4fgq-fpq9-mr3g", "url": "https://github.com/advisories/GHSA-4fgq-fpq9-mr3g" }, { "title": "NVD: CVE-2025-59536", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59536" } ] }, { "id": "gemini-trifecta", "url": "https://vibevulns.com/issues/gemini-trifecta/", "title": "Gemini Trifecta: three injection flaws in Google’s Gemini suite", "severity": "high", "severity_basis": "Researcher rating (Tenable); remediated by Google", "date": "2025-09-30", "type": "prompt-injection", "cve": null, "ghsa": null, "tools": [ "gemini" ], "categories": [ "models" ], "summary": "Tenable found three now-fixed vulnerabilities in Gemini Cloud Assist, the Search Personalization model and the Browsing tool that exposed users to privacy risks, including search-injection.", "sources": [ { "title": "Tenable: The Trifecta: three new Gemini vulnerabilities", "url": "https://www.tenable.com/blog/the-trifecta-how-three-new-gemini-vulnerabilities-in-cloud-assist-search-model-and-browsing" } ] }, { "id": "cve-2025-59828-claude-code-vulnerable-to-arbitrary-code", "url": "https://vibevulns.com/issues/cve-2025-59828-claude-code-vulnerable-to-arbitrary-code/", "title": "CVE-2025-59828: Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-09-24", "type": "rce", "cve": "CVE-2025-59828", "ghsa": "GHSA-2jjv-qf24-vfm4", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "When using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version.", "sources": [ { "title": "GitHub Security Advisory GHSA-2jjv-qf24-vfm4", "url": "https://github.com/advisories/GHSA-2jjv-qf24-vfm4" }, { "title": "NVD: CVE-2025-59828", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59828" } ] }, { "id": "cve-2025-59532-codex-has-sandbox-bypass-due-to-bug-in-path", "url": "https://vibevulns.com/issues/cve-2025-59532-codex-has-sandbox-bypass-due-to-bug-in-path/", "title": "CVE-2025-59532: Codex has sandbox bypass due to bug in path configuration logic", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-09-19", "type": "access-control", "cve": "CVE-2025-59532", "ghsa": "GHSA-w5fx-fh39-j5rw", "tools": [ "codex" ], "categories": [ "agents" ], "summary": "Due to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session.", "sources": [ { "title": "GitHub Security Advisory GHSA-w5fx-fh39-j5rw", "url": "https://github.com/advisories/GHSA-w5fx-fh39-j5rw" }, { "title": "NVD: CVE-2025-59532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59532" } ] }, { "id": "cve-2025-59041-claude-code-vulnerable-to-arbitrary-code", "url": "https://vibevulns.com/issues/cve-2025-59041-claude-code-vulnerable-to-arbitrary-code/", "title": "CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-09-10", "type": "rce", "cve": "CVE-2025-59041", "ghsa": "GHSA-j4h9-wv2m-wrf7", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "At startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace.", "sources": [ { "title": "GitHub Security Advisory GHSA-j4h9-wv2m-wrf7", "url": "https://github.com/advisories/GHSA-j4h9-wv2m-wrf7" }, { "title": "NVD: CVE-2025-59041", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59041" } ] }, { "id": "cve-2025-58764-claude-code-rg-vulnerability-does-not-protect", "url": "https://vibevulns.com/issues/cve-2025-58764-claude-code-rg-vulnerability-does-not-protect/", "title": "CVE-2025-58764: Claude Code rg vulnerability does not protect against approval prompt bypass", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-09-10", "type": "rce", "cve": "CVE-2025-58764", "ghsa": "GHSA-qxfv-fcpc-w36x", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window.", "sources": [ { "title": "GitHub Security Advisory GHSA-qxfv-fcpc-w36x", "url": "https://github.com/advisories/GHSA-qxfv-fcpc-w36x" }, { "title": "NVD: CVE-2025-58764", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58764" } ] }, { "id": "cve-2025-58444-mcp-inspector-is-vulnerable-to-potential-command", "url": "https://vibevulns.com/issues/cve-2025-58444-mcp-inspector-is-vulnerable-to-potential-command/", "title": "CVE-2025-58444: MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-09-08", "type": "rce", "cve": "CVE-2025-58444", "ghsa": "GHSA-g9hg-qhmf-q45m", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "An XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server.", "sources": [ { "title": "GitHub Security Advisory GHSA-g9hg-qhmf-q45m", "url": "https://github.com/advisories/GHSA-g9hg-qhmf-q45m" }, { "title": "NVD: CVE-2025-58444", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58444" } ] }, { "id": "windsurf-prompt-injection-secrets", "url": "https://vibevulns.com/issues/windsurf-prompt-injection-secrets/", "title": "Windsurf: prompt injection leaks developer secrets", "severity": "high", "severity_basis": "Researcher rating; no CVE", "date": "2025-08-21", "type": "prompt-injection", "cve": null, "ghsa": null, "tools": [ "windsurf" ], "categories": [ "agents" ], "summary": "Embrace The Red showed how prompt injection in files the Cascade agent reads could get Windsurf to leak secrets from the developer’s machine.", "sources": [ { "title": "Embrace The Red: