{
    "version": "https://jsonfeed.org/version/1.1",
    "title": "VulnWatch — AI Security Tracker",
    "description": "Curated AI/ML security vulnerabilities, advisories, and breach disclosures.",
    "home_page_url": "https://vulnwatch.ai",
    "feed_url": "https://vulnwatch.ai/feed/json",
    "language": "en-US",
    "authors": [{
            "name": "VulnWatch"
        }
    ],
    "items": [{
            "id": "https://vulnwatch.ai/019fdeab-662d-72ff-acf9-d6d11014a764",
            "title": "CVE-2026-61808: LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds t",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61808",
            "content_html": "LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1.",
            "summary": "LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1.",
            "date_published": "2026-08-08T00:00:02+00:00",
            "date_modified": "2026-08-08T00:00:02+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fdeab-6629-70a9-b9d1-5e86bf053bb1",
            "title": "CVE-2026-48039: Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `A",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48039",
            "content_html": "Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the `META_ACCESS_TOKEN` environment variable, and when the downstream Meta Graph API call fails, `api.py:263\u2013269` serialises the raw `httpx` request URL\u2014including the operator's `access_token` as a query parameter\u2014into the JSON-RPC response body, delivering the credential to the unauthenticated caller. Version 1.0.109 fixes the issue.",
            "summary": "Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the `META_ACCESS_TOKEN` environment variable, and when the downstream Meta Graph API call fails, `api.py:263\u2013269` serialises the raw `httpx` request URL\u2014including the operator's `access_token` as a query parameter\u2014into the JSON-RPC response body, delivering the credential to the unauthenticated caller. Version 1.0.109 fixes the issue.",
            "date_published": "2026-08-08T00:00:02+00:00",
            "date_modified": "2026-08-08T00:00:02+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fdeab-6623-71ff-a43d-494e7cb31a0a",
            "title": "CVE-2026-71847: Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consume",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71847",
            "content_html": "Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.",
            "summary": "Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.",
            "date_published": "2026-08-08T00:00:02+00:00",
            "date_modified": "2026-08-08T00:00:02+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fdee2-533b-73d8-8810-2b09121dca8e",
            "title": "Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams",
            "url": "https://github.com/advisories/GHSA-9hj4-r449-hfvc",
            "content_html": "### Summary\n\nRuby's JSON native C extension clears the consumed `JSON::ResumableParser` input buffer but leaves `state.start`, `state.cursor`, and `state.end` pointing into released storage.\n\nWhen `partial_value` reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls `cursor_position`, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process.\n\nAn attacker who can supply JSON stream data to an application using `JSON::ResumableParser` may cause process termination when the application calls `partial_value` on incomplete attacker-controlled input containing duplicate object keys.\n\nThe issue was reproduced in the native C extension from the official RubyGems releases:\n\n* JSON 2.20.0\n* JSON 2.21.0\n* JSON 2.21.1\n\nThe attached evidence demonstrates:\n\n* an AddressSanitizer-confirmed heap-use-after-free;\n* a native `SIGSEGV` using the official JSON 2.21.1 RubyGem;\n* an end-to-end loopback TCP attacker\/victim reproduction;\n* four differential controls;\n* successful execution after applying a tested patch control.\n\nThis was originally reported privately through Ruby's HackerOne program as report `#3867755`. A Ruby maintainer independently confirmed reproduction of the ASan failure and requested that further coordination continue through this private advisory.\n\nNo code execution or information disclosure is claimed.\n\n### Details\n\nThe affected source is:\n\n```text\next\/json\/ext\/parser\/parser.c\n```\n\nThe vulnerable sequence in JSON 2.21.1 is:\n\n1. `cResumableParser_parse` reaches the end of the current input buffer.\n2. It calls `json_str_clear(parser->buffer)`.\n3. It sets `parser->buffer = Qfalse`.\n4. The parser-state pointers into the released buffer are not reset.\n5. `partial_value` makes a shallow copy of the parser state.\n6. Reconstructing an incomplete object containing duplicate keys reaches the duplicate-key warning path.\n7. `cursor_position` walks through the stale input pointers and reads released memory.\n\nRelevant source locations:\n\n* Buffer release:\n  https:\/\/github.com\/ruby\/json\/blob\/fd61def38b9bb859fee7eec8e7d3143600e5b347\/ext\/json\/ext\/parser\/parser.c#L2562-L2569\n\n* Parser-state copy:\n  https:\/\/github.com\/ruby\/json\/blob\/fd61def38b9bb859fee7eec8e7d3143600e5b347\/ext\/json\/ext\/parser\/parser.c#L2647-L2654\n\n* Stale-pointer read in `cursor_position`:\n  https:\/\/github.com\/ruby\/json\/blob\/fd61def38b9bb859fee7eec8e7d3143600e5b347\/ext\/json\/ext\/parser\/parser.c#L590-L628\n\n* Duplicate-key handling path:\n  https:\/\/github.com\/ruby\/json\/blob\/fd61def38b9bb859fee7eec8e7d3143600e5b347\/ext\/json\/ext\/parser\/parser.c#L1196-L1255\n\nWhen input is supplied to the resumable parser, the parser state stores direct pointers into the backing Ruby string:\n\n```c\nRSTRING_GETMEM(parser->buffer, start, len);\nparser->state.start = start;\nparser->state.end = start + len;\nparser->state.cursor = parser->state.start + offset;\n```\n\nAfter the current buffer has been consumed, `cResumableParser_parse` clears the string and removes the parser's reference to it:\n\n```c\nif (eos(&parser->state)) {\n    json_str_clear(parser->buffer);\n    parser->buffer = Qfalse;\n}\n```\n\nThis path does not invalidate or replace:\n\n```text\nparser->state.start\nparser->state.cursor\nparser->state.end\n```\n\n`JSON::ResumableParser#partial_value` subsequently makes a shallow copy of the parser structure:\n\n```c\nJSON_ResumableParser *original_parser = cResumableParser_get(self);\nJSON_ResumableParser parser = *original_parser;\n```\n\nWhen the partial object contains duplicate keys, reconstruction follows this call path:\n\n```text\ncResumableParser_partial_value_body\n  -> json_decode_object\n  -> json_on_duplicate_key\n  -> emit_duplicate_key_warning\n  -> emit_parse_warning\n  -> cursor_position\n```\n\n`cursor_position` then reads through pointers that may refer to released storage.\n\nAddressSanitizer reports:\n\n```text\nERROR: AddressSanitizer: heap-use-after-free\ncursor_position at parser.c:604\nfreed by cResumableParser_parse at parser.c:2567\n```\n\nThe reproducer follows the normal resumable-parser API sequence:\n\n```ruby\nparser",
