Articles
Daily digests summarizing the vulnerabilities and incidents tracked by VulnWatch.
-
· 16 entries · daily · Subscribers only
Critical AI Infrastructure Flaws: GPUStack RCE, Mistral Supply Chain, and MLflow Deserialization
Today's digest covers critical vulnerabilities in GPUStack allowing full cluster compromise, supply-chain RCEs in Mistral Vibe via Git hooks, and multiple deserialization flaws in MLflow requiring immediate patching.
-
· 9 entries · daily · Subscribers only
VulnWatch Daily: Agentic Path Traversal, Pickle RCE, and Auth Bypasses
Today's digest highlights critical path traversal flaws in agentic tools, a dangerous pickle deserialization RCE in Stanza, and multiple authorization bypasses in ML platforms allowing cross-tenant data leakage.
-
· 120 entries · weekly
VulnWatch Weekly: The Langflow Tsunami and the MCP Security Crisis
This week saw an unprecedented flood of critical RCEs in IBM Langflow and a systemic collapse of security boundaries in the Model Context Protocol (MCP) ecosystem. Immediate patching is required for Langflow instances and any MCP server exposing tools to untrusted networks.
-
· 38 entries · daily · Subscribers only
VulnWatch Daily: Critical RCE in llama.cpp, MCP Ecosystem Compromised, and vLLM DoS Vectors
Today's digest highlights a critical stack overflow in llama.cpp's RDMA transport, widespread authorization failures in Model Context Protocol (MCP) servers, and multiple denial-of-service vectors in vLLM. Immediate patching is required for distributed inference clusters and agentic platforms.
-
· 53 entries · daily · Subscribers only
VulnWatch Daily: Critical RCE in MLflow, Agentic Injection Wave, and llama.cpp Memory Flaws
Today's digest highlights a critical RCE in MLflow scorers, a surge of command injection vulnerabilities across MCP servers, and severe memory safety issues in llama.cpp and TensorRT-LLM affecting model loading and inference.
-
· 120 entries · weekly
VulnWatch Weekly: Agentic RCE Epidemic & vLLM DoS Storm
This week saw a surge in critical agentic vulnerabilities allowing unauthenticated RCE via shell tools. Simultaneously, vLLM faced a wave of DoS vectors targeting multimodal processors.
-
· 8 entries · daily · Subscribers only
VulnWatch Daily: Critical LiteLLM Auth Bypass and RAG Injection Risks
Today's digest highlights a critical authentication bypass in LiteLLM allowing admin takeover, multi-tenant isolation failures in Amazon Strands, and new injection vectors in GraphRAG and terminal integrations.
-
· 26 entries · daily · Subscribers only
VulnWatch Daily: Critical RCE in vLLM and Agentic Frameworks Compromised
Today's digest highlights a critical remote code execution flaw in vLLM allowing arbitrary Python execution via model revisions, alongside severe prompt injection and path traversal vulnerabilities in agentic frameworks like CrewAI and HKUDS Vibe-Trading.
-
· 80 entries · weekly
VulnWatch Weekly: Agentic RCE, MCP Supply Chain, and Model DoS Surge
This week saw a critical surge in agentic vulnerabilities, with CVE-2026-96620 enabling RCE in Claude Agent SDK and deep flaws in MCP servers. Model serving stacks like SGLang and vLLM faced severe DoS vectors, while supply-chain risks in Podman and DeepSeek demand immediate patching.
-
· 16 entries · daily · Subscribers only
VulnWatch Daily: Critical RCE in LMCache, Agentic Injection in Claude SDK, and Supply Chain Risks
Today's digest highlights critical remote code execution flaws in LMCache and SGLang, a dangerous argument injection in the Claude Agent SDK, and severe supply chain vulnerabilities in DeepSeek and MariaDB affecting AI infrastructure.
-
· 23 entries · daily · Subscribers only
VulnWatch Daily: Critical MCP Flaws and SGLang DoS Waves
Today's digest highlights critical authorization bypasses in Model Context Protocol servers, a cascade of denial-of-service vectors in SGLang, and severe prompt-injection risks in agentic frameworks.
-
· 120 entries · weekly
VulnWatch Weekly: The Week of Mass RCE in AI Agents and Orchestration
This week saw an unprecedented wave of Critical RCEs in AI orchestration tools like Langflow and PraisonAI, driven by unsandboxed code execution and prompt injection. Immediate patching is required for agent platforms, MCP servers, and model inference engines to prevent total host compromise.
-
· 8 entries · daily · Subscribers only
VulnWatch Daily: Critical Agentic RCEs and MCP Server Exposures
Today's digest highlights critical RCE vulnerabilities in Astron Agent and unauthenticated access in x64dbg-MCP servers, alongside severe auth-bypass flaws in Nginx-UI and Vikunja affecting AI-adjacent platforms.
-
· 40 entries · daily · Subscribers only
VulnWatch Daily: Langflow RCE Flood, MCP Protocol Flaws, and Agent Injection Risks
A critical surge in Langflow vulnerabilities exposes AI orchestration platforms to remote code execution. New findings also highlight severe risks in Model Context Protocol implementations and agent webhook authentication.
-
· 63 entries · weekly
VulnWatch Weekly: Agentic RCE Epidemic & The Fall of Vibe-Trading
This week's digest highlights a catastrophic cluster of Remote Code Execution (RCE) vulnerabilities in agentic frameworks, led by critical flaws in Vibe-Trading and Devika. Security teams must immediately audit LLM tool definitions and sandbox boundaries as the 'agent-as-a-service' model faces its first major exploitation wave.