Vulnerabilities
CVEs, zero-days and exploit research with an AI angle.
SGLang debug feature lets attackers run code on AI inference servers — no fix yet, keep it switched off
CVE-2026-111391 affects SGLang 0.5.10–0.5.22 when the optional "dumper" debug server is enabled. It is off by default; there is no patch yet.
From SELECT to sysadmin: SQL Server's Copilot enforced "read-only" with a regex
A BlueHat Asia talk shows how Copilot in SQL Server Management Studio could be steered past its "read-only" mode, and how one database owner's notes became an attack on admins.
Archon AI coding agent's control API has no login by default — anyone who can reach it can run commands
A critical flaw (CVE-2026-111322) lets anyone who can reach an Archon server instruct its AI coding agent to run commands. No fixed release yet — restrict access now.
The kernel bug from Vercel's $1M sandbox challenge is now CVE-2026-99999 — and NVD hasn't listed it
A malformed checksum in the Linux IPv4 stack can corrupt host memory from a guest VM. Scored 9.3, fixed upstream on October 15, still marked unfixed by Red Hat and absent from NVD.
Langflow MCP flaw draws 1,400+ exploit attempts — and the first fix, 1.9.0, was incomplete
A honeypot logged over 1,400 attempts to exploit a 9.9-rated Langflow command-injection flaw. The full fix is in 1.10.3; 1.9.0 left the execution path open.
AI agents built a $250,000 Chrome exploit chain in six days — what it means for patching
XBOW used OpenAI's GPT-5.6 Sol to chain three Chrome bugs into a sandbox escape for about $40,000. All are fixed; make sure Chrome is at 152.0.7977.82 or later.
AI-found Linux kernel flaw "Vghost" gives local users root — and can let a VM reach its host
Tencent's AI-assisted research found CVE-2026-74580 in the vhost subsystem, present since Linux 4.11. Fixes are out for most distros; Ubuntu 24.04 and 26.04 are still pending.
AI-found flaw in Rejetto HFS file server now under attack — update to 3.2.1
Anthropic's Mythos helped Horizon3.ai find a login-bypass flaw in HFS that leads to server takeover. Probing began a day after the write-up. Patch now.
Two Unsloth flaws let a model's config file run code — one needs no trust_remote_code
A Pillar Security researcher found two ways a Hugging Face model's config.json could run code on machines using Unsloth. Both are fixed; only one got a CVE.
No patch yet for a LiteLLM flaw that turns any valid login token into an admin account
CVE-2026-93355 lets anyone holding a valid token from your identity provider sign in as another LiteLLM user, including an admin. Affected through 1.102.1; the fix today is configuration.
Ten advisories, no patched version: LightLLM's internal services are open by default
Ten CVEs now list ModelTC's LightLLM inference server as affected, nine of them through 1.2.0 — its newest release. Six are unauthenticated remote code execution. There is no version to upgrade to.
Mooncake, the KV cache layer under vLLM and SGLang, has two unauthenticated flaws — one unfixed
Two CVEs published October 1, 2026 in Mooncake's transfer engine. One lets anyone on the network read and write process memory; the other has no released fix.
Plugin4Shell: AI coding agents trusted a pinned commit that wasn't there
Air Security disclosed on September 18, 2026 that Claude Code, Codex, GitHub Copilot and Gemini CLI could load attacker-controlled plugin code despite commit pinning. Two are patched, two are not.
Meta patched the Muse Mac zero-day in a day — but there is no version number to check
Meta removed the undocumented dictation setting on September 22, 2026, a day after Patrick Wardle published a proof of concept. No CVE, no fixed build number — here is how to check.
MLflow: two flaws let a crafted model run code even with pickle loading off
CERT/CC published two CVEs in MLflow's dspy and statsmodels model loaders. The statsmodels fix shipped in 3.15.0; the dspy gap is still open in the current release.
Four CVEs in Obot's MCP gateway: the critical one is the Docker quickstart itself
CVE records published September 27–28, 2026 cover four flaws in Obot's MCP gateway. The critical one is a documented Docker quickstart that exposes admin access with no authentication.
Salesforce patched three Agentforce flaws that let a public web form quietly drain CRM data
Zenity Labs disclosed "SalesBleed" on September 24, 2026: three flaws that let a hidden instruction in a public lead form make Agentforce leak account records. Salesforce fixed them in August.
Claude Opus 5 turned an undocumented image bug into access to OpenAI's internal code repo
Hacktron researchers chained a HEIF image flaw in OpenAI's Discourse forum to an SSO weakness and reached an internal repo. If you self-host Discourse or process user images, patch now.