            "summary": "### Summary\n\nRuby's JSON native C extension clears the consumed `JSON::ResumableParser` input buffer but leaves `state.start`, `state.cursor`, and `state.end` pointing into released storage.\n\nWhen `partial_value` reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls `cursor_position`, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process.\n\nAn attacker who can supply JSON stream data to an application using `JSON::ResumableParser` may cause process termination when the application calls `partial_value` on incomplete attacker-controlled input containing duplicate object keys.\n\nThe issue was reproduced in the native C extension from the official RubyGems releases:\n\n* JSON 2.20.0\n* JSON 2.21.0\n* JSON 2.21.1\n\nThe attached evidence demonstrates:\n\n* an AddressSanitizer-confirmed heap-use-after-free;\n* a native `SIGSEGV` using the official JSON 2.21.1 RubyGem;\n* an end-to-end loopback TCP attacker\/victim reproduction;\n* four differential controls;\n* successful execution after applying a tested patch control.\n\nThis was originally reported privately through Ruby's HackerOne program as report `#3867755`. A Ruby maintainer independently confirmed reproduction of the ASan failure and requested that further coordination continue through this private advisory.\n\nNo code execution or information disclosure is claimed.\n\n### Details\n\nThe affected source is:\n\n```text\next\/json\/ext\/parser\/parser.c\n```\n\nThe vulnerable sequence in JSON 2.21.1 is:\n\n1. `cResumableParser_parse` reaches the end of the current input buffer.\n2. It calls `json_str_clear(parser->buffer)`.\n3. It sets `parser->buffer = Qfalse`.\n4. The parser-state pointers into the released buffer are not reset.\n5. `partial_value` makes a shallow copy of the parser state.\n6. Reconstructing an incomplete object containing duplicate keys reaches the duplicate-key warning path.\n7. `cursor_position` walks through the stale input pointers and reads released memory.\n\nRelevant source locations:\n\n* Buffer release:\n  https:\/\/github.com\/ruby\/json\/blob\/fd61def38b9bb859fee7eec8e7d3143600e5b347\/ext\/json\/ext\/parser\/parser.c#L2562-L2569\n\n* Parser-state copy:\n  https:\/\/github.com\/ruby\/json\/blob\/fd61def38b9bb859fee7eec8e7d3143600e5b347\/ext\/json\/ext\/parser\/parser.c#L2647-L2654\n\n* Stale-pointer read in `cursor_position`:\n  https:\/\/github.com\/ruby\/json\/blob\/fd61def38b9bb859fee7eec8e7d3143600e5b347\/ext\/json\/ext\/parser\/parser.c#L590-L628\n\n* Duplicate-key handling path:\n  https:\/\/github.com\/ruby\/json\/blob\/fd61def38b9bb859fee7eec8e7d3143600e5b347\/ext\/json\/ext\/parser\/parser.c#L1196-L1255\n\nWhen input is supplied to the resumable parser, the parser state stores direct pointers into the backing Ruby string:\n\n```c\nRSTRING_GETMEM(parser->buffer, start, len);\nparser->state.start = start;\nparser->state.end = start + len;\nparser->state.cursor = parser->state.start + offset;\n```\n\nAfter the current buffer has been consumed, `cResumableParser_parse` clears the string and removes the parser's reference to it:\n\n```c\nif (eos(&parser->state)) {\n    json_str_clear(parser->buffer);\n    parser->buffer = Qfalse;\n}\n```\n\nThis path does not invalidate or replace:\n\n```text\nparser->state.start\nparser->state.cursor\nparser->state.end\n```\n\n`JSON::ResumableParser#partial_value` subsequently makes a shallow copy of the parser structure:\n\n```c\nJSON_ResumableParser *original_parser = cResumableParser_get(self);\nJSON_ResumableParser parser = *original_parser;\n```\n\nWhen the partial object contains duplicate keys, reconstruction follows this call path:\n\n```text\ncResumableParser_partial_value_body\n  -> json_decode_object\n  -> json_on_duplicate_key\n  -> emit_duplicate_key_warning\n  -> emit_parse_warning\n  -> cursor_position\n```\n\n`cursor_position` then reads through pointers that may refer to released storage.\n\nAddressSanitizer reports:\n\n```text\nERROR: AddressSanitizer: heap-use-after-free\ncursor_position at parser.c:604\nfreed by cResumableParser_parse at parser.c:2567\n```\n\nThe reproducer follows the normal resumable-parser API sequence:\n\n```ruby\nparser",
            "date_published": "2026-08-08T01:00:02+00:00",
            "date_modified": "2026-08-08T01:00:02+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fdbaa-543b-7143-9868-e5fa982f440d",
            "title": "Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets",
            "url": "https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html",
            "content_html": "A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run.\n\nNovee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5.",
            "summary": "A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run.\n\nNovee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5.",
            "date_published": "2026-08-08T04:00:13+00:00",
            "date_modified": "2026-08-08T04:00:13+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fdc18-49a3-7265-830e-1b091c38efd4",
            "title": "CVE-2026-12261: A vulnerability in `nltk.downloader` in nltk\/nltk versions <= 3.9.4 allows for cross-package resource and model poisonin",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12261",
            "content_html": "A vulnerability in `nltk.downloader` in nltk\/nltk versions",
            "summary": "A vulnerability in `nltk.downloader` in nltk\/nltk versions",
            "date_published": "2026-08-08T00:00:02+00:00",
            "date_modified": "2026-08-08T00:00:02+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd985-4c9b-7184-ab09-8424e9877ada",
            "title": "OpenAI rolls out a major ChatGPT upgrade, even if you don\u2019t pay for it",
            "url": "https://www.bleepingcomputer.com/news/artificial-intelligence/openai-rolls-out-a-major-chatgpt-upgrade-even-if-you-dont-pay-for-it/",
            "content_html": "OpenAI is rolling out\u00a0a more reliable version of ChatGPT GPT-5.6 Sol for Plus and Pro users, while Free users are getting unlimited text chats with GPT-5.6 Luna. [...]",
            "summary": "OpenAI is rolling out\u00a0a more reliable version of ChatGPT GPT-5.6 Sol for Plus and Pro users, while Free users are getting unlimited text chats with GPT-5.6 Luna. [...]",