Hijacking Windsurf: How Prompt Injection Leaks Developer Secrets", "url": "https://embracethered.com/blog/posts/2025/windsurf-data-exfiltration-vulnerabilities/" } ] }, { "id": "cve-2025-55284-claude-code-s-permissive-default-allowlist", "url": "https://vibevulns.com/issues/cve-2025-55284-claude-code-s-permissive-default-allowlist/", "title": "CVE-2025-55284: Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Code", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-08-18", "type": "data-leak", "cve": "CVE-2025-55284", "ghsa": "GHSA-x5gv-jw7f-j6xj", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to an overly broad allowlist of safe commands, it was possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation.", "sources": [ { "title": "GitHub Security Advisory GHSA-x5gv-jw7f-j6xj", "url": "https://github.com/advisories/GHSA-x5gv-jw7f-j6xj" }, { "title": "NVD: CVE-2025-55284", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55284" } ] }, { "id": "cve-2025-53773-copilot-prompt-injection-rce", "url": "https://vibevulns.com/issues/cve-2025-53773-copilot-prompt-injection-rce/", "title": "CVE-2025-53773: GitHub Copilot prompt injection to code execution", "severity": "high", "severity_basis": "CVSS 3.1 score 7.8 (NVD)", "date": "2025-08-12", "type": "prompt-injection", "cve": "CVE-2025-53773", "ghsa": null, "tools": [ "copilot" ], "categories": [ "agents" ], "summary": "Command injection in GitHub Copilot and Visual Studio let an attacker run code on a developer’s machine. Embrace The Red showed it starting from a prompt injection in project content.", "sources": [ { "title": "NVD: CVE-2025-53773", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53773" }, { "title": "Embrace The Red: GitHub Copilot Remote Code Execution via Prompt Injection", "url": "https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/" } ] }, { "id": "cve-2025-54795-claude-code-echo-command-allowed-bypass-of-user", "url": "https://vibevulns.com/issues/cve-2025-54795-claude-code-echo-command-allowed-bypass-of-user/", "title": "CVE-2025-54795: Claude Code echo command allowed bypass of user approval prompt for command execution", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-08-04", "type": "rce", "cve": "CVE-2025-54795", "ghsa": "GHSA-x56v-x2h6-7j34", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window.", "sources": [ { "title": "GitHub Security Advisory GHSA-x56v-x2h6-7j34", "url": "https://github.com/advisories/GHSA-x56v-x2h6-7j34" }, { "title": "NVD: CVE-2025-54795", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54795" } ] }, { "id": "cve-2025-54794-claude-code-research-preview-has-a-path", "url": "https://vibevulns.com/issues/cve-2025-54794-claude-code-research-preview-has-a-path/", "title": "CVE-2025-54794: Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-08-04", "type": "access-control", "cve": "CVE-2025-54794", "ghsa": "GHSA-pmw4-pwvc-3hx2", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Due to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD.", "sources": [ { "title": "GitHub Security Advisory GHSA-pmw4-pwvc-3hx2", "url": "https://github.com/advisories/GHSA-pmw4-pwvc-3hx2" }, { "title": "NVD: CVE-2025-54794", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54794" } ] }, { "id": "cve-2025-54135-cursor-curxecute", "url": "https://vibevulns.com/issues/cve-2025-54135-cursor-curxecute/", "title": "CVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run code", "severity": "high", "severity_basis": "CVSS 3.1 score 8.6 (CVE record)", "date": "2025-08", "type": "prompt-injection", "cve": "CVE-2025-54135", "ghsa": null, "tools": [ "cursor" ], "categories": [ "agents" ], "summary": "Before 1.3.9, Cursor let the agent create new dotfiles like .cursor/mcp.json without approval. Chained with prompt injection, this meant remote code execution.", "sources": [ { "title": "CVE Record: CVE-2025-54135", "url": "https://www.cve.org/CVERecord?id=CVE-2025-54135" }, { "title": "Cursor advisory GHSA-4cxx-hrm3-49rm", "url": "https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm" }, { "title": "Cursor advisory GHSA-vqv7-vq92-x87f", "url": "https://github.com/cursor/cursor/security/advisories/GHSA-vqv7-vq92-x87f" } ] }, { "id": "cve-2025-54136-cursor-mcpoison", "url": "https://vibevulns.com/issues/cve-2025-54136-cursor-mcpoison/", "title": "CVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swapped", "severity": "high", "severity_basis": "VibeVulns rating: persistent RCE requires repo write access", "date": "2025-08", "type": "agent-hijack", "cve": "CVE-2025-54136", "ghsa": null, "tools": [ "cursor", "mcp" ], "categories": [ "agents", "mcp" ], "summary": "In Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt.", "sources": [ { "title": "NVD: CVE-2025-54136", "url": "https://nvd.nist.gov/vuln/detail/cve-2025-54136" }, { "title": "Cursor advisory GHSA-24mc-g4xr-4395", "url": "https://github.com/cursor/cursor/security/advisories/GHSA-24mc-g4xr-4395" } ] }, { "id": "cve-2025-8217-amazon-q-malicious-code", "url": "https://vibevulns.com/issues/cve-2025-8217-amazon-q-malicious-code/", "title": "CVE-2025-8217: malicious code shipped in Amazon Q Developer 1.84.0", "severity": "high", "severity_basis": "AWS security bulletin AWS-2025-015", "date": "2025-07-23", "type": "supply-chain", "cve": "CVE-2025-8217", "ghsa": null, "tools": [ "amazon-q" ], "categories": [ "agents" ], "summary": "An over-scoped GitHub token in Amazon Q’s build setup let an attacker commit malicious code that shipped in the VS Code extension 1.84.0. AWS says it failed to run due to a syntax error.", "sources": [ { "title": "AWS Security Bulletin AWS-2025-015", "url": "https://aws.amazon.com/security/security-bulletins/AWS-2025-015/" } ] }, { "id": "grok-4-echo-chamber-jailbreak", "url": "https://vibevulns.com/issues/grok-4-echo-chamber-jailbreak/", "title": "Grok 4 jailbroken within 48 hours of launch", "severity": "medium", "severity_basis": "Model safety research; no CVE", "date": "2025-07-11", "type": "jailbreak", "cve": null, "ghsa": null, "tools": [ "xai" ], "categories": [ "models" ], "summary": "NeuralTrust combined its Echo Chamber and Crescendo multi-turn techniques to jailbreak Grok 4 two days after release.", "sources": [ { "title": "NeuralTrust: Grok-4 Jailbreak: Echo Chamber and Crescendo", "url": "https://neuraltrust.ai/blog/grok-4-jailbreak-echo-chamber-and-crescendo" } ] }, { "id": "cve-2025-6514-mcp-remote-exposed-to-os-command-injection-via", "url": "https://vibevulns.com/issues/cve-2025-6514-mcp-remote-exposed-to-os-command-injection-via/", "title": "CVE-2025-6514: mcp-remote exposed to OS command injection via untrusted MCP server connections", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.6)", "date": "2025-07-09", "type": "rce", "cve": "CVE-2025-6514", "ghsa": "GHSA-6xpm-ggf7-wc3p", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL", "sources": [ { "title": "GitHub Security Advisory GHSA-6xpm-ggf7-wc3p", "url": "https://github.com/advisories/GHSA-6xpm-ggf7-wc3p" }, { "title": "NVD: CVE-2025-6514", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6514" } ] }, { "id": "supabase-mcp-prompt-injection", "url": "https://vibevulns.com/issues/supabase-mcp-prompt-injection/", "title": "Supabase MCP: a support ticket gets the agent to dump private tables", "severity": "high", "severity_basis": "Researcher demonstration; no CVE", "date": "2025-07-08", "type": "prompt-injection", "cve": null, "ghsa": null, "tools": [ "mcp", "supabase", "cursor", "lovable" ], "categories": [ "mcp", "stack", "agents", "builders" ], "summary": "General Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role.", "sources": [ { "title": "General Analysis: Supabase MCP prompt injection", "url": "https://www.generalanalysis.com/blog/supabase-mcp-blog" }, { "title": "Supabase: Defense in depth for MCP servers", "url": "https://supabase.com/blog/defense-in-depth-mcp" } ] }, { "id": "cve-2025-53366-mcp-python-sdk-vulnerability-in-the-fastmcp", "url": "https://vibevulns.com/issues/cve-2025-53366-mcp-python-sdk-vulnerability-in-the-fastmcp/", "title": "CVE-2025-53366: MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-07-04", "type": "dos", "cve": "CVE-2025-53366", "ghsa": "GHSA-3qhf-m339-9g5v", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "A validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures.", "sources": [ { "title": "GitHub Security Advisory GHSA-3qhf-m339-9g5v", "url": "https://github.com/advisories/GHSA-3qhf-m339-9g5v" }, { "title": "NVD: CVE-2025-53366", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53366" } ] }, { "id": "cve-2025-53365-mcp-python-sdk-has-unhandled-exception-in", "url": "https://vibevulns.com/issues/cve-2025-53365-mcp-python-sdk-has-unhandled-exception-in/", "title": "CVE-2025-53365: MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-07-04", "type": "dos", "cve": "CVE-2025-53365", "ghsa": "GHSA-j975-95f5-7wqh", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "If a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service.", "sources": [ { "title": "GitHub Security Advisory GHSA-j975-95f5-7wqh", "url": "https://github.com/advisories/GHSA-j975-95f5-7wqh" }, { "title": "NVD: CVE-2025-53365", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53365" } ] }, { "id": "cve-2025-53110-modelcontextprotocol-server-filesystem", "url": "https://vibevulns.com/issues/cve-2025-53110-modelcontextprotocol-server-filesystem/", "title": "CVE-2025-53110: @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-07-01", "type": "access-control", "cve": "CVE-2025-53110", "ghsa": "GHSA-hc55-p739-j48w", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 2025.7.1 to resolve the issue.", "sources": [ { "title": "GitHub Security Advisory GHSA-hc55-p739-j48w", "url": "https://github.com/advisories/GHSA-hc55-p739-j48w" }, { "title": "NVD: CVE-2025-53110", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53110" } ] }, { "id": "cve-2025-53109-modelcontextprotocol-server-filesystem-allows-for", "url": "https://vibevulns.com/issues/cve-2025-53109-modelcontextprotocol-server-filesystem-allows-for/", "title": "CVE-2025-53109: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-07-01", "type": "access-control", "cve": "CVE-2025-53109", "ghsa": "GHSA-q66q-fx2p-7w4m", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve.", "sources": [ { "title": "GitHub Security Advisory GHSA-q66q-fx2p-7w4m", "url": "https://github.com/advisories/GHSA-q66q-fx2p-7w4m" }, { "title": "NVD: CVE-2025-53109", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53109" } ] }, { "id": "base44-private-app-auth-bypass", "url": "https://vibevulns.com/issues/base44-private-app-auth-bypass/", "title": "Base44: private apps open to anyone with the app_id (Wiz)", "severity": "critical", "severity_basis": "Rated critical by Wiz Research", "date": "2025-07", "type": "access-control", "cve": null, "ghsa": null, "tools": [ "base44" ], "categories": [ "builders" ], "summary": "Undocumented register and verify-OTP endpoints accepted a non-secret app_id, letting anyone create a verified account on private, SSO-only apps. Patched by Wix within 24 hours.", "sources": [ { "title": "Wiz: Critical Vulnerability in AI Vibe Coding platform Base44", "url": "https://www.wiz.io/blog/critical-vulnerability-base44" }, { "title": "SecurityWeek: Flaw in Base44 exposed private enterprise apps", "url": "https://www.securityweek.com/flaw-in-vibe-coding-platform-base44-exposed-private-enterprise-applications/" }, { "title": "The Hacker News: Wiz uncovers access bypass flaw in Base44", "url": "https://thehackernews.com/2025/07/wiz-uncovers-critical-access-bypass.html" } ] }, { "id": "replit-agent-deleted-production-database", "url": "https://vibevulns.com/issues/replit-agent-deleted-production-database/", "title": "AI agent deleted a production database during a code freeze (Replit)", "severity": "high", "severity_basis": "VibeVulns rating: data loss, recoverable via rollback", "date": "2025-07", "type": "ops", "cve": null, "ghsa": null, "tools": [ "replit", "cursor" ], "categories": [ "builders", "agents" ], "summary": "Replit Agent deleted SaaStr founder Jason Lemkin’s live database (1,206 executives, 1,196+ companies) despite an explicit freeze, then wrongly said rollback was impossible.", "sources": [ { "title": "The Register: Replit deleted production database", "url": "https://www.theregister.com/software/2025/07/21/vibe-coding-service-replit-deleted-production-database/719783" }, { "title": "Fast Company: Replit CEO on what happened", "url": "https://www.fastcompany.com/91372483/replit-ceo-what-really-happened-when-ai-agent-wiped-jason-lemkins-database-exclusive" } ] }, { "id": "cve-2025-52882-claude-code-improper-authorization-via-websocket", "url": "https://vibevulns.com/issues/cve-2025-52882-claude-code-improper-authorization-via-websocket/", "title": "CVE-2025-52882: Claude Code Improper Authorization via websocket connections from arbitrary origins", "severity": "high", "severity_basis": "GitHub advisory severity: high", "date": "2025-06-23", "type": "access-control", "cve": "CVE-2025-52882", "ghsa": "GHSA-9f65-56v6-gxw7", "tools": [ "claude-code" ], "categories": [ "agents" ], "summary": "Claude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Pycharm, and Android Studio) are vulnerable to unauthorized websocket connections from an attacker when visiting attacker-controlled webpages.", "sources": [ { "title": "GitHub Security Advisory GHSA-9f65-56v6-gxw7", "url": "https://github.com/advisories/GHSA-9f65-56v6-gxw7" }, { "title": "NVD: CVE-2025-52882", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52882" } ] }, { "id": "cve-2025-49596-mcp-inspector-proxy-server-lacks-authentication", "url": "https://vibevulns.com/issues/cve-2025-49596-mcp-inspector-proxy-server-lacks-authentication/", "title": "CVE-2025-49596: MCP Inspector proxy server lacks authentication between the Inspector client and proxy", "severity": "critical", "severity_basis": "GitHub advisory severity: critical", "date": "2025-06-13", "type": "rce", "cve": "CVE-2025-49596", "ghsa": "GHSA-7f8r-222p-6f5g", "tools": [ "mcp" ], "categories": [ "mcp" ], "summary": "Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio.", "sources": [ { "title": "GitHub Security Advisory GHSA-7f8r-222p-6f5g", "url": "https://github.com/advisories/GHSA-7f8r-222p-6f5g" }, { "title": "NVD: CVE-2025-49596", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49596" } ] }, { "id": "cve-2025-32711-echoleak-m365-copilot", "url": "https://vibevulns.com/issues/cve-2025-32711-echoleak-m365-copilot/", "title": "CVE-2025-32711 (EchoLeak): zero-click data leak in Microsoft 365 Copilot", "severity": "critical", "severity_basis": "CVSS 3.1 score 9.3 (CNA)", "date": "2025-06-11", "type": "prompt-injection", "cve": "CVE-2025-32711", "ghsa": null, "tools": [ "copilot" ], "categories": [ "agents" ], "summary": "AI command injection in Microsoft 365 Copilot let an unauthorised attacker disclose information over a network. Microsoft fixed it server-side.", "sources": [ { "title": "NVD: CVE-2025-32711", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32711" } ] }, { "id": "cve-2025-1793-llama-index-vulnerable-to-sql", "url": "https://vibevulns.com/issues/cve-2025-1793-llama-index-vulnerable-to-sql/", "title": "CVE-2025-1793: llama_index vulnerable to SQL Injection", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2025-06-05", "type": "access-control", "cve": "CVE-2025-1793", "ghsa": "GHSA-v3c8-3pr6-gr7p", "tools": [ "llamaindex" ], "categories": [ "frameworks" ], "summary": "Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities.", "sources": [ { "title": "GitHub Security Advisory GHSA-v3c8-3pr6-gr7p", "url": "https://github.com/advisories/GHSA-v3c8-3pr6-gr7p" }, { "title": "NVD: CVE-2025-1793", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1793" } ] }, { "id": "github-mcp-private-repo-leak", "url": "https://vibevulns.com/issues/github-mcp-private-repo-leak/", "title": "GitHub MCP server: a public issue makes the agent leak private repos", "severity": "high", "severity_basis": "Researcher rating (Invariant Labs called it critical); no CVE", "date": "2025-05-26", "type": "agent-hijack", "cve": null, "ghsa": null, "tools": [ "mcp", "claude-code", "cursor", "copilot" ], "categories": [ "mcp", "agents" ], "summary": "Invariant Labs showed that a prompt injection planted in a public GitHub issue could get an agent using the official GitHub MCP server to pull data from the user’s private repositories.", "sources": [ { "title": "Invariant Labs: GitHub MCP Exploited: Accessing private repositories via MCP", "url": "https://invariantlabs.ai/blog/mcp-github-vulnerability" } ] }, { "id": "cve-2025-47277-vllm-allows-remote-code-execution-via-pyncclpipe", "url": "https://vibevulns.com/issues/cve-2025-47277-vllm-allows-remote-code-execution-via-pyncclpipe/", "title": "CVE-2025-47277: vLLM Allows Remote Code Execution via PyNcclPipe Communication Service", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2025-05-20", "type": "rce", "cve": "CVE-2025-47277", "ghsa": "GHSA-hjq4-87xh-g4fv", "tools": [ "vllm" ], "categories": [ "frameworks" ], "summary": "vLLM Allows Remote Code Execution via PyNcclPipe Communication Service.", "sources": [ { "title": "GitHub Security Advisory GHSA-hjq4-87xh-g4fv", "url": "https://github.com/advisories/GHSA-hjq4-87xh-g4fv" }, { "title": "NVD: CVE-2025-47277", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47277" } ] }, { "id": "cve-2025-48757-lovable-missing-rls", "url": "https://vibevulns.com/issues/cve-2025-48757-lovable-missing-rls/", "title": "CVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLS", "severity": "critical", "severity_basis": "CVSS 3.1 score 9.3 (CVE record)", "date": "2025-05", "type": "access-control", "cve": "CVE-2025-48757", "ghsa": null, "tools": [ "lovable", "supabase" ], "categories": [ "builders", "stack" ], "summary": "Lovable-generated apps talked to Supabase directly from the browser, but many tables had no (or wrong) Row Level Security policies, so anyone with the public anon key could read or write data.", "sources": [ { "title": "CVE Record: CVE-2025-48757", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48757" }, { "title": "Matt Palmer: CVE-2025-48757 write-up", "url": "https://mattpalmer.io/posts/2025/05/CVE-2025-48757/" }, { "title": "Matt Palmer: Statement on CVE-2025-48757", "url": "https://mattpalmer.io/posts/2025/05/statement-on-CVE-2025-48757/" } ] }, { "id": "cve-2025-32444-vllm-vulnerable-to-remote-code-execution-via", "url": "https://vibevulns.com/issues/cve-2025-32444-vllm-vulnerable-to-remote-code-execution-via/", "title": "CVE-2025-32444: vLLM Vulnerable to Remote Code Execution via Mooncake Integration", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 10)", "date": "2025-04-29", "type": "rce", "cve": "CVE-2025-32444", "ghsa": "GHSA-hj4w-hm2g-p6w5", "tools": [ "vllm" ], "categories": [ "frameworks" ], "summary": "vLLM integration with mooncake is vaulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets.", "sources": [ { "title": "GitHub Security Advisory GHSA-hj4w-hm2g-p6w5", "url": "https://github.com/advisories/GHSA-hj4w-hm2g-p6w5" }, { "title": "NVD: CVE-2025-32444", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32444" } ] }, { "id": "mcp-tool-poisoning-attacks", "url": "https://vibevulns.com/issues/mcp-tool-poisoning-attacks/", "title": "MCP tool poisoning: hidden instructions in tool descriptions", "severity": "high", "severity_basis": "Researcher rating (Invariant Labs called it critical); no CVE", "date": "2025-04-01", "type": "prompt-injection", "cve": null, "ghsa": null, "tools": [ "mcp", "cursor", "claude-code", "windsurf", "cline" ], "categories": [ "mcp", "agents" ], "summary": "An MCP server can hide instructions inside a tool’s description. The model reads them, the user usually doesn’t, and the agent can be steered into reading files or sending data elsewhere.", "sources": [ { "title": "Invariant Labs: MCP Security Notification: Tool Poisoning Attacks", "url": "https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks" } ] }, { "id": "cve-2025-29927-nextjs-middleware-bypass", "url": "https://vibevulns.com/issues/cve-2025-29927-nextjs-middleware-bypass/", "title": "CVE-2025-29927: Next.js middleware authorization bypass", "severity": "critical", "severity_basis": "Critical severity (GitHub Advisory)", "date": "2025-03", "type": "access-control", "cve": "CVE-2025-29927", "ghsa": null, "tools": [ "nextjs", "v0", "bolt", "cursor", "replit" ], "categories": [ "stack", "builders", "agents" ], "summary": "Self-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0.", "sources": [ { "title": "GitHub Advisory GHSA-f82v-jwr5-mffw (CVE-2025-29927)", "url": "https://github.com/advisories/ghsa-f82v-jwr5-mffw" }, { "title": "Vercel: Postmortem on Next.js Middleware bypass", "url": "https://vercel.com/blog/postmortem-on-next-js-middleware-bypass" } ] }, { "id": "rules-file-backdoor", "url": "https://vibevulns.com/issues/rules-file-backdoor/", "title": "“Rules File Backdoor”: hidden Unicode instructions in AI rules files", "severity": "high", "severity_basis": "VibeVulns rating: supply-chain attack invisible in code review", "date": "2025-03", "type": "supply-chain", "cve": null, "ghsa": null, "tools": [ "cursor", "copilot" ], "categories": [ "agents" ], "summary": "Pillar Security showed invisible Unicode characters in shared rules files (.cursorrules, .mdc) can steer Cursor and GitHub Copilot into writing backdoored code.", "sources": [ { "title": "Pillar Security: Rules File Backdoor", "url": "https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor-how-hackers-can-weaponize-code-agents" }, { "title": "Pillar Security: Rule File Scanner", "url": "https://rule-scan.pillar.security/" } ] }, { "id": "middleware-only-route-protection", "url": "https://vibevulns.com/issues/middleware-only-route-protection/", "title": "Protecting routes only in middleware", "severity": "medium", "severity_basis": "VibeVulns rating: design weakness, not a single bug", "date": "2025-03", "type": "access-control", "cve": null, "ghsa": null, "tools": [ "nextjs", "v0", "bolt", "cursor", "replit" ], "categories": [ "stack", "builders", "agents" ], "summary": "Vercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed.", "sources": [ { "title": "Vercel: Postmortem on Next.js Middleware bypass", "url": "https://vercel.com/blog/postmortem-on-next-js-middleware-bypass" } ] }, { "id": "deepseek-r1-jailbreak-evaluation", "url": "https://vibevulns.com/issues/deepseek-r1-jailbreak-evaluation/", "title": "DeepSeek R1 failed every harmful-prompt test in Cisco’s evaluation", "severity": "medium", "severity_basis": "Model safety evaluation; no CVE", "date": "2025-01-31", "type": "jailbreak", "cve": null, "ghsa": null, "tools": [ "deepseek" ], "categories": [ "models" ], "summary": "Cisco ran algorithmic jailbreak testing against DeepSeek and other frontier reasoning models and published the results on 31 January 2025.", "sources": [ { "title": "Cisco: Evaluating Security Risk in DeepSeek and Other Frontier Reasoning Models", "url": "https://blogs.cisco.com/security/evaluating-security-risk-in-deepseek-and-other-frontier-reasoning-models" } ] }, { "id": "deepseek-exposed-clickhouse-database", "url": "https://vibevulns.com/issues/deepseek-exposed-clickhouse-database/", "title": "DeepSeek left a database open with chat history and secrets", "severity": "critical", "severity_basis": "Researcher rating (Wiz); vendor incident", "date": "2025-01-29", "type": "data-leak", "cve": null, "ghsa": null, "tools": [ "deepseek" ], "categories": [ "models" ], "summary": "Wiz found a publicly accessible DeepSeek database that allowed full control over database operations, exposing over a million lines of logs with chat history and other sensitive data.", "sources": [ { "title": "Wiz: Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information", "url": "https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak" } ] }, { "id": "client-side-only-auth", "url": "https://vibevulns.com/issues/client-side-only-auth/", "title": "Authentication logic living entirely in the browser", "severity": "high", "severity_basis": "VibeVulns rating: auth checks can be skipped by calling the API directly", "date": "2025", "type": "access-control", "cve": null, "ghsa": null, "tools": [ "lovable", "base44", "bolt", "v0", "replit", "cursor" ], "categories": [ "builders", "agents" ], "summary": "Hiding a page or button in the UI is not access control. If the API or database doesn’t check the user, anyone can call it directly.", "sources": [ { "title": "Escape: State of Security of Vibe Coded Apps 2025 (PDF)", "url": "https://26857953.fs1.hubspotusercontent-eu1.net/hubfs/26857953/State-Security-Vibe%20Coded%20Apps%20Report%202025%20Escape.pdf" } ] }, { "id": "slopsquatting-hallucinated-packages", "url": "https://vibevulns.com/issues/slopsquatting-hallucinated-packages/", "title": "Slopsquatting: AI suggests packages that don’t exist", "severity": "high", "severity_basis": "VibeVulns rating: can install attacker-controlled code", "date": "2025", "type": "supply-chain", "cve": null, "ghsa": null, "tools": [ "claude-code", "copilot", "cursor", "lovable", "bolt", "v0", "replit", "base44" ], "categories": [ "agents", "builders" ], "summary": "A USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names.", "sources": [ { "title": "arXiv: We Have a Package for You! (USENIX Security 2025)", "url": "https://arxiv.org/html/2406.10279v2" }, { "title": "USENIX ;login: Package Hallucinations", "url": "https://www.usenix.org/publications/loginonline/we-have-package-you-comprehensive-analysis-package-hallucinations-code" } ] }, { "id": "cve-2024-11393-deserialization-of-untrusted-data-in-hugging-face", "url": "https://vibevulns.com/issues/cve-2024-11393-deserialization-of-untrusted-data-in-hugging-face/", "title": "CVE-2024-11393: Deserialization of Untrusted Data in Hugging Face Transformers", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.8)", "date": "2024-11-23", "type": "rce", "cve": "CVE-2024-11393", "ghsa": "GHSA-wrfc-pvp9-mr9g", "tools": [ "transformers" ], "categories": [ "frameworks" ], "summary": "Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers.", "sources": [ { "title": "GitHub Security Advisory GHSA-wrfc-pvp9-mr9g", "url": "https://github.com/advisories/GHSA-wrfc-pvp9-mr9g" }, { "title": "NVD: CVE-2024-11393", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11393" } ] }, { "id": "cve-2024-11394-deserialization-of-untrusted-data-in-hugging-face", "url": "https://vibevulns.com/issues/cve-2024-11394-deserialization-of-untrusted-data-in-hugging-face/", "title": "CVE-2024-11394: Deserialization of Untrusted Data in Hugging Face Transformers", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.8)", "date": "2024-11-23", "type": "rce", "cve": "CVE-2024-11394", "ghsa": "GHSA-hxxf-235m-72v3", "tools": [ "transformers" ], "categories": [ "frameworks" ], "summary": "Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers.", "sources": [ { "title": "GitHub Security Advisory GHSA-hxxf-235m-72v3", "url": "https://github.com/advisories/GHSA-hxxf-235m-72v3" }, { "title": "NVD: CVE-2024-11394", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11394" } ] }, { "id": "owasp-llm01-prompt-injection", "url": "https://vibevulns.com/issues/owasp-llm01-prompt-injection/", "title": "OWASP LLM01:2025: prompt injection is the top LLM app risk", "severity": "high", "severity_basis": "OWASP Top 10 for LLM Applications 2025, rank 1", "date": "2024-11-18", "type": "prompt-injection", "cve": null, "ghsa": null, "tools": [ "openai", "anthropic", "gemini", "llama", "mistral", "deepseek", "xai" ], "categories": [ "models" ], "summary": "OWASP ranks prompt injection first in its Top 10 for LLM Applications 2025. Any app that feeds untrusted text to a model with tools or data access is exposed.", "sources": [ { "title": "OWASP GenAI: LLM01:2025 Prompt Injection", "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/" } ] }, { "id": "cve-2024-50050-llama-stack-pickle", "url": "https://vibevulns.com/issues/cve-2024-50050-llama-stack-pickle/", "title": "CVE-2024-50050: Llama Stack used pickle over sockets", "severity": "medium", "severity_basis": "CVSS 3.1 score 6.3 (NVD)", "date": "2024-10-23", "type": "rce", "cve": "CVE-2024-50050", "ghsa": null, "tools": [ "llama" ], "categories": [ "models" ], "summary": "Meta’s Llama Stack used Python pickle to deserialise socket messages, which could allow remote code execution. It switched to JSON.", "sources": [ { "title": "NVD: CVE-2024-50050", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50050" } ] }, { "id": "chatgpt-spaiware-memory-injection", "url": "https://vibevulns.com/issues/chatgpt-spaiware-memory-injection/", "title": "SpAIware: prompt injection writes into ChatGPT’s long-term memory", "severity": "high", "severity_basis": "Researcher rating; no CVE", "date": "2024-09-20", "type": "prompt-injection", "cve": null, "ghsa": null, "tools": [ "openai" ], "categories": [ "models" ], "summary": "Embrace The Red showed untrusted content planting persistent instructions in ChatGPT’s memory on the macOS app, so later chats kept sending data to the attacker.", "sources": [ { "title": "Embrace The Red: Spyware Injection Into Your ChatGPT’s Long-Term Memory (SpAIware)", "url": "https://embracethered.com/blog/posts/2024/chatgpt-macos-app-persistent-data-exfiltration/" } ] }, { "id": "cve-2024-46946-langchain-experimental-eval-injection", "url": "https://vibevulns.com/issues/cve-2024-46946-langchain-experimental-eval-injection/", "title": "CVE-2024-46946: LangChain Experimental Eval Injection vulnerability", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2024-09-19", "type": "rce", "cve": "CVE-2024-46946", "ghsa": "GHSA-p2qj-r53j-h3xj", "tools": [ "langchain" ], "categories": [ "frameworks" ], "summary": "langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05).", "sources": [ { "title": "GitHub Security Advisory GHSA-p2qj-r53j-h3xj", "url": "https://github.com/advisories/GHSA-p2qj-r53j-h3xj" }, { "title": "NVD: CVE-2024-46946", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46946" } ] }, { "id": "cve-2024-45201-llamaindex-includes-an-exec-call-for-import-cls", "url": "https://vibevulns.com/issues/cve-2024-45201-llamaindex-includes-an-exec-call-for-import-cls/", "title": "CVE-2024-45201: