Articles
Daily digests summarizing the vulnerabilities and incidents tracked by VulnWatch.
-
· 30 entries · daily · Subscribers only
VulnWatch Daily: Critical Kubeflow Flaws and Agentic Supply Chain Risks
Today's digest highlights critical authorization bypasses in Kubeflow Pipelines, command injection risks in AG2 and AgentScope, and widespread validation failures in the Model Context Protocol ecosystem.
-
· 16 entries · daily · Subscribers only
Critical AI Infrastructure Flaws: GPUStack RCE, Mistral Supply Chain, and MLflow Deserialization
Today's digest covers critical vulnerabilities in GPUStack allowing full cluster compromise, supply-chain RCEs in Mistral Vibe via Git hooks, and multiple deserialization flaws in MLflow requiring immediate patching.
-
· 9 entries · daily · Subscribers only
VulnWatch Daily: Agentic Path Traversal, Pickle RCE, and Auth Bypasses
Today's digest highlights critical path traversal flaws in agentic tools, a dangerous pickle deserialization RCE in Stanza, and multiple authorization bypasses in ML platforms allowing cross-tenant data leakage.
-
· 8 entries · daily · Subscribers only
VulnWatch Daily: Critical psqlODBC Flaws and Agentic Bypasses
Today's digest highlights a cluster of high-severity memory corruption bugs in psqlODBC, a read-only bypass in DBHub affecting AI agents, and authentication gaps in emerging AI networking protocols.
-
· 120 entries · weekly
VulnWatch Weekly: The Langflow Tsunami and the MCP Security Crisis
This week saw an unprecedented flood of critical RCEs in IBM Langflow and a systemic collapse of security boundaries in the Model Context Protocol (MCP) ecosystem. Immediate patching is required for Langflow instances and any MCP server exposing tools to untrusted networks.
-
· 1 entry · daily · Subscribers only
Critical RCE in Prefab UI: When WebAssembly Sandboxes Fail
A critical vulnerability in Prefab UI's Generative UI feature allows untrusted LLM-generated Python code to escape Pyodide isolation and execute arbitrary OS commands via an misconfigured Deno subprocess.
-
· 1 entry · daily · Subscribers only
VulnWatch Daily: Critical Heap Overflow in libheif Threatens AI Vision Pipelines
A high-severity heap-based buffer overflow in libheif (CVE-2026-120208) allows arbitrary code execution via crafted HEIF files with mismatched chroma bit depths, posing immediate risks to AI image preprocessing services.
-
· 18 entries · daily · Subscribers only
VulnWatch Daily: Critical Agentic RCEs and Supply Chain Flaws in AI Stacks
Today's digest highlights critical remote code execution risks in AI agents, unauthenticated setup flaws in Okta integrations, and severe supply chain vulnerabilities in popular LLM orchestration frameworks like Flowise and n8n.
-
· 47 entries · daily · Subscribers only
Langflow RCE Storm: Critical Supply Chain & Agentic Vulnerabilities
A massive cluster of critical RCE flaws hits IBM Langflow, while agentic frameworks like Agno and Crawl4AI face new prompt injection and model poisoning risks. Immediate patching required.
-
· 38 entries · daily · Subscribers only
VulnWatch Daily: Critical RCE in llama.cpp, MCP Ecosystem Compromised, and vLLM DoS Vectors
Today's digest highlights a critical stack overflow in llama.cpp's RDMA transport, widespread authorization failures in Model Context Protocol (MCP) servers, and multiple denial-of-service vectors in vLLM. Immediate patching is required for distributed inference clusters and agentic platforms.
-
· 53 entries · daily · Subscribers only
VulnWatch Daily: Critical RCE in MLflow, Agentic Injection Wave, and llama.cpp Memory Flaws
Today's digest highlights a critical RCE in MLflow scorers, a surge of command injection vulnerabilities across MCP servers, and severe memory safety issues in llama.cpp and TensorRT-LLM affecting model loading and inference.
-
· 26 entries · daily · Subscribers only
vLLM RCE Wave, Agentic Data Leaks, and ONNX DoS: The October 26 Digest
A critical cluster of vulnerabilities in vLLM enables RCE and DoS via multimodal inputs, while agentic frameworks suffer from hardcoded keys and tenant isolation failures. Immediate patching is required for inference engines and agent memory systems.
-
· 120 entries · weekly
VulnWatch Weekly: Agentic RCE Epidemic & vLLM DoS Storm
This week saw a surge in critical agentic vulnerabilities allowing unauthenticated RCE via shell tools. Simultaneously, vLLM faced a wave of DoS vectors targeting multimodal processors.
-
· 12 entries · daily · Subscribers only
vLLM Under Siege: Critical DoS and SSRF Flaws Threaten Inference Stability
A cluster of high-severity vulnerabilities in vLLM exposes inference engines to SSRF, resource exhaustion, and crashes via malformed multimodal inputs. Immediate patching to v0.31.0+ is critical for platform stability.
-
· 37 entries · daily · Subscribers only
VulnWatch Digest: Critical RCE in Agentic Frameworks and MCP Isolation Failures
Today's digest highlights critical remote code execution risks in AgenticSeek and Aider, alongside severe session isolation failures in Strands Agents and Model Context Protocol servers requiring immediate remediation.