            "date_published": "2026-08-08T04:00:13+00:00",
            "date_modified": "2026-08-08T04:00:13+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd985-298a-710d-b453-887388de835e",
            "title": "CVE-2026-70640: llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrap",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70640",
            "content_html": "llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llama_context. Attackers can exploit this by performing heap spray with attacker-controlled data containing a fake vtable to hijack the vtable pointer at offset +0x30, causing llama_batch_allocr::clear() to dereference arbitrary memory and achieve remote code execution.",
            "summary": "llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llama_context. Attackers can exploit this by performing heap spray with attacker-controlled data containing a fake vtable to hijack the vtable pointer at offset +0x30, causing llama_batch_allocr::clear() to dereference arbitrary memory and achieve remote code execution.",
            "date_published": "2026-08-07T18:00:03+00:00",
            "date_modified": "2026-08-07T18:00:03+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd985-297a-71c8-948d-c9797d815abd",
            "title": "CVE-2026-70639: llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper w",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70639",
            "content_html": "llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger a null context condition, causing a SIGSEGV crash that terminates the Android application process and results in denial of service.",
            "summary": "llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger a null context condition, causing a SIGSEGV crash that terminates the Android application process and results in denial of service.",
            "date_published": "2026-08-07T18:00:03+00:00",
            "date_modified": "2026-08-07T18:00:03+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd985-2969-70a6-a660-6358286fc47b",
            "title": "CVE-2026-70638: llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where th",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70638",
            "content_html": "llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max parameter without overflow validation, causing heap buffer allocation to wrap and allocate insufficient memory. Attackers can exploit this by providing a crafted n_seq_max value through a malicious model file or JNI call to trigger heap corruption and achieve denial of service or arbitrary code execution on Android applications using the LLaMA-Android binding.",
            "summary": "llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max parameter without overflow validation, causing heap buffer allocation to wrap and allocate insufficient memory. Attackers can exploit this by providing a crafted n_seq_max value through a malicious model file or JNI call to trigger heap corruption and achieve denial of service or arbitrary code execution on Android applications using the LLaMA-Android binding.",
            "date_published": "2026-08-07T18:00:03+00:00",
            "date_modified": "2026-08-07T18:00:03+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd985-295b-70bc-8ed0-8c22e311715b",
            "title": "CVE-2026-67622: Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration th",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67622",
            "content_html": "Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownership verification. Attackers can enumerate cross-workspace assistant metadata, retrieve file and vector store listings, and upload files into victim workspaces by exploiting the missing workspace-scoped authorization check in the credential lookup logic.",
            "summary": "Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownership verification. Attackers can enumerate cross-workspace assistant metadata, retrieve file and vector store listings, and upload files into victim workspaces by exploiting the missing workspace-scoped authorization check in the credential lookup logic.",
            "date_published": "2026-08-07T18:00:03+00:00",
            "date_modified": "2026-08-07T18:00:03+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd985-2953-71b8-bc19-e7a9101c6780",
            "title": "CVE-2026-67621: Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perf",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67621",
            "content_html": "Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.",
            "summary": "Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.",
            "date_published": "2026-08-07T18:00:03+00:00",
            "date_modified": "2026-08-07T18:00:03+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd985-2944-73cd-9b85-f73d297b2d29",
            "title": "CVE-2026-43632: llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six to",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43632",
            "content_html": "llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (\/tokenize, \/detokenize, \/infill, \/apply-template, \/rerank, and \/anthropic\/count_tokens) that bypass the task queue and access ctx_server.vocab directly on HTTP worker threads. Attackers can exploit a time-of-check-time-of-use race condition where the main thread destroys and frees vocab after the synchronization lock is released but before the handler finishes using it, causing a crash or potential code execution when --sleep-idle-seconds is configured.",
            "summary": "llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (\/tokenize, \/detokenize, \/infill, \/apply-template, \/rerank, and \/anthropic\/count_tokens) that bypass the task queue and access ctx_server.vocab directly on HTTP worker threads. Attackers can exploit a time-of-check-time-of-use race condition where the main thread destroys and frees vocab after the synchronization lock is released but before the handler finishes using it, causing a crash or potential code execution when --sleep-idle-seconds is configured.",
            "date_published": "2026-08-07T18:00:03+00:00",
            "date_modified": "2026-08-07T18:00:03+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd985-293c-7082-938e-e72a17f542f5",
            "title": "CVE-2026-43631: llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-se",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43631",
            "content_html": "llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the vulnerability by sending requests to affected endpoints while the server transitions to sleep mode, causing concurrent worker threads to dereference a freed vocab pointer that can be reclaimed with attacker-controlled data to achieve remote code execution.",