LlamaIndex includes an exec call for `import {cls_name}`", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2024-08-22", "type": "rce", "cve": "CVE-2024-45201", "ghsa": "GHSA-fxc2-8m62-m85x", "tools": [ "llamaindex" ], "categories": [ "frameworks" ], "summary": "An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}.", "sources": [ { "title": "GitHub Security Advisory GHSA-fxc2-8m62-m85x", "url": "https://github.com/advisories/GHSA-fxc2-8m62-m85x" }, { "title": "NVD: CVE-2024-45201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45201" } ] }, { "id": "cve-2024-3271-llama-index-core-command-injection", "url": "https://vibevulns.com/issues/cve-2024-3271-llama-index-core-command-injection/", "title": "CVE-2024-3271: llama-index-core Command Injection vulnerability", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2024-04-16", "type": "rce", "cve": "CVE-2024-3271", "ghsa": "GHSA-r6gp-rff2-p3hf", "tools": [ "llamaindex" ], "categories": [ "frameworks" ], "summary": "A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code.", "sources": [ { "title": "GitHub Security Advisory GHSA-r6gp-rff2-p3hf", "url": "https://github.com/advisories/GHSA-r6gp-rff2-p3hf" }, { "title": "NVD: CVE-2024-3271", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3271" } ] }, { "id": "cve-2024-28224-ollama-dns-rebinding", "url": "https://vibevulns.com/issues/cve-2024-28224-ollama-dns-rebinding/", "title": "CVE-2024-28224: Ollama DNS rebinding vulnerability", "severity": "high", "severity_basis": "GitHub advisory severity: high (CVSS 8.8)", "date": "2024-04-08", "type": "ssrf", "cve": "CVE-2024-28224", "ghsa": "GHSA-5jx5-hqx5-2vrj", "tools": [ "ollama" ], "categories": [ "frameworks" ], "summary": "Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).", "sources": [ { "title": "GitHub Security Advisory GHSA-5jx5-hqx5-2vrj", "url": "https://github.com/advisories/GHSA-5jx5-hqx5-2vrj" }, { "title": "NVD: CVE-2024-28224", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28224" } ] }, { "id": "many-shot-jailbreaking", "url": "https://vibevulns.com/issues/many-shot-jailbreaking/", "title": "Many-shot jailbreaking: long context windows weaken refusals", "severity": "medium", "severity_basis": "Vendor research; no CVE", "date": "2024-04-02", "type": "jailbreak", "cve": null, "ghsa": null, "tools": [ "anthropic", "openai", "gemini", "llama", "mistral" ], "categories": [ "models" ], "summary": "Anthropic published research showing that filling a long prompt with many fake dialogue examples can push models into answering requests they would normally refuse.", "sources": [ { "title": "Anthropic: Many-shot jailbreaking", "url": "https://www.anthropic.com/research/many-shot-jailbreaking" } ] }, { "id": "cve-2024-27444-langchain-experimental-vulnerable-to-arbitrary", "url": "https://vibevulns.com/issues/cve-2024-27444-langchain-experimental-vulnerable-to-arbitrary/", "title": "CVE-2024-27444: LangChain Experimental vulnerable to arbitrary code execution", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2024-02-26", "type": "rce", "cve": "CVE-2024-27444", "ghsa": "GHSA-v8vj-cv27-hjv8", "tools": [ "langchain" ], "categories": [ "frameworks" ], "summary": "langchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__…", "sources": [ { "title": "GitHub Security Advisory GHSA-v8vj-cv27-hjv8", "url": "https://github.com/advisories/GHSA-v8vj-cv27-hjv8" }, { "title": "NVD: CVE-2024-27444", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27444" } ] }, { "id": "cve-2023-6730-transformers-has-a-deserialization-of-untrusted", "url": "https://vibevulns.com/issues/cve-2023-6730-transformers-has-a-deserialization-of-untrusted/", "title": "CVE-2023-6730: transformers has a Deserialization of Untrusted Data vulnerability", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9)", "date": "2023-12-19", "type": "rce", "cve": "CVE-2023-6730", "ghsa": "GHSA-3863-2447-669p", "tools": [ "transformers" ], "categories": [ "frameworks" ], "summary": "Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0.", "sources": [ { "title": "GitHub Security Advisory GHSA-3863-2447-669p", "url": "https://github.com/advisories/GHSA-3863-2447-669p" }, { "title": "NVD: CVE-2023-6730", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6730" } ] }, { "id": "cve-2023-32785-langchain-sql-injection", "url": "https://vibevulns.com/issues/cve-2023-32785-langchain-sql-injection/", "title": "CVE-2023-32785: Langchain SQL Injection vulnerability", "severity": "critical", "severity_basis": "GitHub advisory severity: critical (CVSS 9.8)", "date": "2023-10-21", "type": "prompt-injection", "cve": "CVE-2023-32785", "ghsa": "GHSA-8h5w-f6q9-wg35", "tools": [ "langchain" ], "categories": [ "frameworks" ], "summary": "In Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.", "sources": [ { "title": "GitHub Security Advisory GHSA-8h5w-f6q9-wg35", "url": "https://github.com/advisories/GHSA-8h5w-f6q9-wg35" }, { "title": "NVD: CVE-2023-32785", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32785" } ] } ] }