Articles
Daily digests summarizing the vulnerabilities and incidents tracked by VulnWatch.
-
· 5 entries · daily · Subscribers only
vLLM RCE and Flowise Credential Leak: September 12 AI Security Digest
Critical vulnerabilities in vLLM enable remote code execution and DoS via malformed media, while Flowise exposes cross-tenant credential access. Immediate patching and configuration audits are required.
-
· 14 entries · daily · Subscribers only
VulnWatch Daily: Critical RCE in Mistral Vibe & Agentic Supply Chain Risks
Today's digest highlights a cluster of critical RCE vulnerabilities in Mistral Vibe allowing full command bypass, alongside severe agentic supply chain flaws in MySQL MCP and Shopper frameworks requiring immediate remediation.
-
· 43 entries · daily · Subscribers only
Langflow Catastrophe: 14 Critical Flaws Expose AI Orchestration to RCE
A massive cluster of vulnerabilities in IBM Langflow enables unauthenticated RCE and session hijacking. Additional critical issues affect mistral.rs, vLLM, and agentic frameworks via SSRF and path traversal.
-
· 5 entries · daily · Subscribers only
VulnWatch Daily: Critical MCP RCEs and Supply Chain Risks in AI Agents
Today's digest highlights critical Remote Code Execution flaws in Model Context Protocol servers, including command injection in AWS tools and package alias abuse. We also cover data leakage in Nuxt Ollama and DoS vectors in Kotlin SDKs and TOML parsers affecting AI agents.
-
· 17 entries · daily · Subscribers only
VulnWatch Daily: Critical GitPython RCE, DeepSeek Auth Bypass, and vLLM Data Leaks
Today's digest highlights a critical config corruption flaw in GitPython enabling RCE, an authentication bypass in DeepSeek Harness, and cross-user data leakage in vLLM inference kernels.
-
· 4 entries · daily · Subscribers only
VulnWatch Digest: RPC Assertions, GGUF Overflows, and Supply Chain Risks
Today's briefing covers critical integrity flaws in llama.cpp RPC servers, integer overflows in Ollama's GGUF decoder, and supply chain prompt injection risks in Elixir tooling.
-
· 101 entries · weekly
VulnWatch Weekly: The Agentic Explosion & The LiteLLM Emergency
This week marks a turning point for AI security as agentic frameworks become the primary attack surface. With a known-exploited vulnerability in LiteLLM and critical RCEs in MCP hubs, immediate patching is required.
-
· 1 entry · daily · Subscribers only
VulnWatch Daily: JeecgBoot LLM Module Auth Bypass Analyzed
A low-severity authentication bypass in JeecgBoot's AI module allows remote manipulation of export functions via credential parameters, requiring immediate patching despite the low CVSS score.
-
· 2 entries · daily · Subscribers only
Axolotl RCE and Rowboat SSRF: Critical Risks in AI Tooling
New vulnerabilities in Axolotl and Rowboat expose AI pipelines to remote code execution and server-side request forgery, demanding immediate patching and configuration audits for ML platforms.
-
· 45 entries · daily · Subscribers only
VulnWatch Digest: Critical RCE in AI Agents and Widespread SSRF in Model Serving
Today's digest highlights critical remote code execution flaws in CodeWhale and LaVague agents, alongside a wave of SSRF vulnerabilities in OpenAI-compatible APIs. Immediate patching is required for multiple high-severity issues affecting Langflow, vLLM, and Hugging Face tokenizers.
-
· 18 entries · daily · Subscribers only
VulnWatch Daily: Critical RCE in Claude Code, SSRF in Unstructured, and Auth Bypasses
Today's digest highlights critical remote code execution in Claude Code Studio, full-read SSRF in the ubiquitous Unstructured library, and severe authentication bypasses in MISP and Copilot Studio affecting AI supply chains.
-
· 13 entries · daily · Subscribers only
VulnWatch Daily: Critical Agentic RCE and LiteLLM Auth Bypasses
Today's digest highlights critical vulnerabilities in agentic frameworks allowing shared bundle overwrites and RCE, alongside active exploitation of LiteLLM authentication flaws and supply-chain risks in model training data handlers.
-
· 7 entries · daily · Subscribers only
VulnWatch Daily: Critical RCE in Elasticsearch ML and Supply Chain Risks
Today's digest highlights a critical deserialization flaw in Elasticsearch ML enabling RCE, a recursion DoS in llama.cpp, and supply chain vulnerabilities in Scrapy and pnpm affecting AI data pipelines.
-
· 13 entries · daily · Subscribers only
MCPHub Critical Flaws and Agentic RCE Risks Dominate August 31 Vulnerability Landscape
A surge of critical vulnerabilities in MCPHub and Eclipse Theia exposes agentic systems to RCE, SSRF, and prompt injection attacks, demanding immediate patching and architectural review.
-
· 93 entries · weekly
VulnWatch Weekly: The MCP Security Crisis & Langflow RCE
This week marks a turning point for AI security with critical RCEs in Langflow and a systemic collapse of authentication in the Model Context Protocol (MCP) ecosystem. Immediate patching is required for Kubeflow, Langflow, and all exposed MCP servers.