            "summary": "llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the vulnerability by sending requests to affected endpoints while the server transitions to sleep mode, causing concurrent worker threads to dereference a freed vocab pointer that can be reclaimed with attacker-controlled data to achieve remote code execution.",
            "date_published": "2026-08-07T18:00:03+00:00",
            "date_modified": "2026-08-07T18:00:03+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd985-2932-70f7-89e8-1a19c30e7deb",
            "title": "CVE-2026-43630: llama.cpp builds b5702 through b7653 contain an out-of-bounds read vulnerability in the recurrent memory state restore p",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43630",
            "content_html": "llama.cpp builds b5702 through b7653 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot save directory to read memory past the end of the allocated cells array. Attackers can craft a malicious slot file with an oversized seq_id value to trigger an out-of-bounds read that leaks heap data including pointer values into server logs, defeating ASLR protections and facilitating further exploitation.",
            "summary": "llama.cpp builds b5702 through b7653 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot save directory to read memory past the end of the allocated cells array. Attackers can craft a malicious slot file with an oversized seq_id value to trigger an out-of-bounds read that leaks heap data including pointer values into server logs, defeating ASLR protections and facilitating further exploitation.",
            "date_published": "2026-08-07T18:00:03+00:00",
            "date_modified": "2026-08-07T18:00:03+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd985-2926-70fd-90c0-8199f81b535b",
            "title": "CVE-2026-43629: llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path whe",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43629",
            "content_html": "llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to corrupt heap memory. Attackers can craft malicious state files where cell_count multiplication overflows or exceeds tensor buffer allocation to write attacker-controlled bytes past buffer boundaries, potentially resulting in heap metadata corruption, model weight corruption, or arbitrary code execution via function pointer overwrite.",
            "summary": "llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to corrupt heap memory. Attackers can craft malicious state files where cell_count multiplication overflows or exceeds tensor buffer allocation to write attacker-controlled bytes past buffer boundaries, potentially resulting in heap metadata corruption, model weight corruption, or arbitrary code execution via function pointer overwrite.",
            "date_published": "2026-08-07T18:00:03+00:00",
            "date_modified": "2026-08-07T18:00:03+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd985-2915-70c1-b6a9-a2d1b6583c37",
            "title": "CVE-2026-43628: llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sample",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43628",
            "content_html": "llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the \/v1\/completions or \/v1\/chat\/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.",
            "summary": "llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the \/v1\/completions or \/v1\/chat\/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.",
            "date_published": "2026-08-07T18:00:03+00:00",
            "date_modified": "2026-08-07T18:00:03+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd985-290b-72db-81d5-f48ba1838a81",
            "title": "CVE-2026-43627: llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where ",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43627",
            "content_html": "llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.",
            "summary": "llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.",
            "date_published": "2026-08-07T18:00:03+00:00",
            "date_modified": "2026-08-07T18:00:03+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd985-28fa-7125-97cf-68f5474b5cc2",
            "title": "CVE-2026-19111: Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Ag",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19111",
            "content_html": "Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a forged namespace parameter.\n\n\n\nTo remediate this issue, users should upgrade to version 0.8.3.",
            "summary": "Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a forged namespace parameter.\n\n\n\nTo remediate this issue, users should upgrade to version 0.8.3.",
            "date_published": "2026-08-07T18:00:03+00:00",
            "date_modified": "2026-08-07T18:00:03+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd9bb-f73a-73cb-b621-d5b732658d73",
            "title": "Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth \/ DigestAuth \/ ForwardAuth",
            "url": "https://github.com/advisories/GHSA-x677-9fxg-v5c5",
            "content_html": "## Summary\n\nThere is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth\nmiddlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers\n(e.g. `X-Auth-User`) before writing Traefik's own value, but did not account for\nunderscore-variant header names (e.g. `X_Auth_User`), which many backends normalize\nidentically to the dashed form. An attacker able to reach a protected route could inject\nan underscore-variant header that survives Traefik's stripping and reaches the backend\nalongside \u2014 or, on the unauthenticated ForwardAuth `authResponseHeaders` path, instead of\n\u2014 the value Traefik intended to set, spoofing identity or authorization context. This is\nfixed by setting the new `allowHeadersWithUnderscores: false` entry point option, which\nstrips all headers with underscores in their names before routing.\n\n## Patches\n\n- https:\/\/github.com\/traefik\/traefik\/releases\/tag\/v2.11.51\n- https:\/\/github.com\/traefik\/traefik\/releases\/tag\/v3.6.22\n- https:\/\/github.com\/traefik\/traefik\/releases\/tag\/v3.7.6\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https:\/\/github.com\/traefik\/traefik\/issues).