AI Security

← Security overview

1. Nov 112026

   URGENT: WordPress Plugin Flaw Lets Subscribers Become Admins

   CVE-2026-121576: Privilege Escalation Flaw in MCP Server for WordPress Plugin Allows Low-Privilege Users to Gain Admin Access

   HighPatch availableMCP Server for WordPress pluginMCP & agent tools

2. Nov 112026

   URGENT: MCP SDK Leaked Client Data Across HTTP Connections

   CVE-2026-111770: Model Context Protocol TypeScript SDK Delivered Messages to Wrong HTTP Clients

   HighPatch available@modelcontextprotocol/serverMCP & agent tools

3. Nov 112026

   URGENT: AI Codebase Tool Exposes Server Files

   CVE-2026-77604: Path Traversal Vulnerability in Code Graph RAG MCP Server Allows Arbitrary File Read

   HighPatch availableCode Graph RAGMCP & agent tools

4. Nov 112026

   URGENT: ChatCLI OAuth Flaw Enables Token Replay Attacks

   CVE-2026-123271: ChatCLI OAuth Flaw Allows Token Theft via Malicious MCP Servers

   HighPatch availableChatCLIMCP & agent tools

5. Nov 112026

   URGENT: Unauthenticated RCE in AgentScope MCP API

   CVE-2026-123022: AgentScope MCP Workspace Allows Unauthenticated Remote Code Execution

   HighNo fix yetAgentScopeMCP & agent tools

6. Nov 112026

   URGENT: Path Traversal Flaw Exposes Secrets in IBM Langflow OSS

   CVE-2026-97677: Path Traversal Flaw in IBM Langflow OSS 1.0.0–1.12.2 Allows File Read/Write

   HighPatch availableIBM Langflow OSSMCP & agent tools

7. Nov 112026

   URGENT: Development IDE Server Exposed to Network Attacks

   CVE-2026-112136: Mendix Studio Pro MCP Server Exposed to Remote Network Attacks

   HighPatch availableMendix Studio Pro 11MCP & agent tools

8. Nov 112026

   URGENT: Symlink Flaw Enables File System Escape in AI Code Analysis Tool

   CVE-2026-87008: Symlink Vulnerability in Code Graph RAG Allows Arbitrary File Read and Write Outside Project Root

   HighPatch availableCode Graph RAGMCP & agent tools

9. Nov 112026

   URGENT: OAuth Token Theft Flaw in mcp-go Client Library

   CVE-2026-123272: Token Theft Vulnerability in mcp-go OAuth Client Allows Malicious Servers to Obtain Credentials for Other Resources

   HighPatch availableMark3labs mcp-goMCP & agent tools

10. Nov 112026

    URGENT: Agent Hijacking via MCP Tool Injection

    CVE-2026-54140: OpenHuman MCP Tool Description Injection Allows Silent Agent Hijacking

    HighPatch availableOpenHumanMCP & agent tools

11. Nov 112026

    URGENT: Single Malformed Request Crashes Particle Animation Server

    CVE-2026-76892: Malformed JSON Crashes tsParticles MCP Server, Causing Denial of Service

    HighPatch available@tsparticles/mcp-serverMCP & agent tools

12. Nov 102026

    URGENT: Microsoft MCP Gateway had an 8.8 auth bypass

    Microsoft MCP Gateway CVE-2026-109492: A Name Collision Let One User Reach Another’s Workloads

    HighPatch availableMicrosoft MCP GatewayMCP & agent tools

13. Nov 22026

    URGENT: Agents are installing abandoned MCP servers with RCE

    MCPhantom: Coding Agents Are Installing Deprecated MCP Servers That Still Have RCE Bugs

    HighNo fix yetDeprecated MCP serversMCP & agent tools

14. Oct 272026

    DANGER: NVIDIA NeMo Agent Toolkit had a CVSS 10.0 auth gap

    NVIDIA NeMo Agent Toolkit CVE-2026-65145: A CVSS 10.0 Missing-Authentication Flaw

    CriticalPatch availableNVIDIA NeMo Agent ToolkitMCP & agent tools

15. Mar 232026

    URGENT: OpenClaw: Viral Open-Source AI Project on GitHub

    HighReportedMCP & agent tools

16. Feb 112026

    ALERT: Zero-Click Vulnerability in Claude DXT: AI Security Risks

    MediumReportedClaudeMCP & agent tools

17. Jan 222026

    URGENT: Anthropic Git MCP Server RCE Analysis

    HighReportedClaudeMCP & agent tools