\n\n\nOriginal Description\n\n# Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: `headerField` underscore-variant identity spoofing in BasicAuth \/ DigestAuth \/ ForwardAuth\n\n## Summary\n\nThe fix for CVE-2026-33433 (GHSA-qr99-7898-vr7c, \"BasicAuth\/DigestAuth Identity Spoofing via Non-Canonical headerField\", patched in v2.11.42 \/ v3.6.12 \/ v3.7.0-ea.3) added `req.Header.Del(headerField)` before the literal-key writeback in `pkg\/middlewares\/auth\/basic_auth.go` and `pkg\/middlewares\/auth\/digest_auth.go`. Go's `Header.Del` calls `textproto.CanonicalMIMEHeaderKey` which canonicalizes ASCII CASE and treats `-` as a word separator \u2014 so the fix correctly strips canonical-cased attacker headers (`X-Auth-User`, `x-auth-user`, `X-AUTH-USER`, etc.).\n\nHowever, `textproto.CanonicalMIMEHeaderKey` does **NOT** treat `_` as a separator. Attacker-supplied **underscore-variant** headers such as `X_Auth_User` survive `Header.Del(\"X-Auth-User\")` intact and are forwarded to the backend alongside Traefik's own writeback. Many common backends (CGI\/WSGI per RFC 3875, PHP `$_SERVER`, nginx with `underscores_in_headers on`, Tomcat \/ Java EE servlet containers, ASGI\/WSGI frameworks) normalize `_` \u2194 `-` equivalently or expose both forms to application code that may read the attacker's value.\n\nThis is the **direct cross-cohort sibling** of the threat model the maintainer accepted in **CVE-2026-39858** (GHSA-5m6w-wvh7-57vm, \"Forwarded alias spoofing pre-auth decision bypass\"), which fixed the underscore-variant of the X-Forwarded-* family via `isManagedXHeader` in `pkg\/middlewares\/forwardedheaders\/forwarded_header.go`. The CVE-2026-39858 advisory body states verbatim:\n\n> \"When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust context \u2014 such as a trusted scheme or host \u2014 through the alias headers and bypass authentication on protected routes without valid credentials.\"\n\nThe same threat model applies to the operator-configurable `headerField` (BasicAuth, DigestAuth) and `authResponseHeaders` (ForwardAuth, ingress-nginx snippet provider), but the underscore-handling primitive (`isManagedXHeader`) was not extended to those middlewares. I verified the bypass end-to-end on `traefik:v3.6.14` (the latest patched release containing both fixes) using a default-recommended canonical `headerField: \"X-Auth-User\"` config and reproduced the bypass with a single `curl -H \"X_Auth_User: superadmin\" ...` request alongside valid BasicAuth credentials.\n\nThe defect is present in four code paths at HEAD `eec68dce064f843b4317c4393aaea81b6dea31d6`:\n\n1. `pkg\/middlewares\/auth\/basic_auth.go:101-105` \u2014 BasicAuth `headerField`\n2. `pkg\/middlewares\/auth\/digest_auth.go:99-103` \u2014 DigestAuth `headerField`\n3. `pkg\/middlewares\/auth\/forward.go:304-310` \u2014 ForwardAuth `authResponseHeaders` per-name writeback\n4. `pkg\/middlewares\/ingressnginx\/snippet\/snippet.go:480-486` \u2014 Ingress-NGINX snippet `authResponseHeaders` per-name writeback\n\nThe ForwardAuth instance (#3) is particularly notable: the attacker does NOT need credentials. The `authResponseHeaders` mechanism is intended to copy identity headers from the trusted auth server only; the underscore-variant bypass lets an unauthenticated attacker pre-inject the same identity header before any auth happens.\n\nThe fast proxy at `pkg\/proxy\/fast\/proxy.go:139` explicitly calls `DisableNormalizing()` on the outgoing fasthttp request, guaranteeing that the underscore-variant header reaches the backend wire verbatim. The standard `httputil.ReverseProxy` path at `pkg\/proxy\/httputil\/proxy.go:55` likewise copies `req.Header` keys as-is during the wire write.\n\n## Affected versions\n\n- `traefik` v3.6.x \u2264 3.6.14, v3.7.x \u2264 3.7.0-rc.2, v2.11.x \u2264 2.11.43, and all earlier versions sharing the same auth middleware architecture.\n\nThe defect is present at HEAD post-CVE-2026-33433 fix (the fix added the `Del` line but the literal-key write defect-class survives for underscore variants).\n\n## Root cause\n\nIn `pkg\/middlewares\/auth\/basic_auth.go` at HEAD `eec68dc`:\n\n```go\nif b.headerField != \"\" {\n    \/\/ TODO Deprecated we should add the header with canonical key.\n    req.Header.Del(b.headerField)\n    req.Header[b.headerField] = []string{user}\n}\n```\n\nThe TODO comment shows the maintainer is aware of the literal-key write problem in general (canonical-key write would solve the case-canonicalization issue more cleanly than the current `Del` + literal-write pair). The comment does not acknowledge the underscore-variant survival corollary.\n\n`pkg\/middlewares\/auth\/digest_auth.go:99-103` and the two ForwardAuth paths follow the same `Del` + literal-write pattern. Each is independently exploitable; the underlying primitive defect is shared.\n\nThe maintainer's gold-standard primitive for handling this exact threat class is `pkg\/middlewares\/forwardedheaders\/forwarded_header.go:53-66`:\n\n```go\nfunc isManagedXHeader(key string) bool {\n    if len(key) == 0 || key[0] != 'X' { return false }\n    if _, ok := XHeadersSet[key]; ok { return true }\n    if strings.IndexByte(key, '_') < 0 { return false }\n    canonical := http.CanonicalHeaderKey(strings.ReplaceAll(key, \"_\", \"-\"))\n    _, ok := XHeadersSet[canonical]\n    return ok\n}\n```\n\nThis treats `_` \u2194 `-` equivalence as a security requirement. It is reachable only via the static `XHeadersSet` membership check, which contains exclusively the X-Forwarded-* family + X-Real-Ip. Operator-configurable identity headers are out of scope of this primitive.\n\n## Proof of concept\n\nVerified on `traefik:v3.6.14` (the patched version, post-CVE-2026-33433 and post-CVE-2026-39858) using Docker compose. Full reproducer at https:\/\/github.com\/\/traefik-ht1a-poc; commands below are verbatim.\n\n### Setup\n\n```yaml\n# docker-compose.yml\nservices:\n  traefik:\n    image: traefik:v3.6.14\n    command:\n      - --providers.file.filename=\/etc\/traefik\/dynamic.yml\n      - --entrypoints.web.address=:80\n    ports:\n      - \"8080:80\"\n    volumes:\n      - .\/traefik\/dynamic.yml:\/etc\/traefik\/dynamic.yml:ro\n  echo:\n    image: mendhak\/http-https-echo:36\n    environment:\n      - HTTP_PORT=8888\n```\n\n```yaml\n# traefik\/dynamic.yml \u2014 canonical headerField, recommended operator config\nhttp:\n  routers:\n    protected:\n      rule: \"PathPrefix(`\/`)\"\n      service: echo\n      middlewares: [basic-auth]\n  services:\n    echo:\n      loadBalancer:\n        servers: [{url: \"http:\/\/echo:8888\"}]\n  middlewares:\n    basic-auth:\n      basicAuth:\n        users:\n          - 'alice:$2b$05$FhDfYidZdDPuQjovYqcTAe22wHpQ\/cILC7Tr2yAD6vLlvZh\/Q45PC'   # alice:secret123\n        headerField: \"X-Auth-User\"\n```\n\n`docker compose up -d`.\n\n### Test 1 (control \u2014 CVE-2026-33433 fix works for canonical case)\n\n```bash\n$ curl -s -u alice:secret123 -H \"X-Auth-User: superadmin\" http:\/\/localhost:8080\/\n{\n  ...\n  \"x-auth-user\": \"alice\",\n  ...\n}\n```\n\nThe attacker's canonical `X-Auth-User: superadmin` was correctly stripped by Traefik's `Del`; the backend receives only Traefik's authenticated-user writeback `alice`.\n\n### Test 2 (HT-1A bypass \u2014 underscore variant survives)\n\n```bash\n$ curl -s -u alice:secret123 -H \"X_Auth_User: superadmin\" http:\/\/localhost:8080\/\n{\n  ...\n  \"x-auth-user\": \"alice\",\n  \"x_auth_user\": \"superadmin\",\n  ...\n}\n```\n\nThe underscore-variant `x_auth_user: superadmin` reached the backend intact, despite the `Del(\"X-Auth-User\")` having executed. The backend sees both forms.\n\n### Test 3 (double-send \u2014 same result)\n\n```bash\n$ curl -s -u alice:secret123 \\\n    -H \"X-Auth-User: superadmin\" \\\n    -H \"X_Auth_User: superadmin\" \\\n    http:\/\/localhost:8080\/\n{\n  ...\n  \"x-auth-user\": \"alice\",       # Traefik's writeback\n  \"x_auth_user\": \"superadmin\",  # attacker's underscore \u2014 survived Del\n  ...\n}\n```\n\nThe canonical attacker header is stripped (Test 1 behavior). The underscore variant is forwarded.\n\n### Backend impact\n\nThe PoC's echo backend (`mendhak\/http-https-echo`, Node.js) preserves both forms with the lowercase normalization Node.js applies. Application code reading `req.headers[\"x-auth-user\"]` sees `alice`. Application code reading `req.headers[\"x_auth_user\"]` sees `superadmin`.\n\nFor backends that normalize `_` \u2194 `-` equivalently \u2014 meaning the attacker's value wins:\n\n- **CGI \/ WSGI \/ PHP `$_SERVER`** (RFC 3875 \u00a74.1.18 \u2014 header name uppercased with `-` replaced by `_`): both `X-Auth-User` and `X_Auth_User` map to `HTTP_X_AUTH_USER`. The last-set wins per the WSGI server's iteration order; many servers (gunicorn, uwsgi without `--disable-logging`, waitress) preserve both. Note: Apache + mod_php with default `HttpProtocolOptions Strict` filters underscore-headers from `$_SERVER` (this PoC's PHP backend test demonstrated the filter); Apache + mod_python, Apache + mod_wsgi without the strict mode, nginx + uwsgi, nginx + gunicorn, nginx + FastCGI, and standalone WSGI servers do NOT filter.\n- **nginx with `underscores_in_headers on`** (https:\/\/nginx.org\/en\/docs\/http\/ngx_http_core_module.html#underscores_in_headers): preserves underscore-variant headers and forwards them to upstream as separate values. Upstream application logic that does case-insensitive + underscore-insensitive matching (common pattern in security-sensitive code) merges them.\n- **Tomcat \/ Java EE servlet containers**: `HttpServletRequest.getHeader(name)` is case-insensitive; underscore handling is container-specific. Many normalize.\n- **Application middleware** (WAFs, log aggregators, security gateways, identity-aware proxies) that normalize header names before applying security policy: both forms collapse to the same authorization decision input.\n\n## Severity\n\nI propose **HIGH CVSS 7.5** for the BasicAuth \/ DigestAuth case and **CRITICAL CVSS 9.1** for the ForwardAuth `authResponseHeaders` case (the latter requires no credentials).\n\n**CVSS 3.1 vector (BasicAuth \/ DigestAuth)**: `AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:N=7.5` \u2014 one step above CVE-2026-33433 (which the maintainer scored MEDIUM 5.1 because it required misconfigured non-canonical `headerField`). HT-1A works against the canonical \/ recommended `headerField` configuration, broader operational scope.\n\n**CVSS 3.1 vector (ForwardAuth `authResponseHeaders`)**: `AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:N=9.1` \u2014 parallel to CVE-2026-39858 (HIGH 7.5) but achieves spoofing without credentials because the `authResponseHeaders` mechanism trusts headers exclusively from the auth server and the underscore variant defeats that trust boundary.\n\nCWEs:\n- CWE-290 (Authentication Bypass by Spoofing)\n- CWE-178 (Improper Handling of Case Sensitivity) \u2014 analogous to CVE-2026-29054\n- CWE-345 (Insufficient Verification of Data Authenticity) \u2014 same as CVE-2026-35051\n\n## Suggested fix\n\nTwo equivalent approaches:\n\n**1. Extend `Header.Del` to handle underscore variants** at the four call sites. Replace:\n\n```go\nreq.Header.Del(b.headerField)\nreq.Header[b.headerField] = []string{user}\n```\n\nwith:\n\n```go\ncanonical := http.CanonicalHeaderKey(b.headerField)\n\/\/ Strip canonical AND underscore-variant of the canonical key.\nfor key := range req.Header {\n    if key == canonical || strings.EqualFold(strings.ReplaceAll(key, \"_\", \"-\"), canonical) {\n        delete(req.Header, key)\n    }\n}\nreq.Header.Set(canonical, user)  \/\/ canonical-key write\n```\n\nThis pairs the headerField primitive with the same `_` \u2194 `-` equivalence that `isManagedXHeader` enforces for X-Forwarded-*.\n\n**2. Generalize the existing `isManagedXHeader` primitive** into a `stripHeaderAndVariants(headers http.Header, name string)` helper in the `forwardedheaders` package and call it from `basic_auth.go`, `digest_auth.go`, `forward.go`, and `snippet.go`. Reusing the existing gold-standard primitive is the cleanest fix and minimizes future drift.\n\nEither approach should also resolve the `\/\/ TODO Deprecated we should add the header with canonical key.` debt at `basic_auth.go:102` and `digest_auth.go:100` by writing to the canonical key (`Header.Set(canonical, user)`) instead of the literal `b.headerField`.\n\n## Why this is a Pattern-8 sibling, not a new CVE class\n\nThe combination of:\n\n1. CVE-2026-33433's fix scope (case-canonicalization for `headerField`)\n2. CVE-2026-39858's fix scope (underscore-variant for `XHeadersSet`)\n3. The defective primitive remaining at HEAD (the `Del` + literal-write pair at four call sites)\n\nestablishes that the maintainer accepts the threat model and has architectural primitives to fix it \u2014 but did not cross the two cohorts. The \"primitive depth-audit\" of the CVE-2026-33433 fix (reading the actual `Header.Del` implementation against the documented threat model and Go's canonicalization semantics) reveals the gap.\n\nI confirmed there is no public PoC mentioning underscore-variant siblings of CVE-2026-33433 (WebSearched 2026-05-23). The fix-flurry from the April 2026 security release batch addressed the X-Forwarded family but not the headerField family.\n\n## Credit\n\nMatteo Panzeri (GitHub `matte1782`). CVE credit requested.\n\n## AI-assistance disclosure\n\nStatic analysis, hypothesis writing, and hostile-review confirmation were assisted by Anthropic Claude (Opus 4.7). Live PoC reproduction, code-citation verification, and submission decision were made by the human author.\n\n\n\n\n---",
            "summary": "## Summary\n\nThere is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth\nmiddlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers\n(e.g. `X-Auth-User`) before writing Traefik's own value, but did not account for\nunderscore-variant header names (e.g. `X_Auth_User`), which many backends normalize\nidentically to the dashed form. An attacker able to reach a protected route could inject\nan underscore-variant header that survives Traefik's stripping and reaches the backend\nalongside \u2014 or, on the unauthenticated ForwardAuth `authResponseHeaders` path, instead of\n\u2014 the value Traefik intended to set, spoofing identity or authorization context. This is\nfixed by setting the new `allowHeadersWithUnderscores: false` entry point option, which\nstrips all headers with underscores in their names before routing.\n\n## Patches\n\n- https:\/\/github.com\/traefik\/traefik\/releases\/tag\/v2.11.51\n- https:\/\/github.com\/traefik\/traefik\/releases\/tag\/v3.6.22\n- https:\/\/github.com\/traefik\/traefik\/releases\/tag\/v3.7.6\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https:\/\/github.com\/traefik\/traefik\/issues).\n\n\nOriginal Description\n\n# Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: `headerField` underscore-variant identity spoofing in BasicAuth \/ DigestAuth \/ ForwardAuth\n\n## Summary\n\nThe fix for CVE-2026-33433 (GHSA-qr99-7898-vr7c, \"BasicAuth\/DigestAuth Identity Spoofing via Non-Canonical headerField\", patched in v2.11.42 \/ v3.6.12 \/ v3.7.0-ea.3) added `req.Header.Del(headerField)` before the literal-key writeback in `pkg\/middlewares\/auth\/basic_auth.go` and `pkg\/middlewares\/auth\/digest_auth.go`. Go's `Header.Del` calls `textproto.CanonicalMIMEHeaderKey` which canonicalizes ASCII CASE and treats `-` as a word separator \u2014 so the fix correctly strips canonical-cased attacker headers (`X-Auth-User`, `x-auth-user`, `X-AUTH-USER`, etc.).\n\nHowever, `textproto.CanonicalMIMEHeaderKey` does **NOT** treat `_` as a separator. Attacker-supplied **underscore-variant** headers such as `X_Auth_User` survive `Header.Del(\"X-Auth-User\")` intact and are forwarded to the backend alongside Traefik's own writeback. Many common backends (CGI\/WSGI per RFC 3875, PHP `$_SERVER`, nginx with `underscores_in_headers on`, Tomcat \/ Java EE servlet containers, ASGI\/WSGI frameworks) normalize `_` \u2194 `-` equivalently or expose both forms to application code that may read the attacker's value.\n\nThis is the **direct cross-cohort sibling** of the threat model the maintainer accepted in **CVE-2026-39858** (GHSA-5m6w-wvh7-57vm, \"Forwarded alias spoofing pre-auth decision bypass\"), which fixed the underscore-variant of the X-Forwarded-* family via `isManagedXHeader` in `pkg\/middlewares\/forwardedheaders\/forwarded_header.go`. The CVE-2026-39858 advisory body states verbatim:\n\n> \"When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust context \u2014 such as a trusted scheme or host \u2014 through the alias headers and bypass authentication on protected routes without valid credentials.\"\n\nThe same threat model applies to the operator-configurable `headerField` (BasicAuth, DigestAuth) and `authResponseHeaders` (ForwardAuth, ingress-nginx snippet provider), but the underscore-handling primitive (`isManagedXHeader`) was not extended to those middlewares. I verified the bypass end-to-end on `traefik:v3.6.14` (the latest patched release containing both fixes) using a default-recommended canonical `headerField: \"X-Auth-User\"` config and reproduced the bypass with a single `curl -H \"X_Auth_User: superadmin\" ...` request alongside valid BasicAuth credentials.\n\nThe defect is present in four code paths at HEAD `eec68dce064f843b4317c4393aaea81b6dea31d6`:\n\n1. `pkg\/middlewares\/auth\/basic_auth.go:101-105` \u2014 BasicAuth `headerField`\n2. `pkg\/middlewares\/auth\/digest_auth.go:99-103` \u2014 DigestAuth `headerField`\n3. `pkg\/middlewares\/auth\/forward.go:304-310` \u2014 ForwardAuth `authResponseHeaders` per-name writeback\n4. `pkg\/middlewares\/ingressnginx\/snippet\/snippet.go:480-486` \u2014 Ingress-NGINX snippet `authResponseHeaders` per-name writeback\n\nThe ForwardAuth instance (#3) is particularly notable: the attacker does NOT need credentials. The `authResponseHeaders` mechanism is intended to copy identity headers from the trusted auth server only; the underscore-variant bypass lets an unauthenticated attacker pre-inject the same identity header before any auth happens.\n\nThe fast proxy at `pkg\/proxy\/fast\/proxy.go:139` explicitly calls `DisableNormalizing()` on the outgoing fasthttp request, guaranteeing that the underscore-variant header reaches the backend wire verbatim. The standard `httputil.ReverseProxy` path at `pkg\/proxy\/httputil\/proxy.go:55` likewise copies `req.Header` keys as-is during the wire write.\n\n## Affected versions\n\n- `traefik` v3.6.x \u2264 3.6.14, v3.7.x \u2264 3.7.0-rc.2, v2.11.x \u2264 2.11.43, and all earlier versions sharing the same auth middleware architecture.\n\nThe defect is present at HEAD post-CVE-2026-33433 fix (the fix added the `Del` line but the literal-key write defect-class survives for underscore variants).\n\n## Root cause\n\nIn `pkg\/middlewares\/auth\/basic_auth.go` at HEAD `eec68dc`:\n\n```go\nif b.headerField != \"\" {\n    \/\/ TODO Deprecated we should add the header with canonical key.\n    req.Header.Del(b.headerField)\n    req.Header[b.headerField] = []string{user}\n}\n```\n\nThe TODO comment shows the maintainer is aware of the literal-key write problem in general (canonical-key write would solve the case-canonicalization issue more cleanly than the current `Del` + literal-write pair). The comment does not acknowledge the underscore-variant survival corollary.\n\n`pkg\/middlewares\/auth\/digest_auth.go:99-103` and the two ForwardAuth paths follow the same `Del` + literal-write pattern. Each is independently exploitable; the underlying primitive defect is shared.\n\nThe maintainer's gold-standard primitive for handling this exact threat class is `pkg\/middlewares\/forwardedheaders\/forwarded_header.go:53-66`:\n\n```go\nfunc isManagedXHeader(key string) bool {\n    if len(key) == 0 || key[0] != 'X' { return false }\n    if _, ok := XHeadersSet[key]; ok { return true }\n    if strings.IndexByte(key, '_') < 0 { return false }\n    canonical := http.CanonicalHeaderKey(strings.ReplaceAll(key, \"_\", \"-\"))\n    _, ok := XHeadersSet[canonical]\n    return ok\n}\n```\n\nThis treats `_` \u2194 `-` equivalence as a security requirement. It is reachable only via the static `XHeadersSet` membership check, which contains exclusively the X-Forwarded-* family + X-Real-Ip. Operator-configurable identity headers are out of scope of this primitive.\n\n## Proof of concept\n\nVerified on `traefik:v3.6.14` (the patched version, post-CVE-2026-33433 and post-CVE-2026-39858) using Docker compose. Full reproducer at https:\/\/github.com\/\/traefik-ht1a-poc; commands below are verbatim.\n\n### Setup\n\n```yaml\n# docker-compose.yml\nservices:\n  traefik:\n    image: traefik:v3.6.14\n    command:\n      - --providers.file.filename=\/etc\/traefik\/dynamic.yml\n      - --entrypoints.web.address=:80\n    ports:\n      - \"8080:80\"\n    volumes:\n      - .\/traefik\/dynamic.yml:\/etc\/traefik\/dynamic.yml:ro\n  echo:\n    image: mendhak\/http-https-echo:36\n    environment:\n      - HTTP_PORT=8888\n```\n\n```yaml\n# traefik\/dynamic.yml \u2014 canonical headerField, recommended operator config\nhttp:\n  routers:\n    protected:\n      rule: \"PathPrefix(`\/`)\"\n      service: echo\n      middlewares: [basic-auth]\n  services:\n    echo:\n      loadBalancer:\n        servers: [{url: \"http:\/\/echo:8888\"}]\n  middlewares:\n    basic-auth:\n      basicAuth:\n        users:\n          - 'alice:$2b$05$FhDfYidZdDPuQjovYqcTAe22wHpQ\/cILC7Tr2yAD6vLlvZh\/Q45PC'   # alice:secret123\n        headerField: \"X-Auth-User\"\n```\n\n`docker compose up -d`.\n\n### Test 1 (control \u2014 CVE-2026-33433 fix works for canonical case)\n\n```bash\n$ curl -s -u alice:secret123 -H \"X-Auth-User: superadmin\" http:\/\/localhost:8080\/\n{\n  ...\n  \"x-auth-user\": \"alice\",\n  ...\n}\n```\n\nThe attacker's canonical `X-Auth-User: superadmin` was correctly stripped by Traefik's `Del`; the backend receives only Traefik's authenticated-user writeback `alice`.\n\n### Test 2 (HT-1A bypass \u2014 underscore variant survives)\n\n```bash\n$ curl -s -u alice:secret123 -H \"X_Auth_User: superadmin\" http:\/\/localhost:8080\/\n{\n  ...\n  \"x-auth-user\": \"alice\",\n  \"x_auth_user\": \"superadmin\",\n  ...\n}\n```\n\nThe underscore-variant `x_auth_user: superadmin` reached the backend intact, despite the `Del(\"X-Auth-User\")` having executed. The backend sees both forms.\n\n### Test 3 (double-send \u2014 same result)\n\n```bash\n$ curl -s -u alice:secret123 \\\n    -H \"X-Auth-User: superadmin\" \\\n    -H \"X_Auth_User: superadmin\" \\\n    http:\/\/localhost:8080\/\n{\n  ...\n  \"x-auth-user\": \"alice\",       # Traefik's writeback\n  \"x_auth_user\": \"superadmin\",  # attacker's underscore \u2014 survived Del\n  ...\n}\n```\n\nThe canonical attacker header is stripped (Test 1 behavior). The underscore variant is forwarded.\n\n### Backend impact\n\nThe PoC's echo backend (`mendhak\/http-https-echo`, Node.js) preserves both forms with the lowercase normalization Node.js applies. Application code reading `req.headers[\"x-auth-user\"]` sees `alice`. Application code reading `req.headers[\"x_auth_user\"]` sees `superadmin`.\n\nFor backends that normalize `_` \u2194 `-` equivalently \u2014 meaning the attacker's value wins:\n\n- **CGI \/ WSGI \/ PHP `$_SERVER`** (RFC 3875 \u00a74.1.18 \u2014 header name uppercased with `-` replaced by `_`): both `X-Auth-User` and `X_Auth_User` map to `HTTP_X_AUTH_USER`. The last-set wins per the WSGI server's iteration order; many servers (gunicorn, uwsgi without `--disable-logging`, waitress) preserve both. Note: Apache + mod_php with default `HttpProtocolOptions Strict` filters underscore-headers from `$_SERVER` (this PoC's PHP backend test demonstrated the filter); Apache + mod_python, Apache + mod_wsgi without the strict mode, nginx + uwsgi, nginx + gunicorn, nginx + FastCGI, and standalone WSGI servers do NOT filter.\n- **nginx with `underscores_in_headers on`** (https:\/\/nginx.org\/en\/docs\/http\/ngx_http_core_module.html#underscores_in_headers): preserves underscore-variant headers and forwards them to upstream as separate values. Upstream application logic that does case-insensitive + underscore-insensitive matching (common pattern in security-sensitive code) merges them.\n- **Tomcat \/ Java EE servlet containers**: `HttpServletRequest.getHeader(name)` is case-insensitive; underscore handling is container-specific. Many normalize.\n- **Application middleware** (WAFs, log aggregators, security gateways, identity-aware proxies) that normalize header names before applying security policy: both forms collapse to the same authorization decision input.\n\n## Severity\n\nI propose **HIGH CVSS 7.5** for the BasicAuth \/ DigestAuth case and **CRITICAL CVSS 9.1** for the ForwardAuth `authResponseHeaders` case (the latter requires no credentials).\n\n**CVSS 3.1 vector (BasicAuth \/ DigestAuth)**: `AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:N=7.5` \u2014 one step above CVE-2026-33433 (which the maintainer scored MEDIUM 5.1 because it required misconfigured non-canonical `headerField`). HT-1A works against the canonical \/ recommended `headerField` configuration, broader operational scope.\n\n**CVSS 3.1 vector (ForwardAuth `authResponseHeaders`)**: `AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:N=9.1` \u2014 parallel to CVE-2026-39858 (HIGH 7.5) but achieves spoofing without credentials because the `authResponseHeaders` mechanism trusts headers exclusively from the auth server and the underscore variant defeats that trust boundary.\n\nCWEs:\n- CWE-290 (Authentication Bypass by Spoofing)\n- CWE-178 (Improper Handling of Case Sensitivity) \u2014 analogous to CVE-2026-29054\n- CWE-345 (Insufficient Verification of Data Authenticity) \u2014 same as CVE-2026-35051\n\n## Suggested fix\n\nTwo equivalent approaches:\n\n**1. Extend `Header.Del` to handle underscore variants** at the four call sites. Replace:\n\n```go\nreq.Header.Del(b.headerField)\nreq.Header[b.headerField] = []string{user}\n```\n\nwith:\n\n```go\ncanonical := http.CanonicalHeaderKey(b.headerField)\n\/\/ Strip canonical AND underscore-variant of the canonical key.\nfor key := range req.Header {\n    if key == canonical || strings.EqualFold(strings.ReplaceAll(key, \"_\", \"-\"), canonical) {\n        delete(req.Header, key)\n    }\n}\nreq.Header.Set(canonical, user)  \/\/ canonical-key write\n```\n\nThis pairs the headerField primitive with the same `_` \u2194 `-` equivalence that `isManagedXHeader` enforces for X-Forwarded-*.\n\n**2. Generalize the existing `isManagedXHeader` primitive** into a `stripHeaderAndVariants(headers http.Header, name string)` helper in the `forwardedheaders` package and call it from `basic_auth.go`, `digest_auth.go`, `forward.go`, and `snippet.go`. Reusing the existing gold-standard primitive is the cleanest fix and minimizes future drift.\n\nEither approach should also resolve the `\/\/ TODO Deprecated we should add the header with canonical key.` debt at `basic_auth.go:102` and `digest_auth.go:100` by writing to the canonical key (`Header.Set(canonical, user)`) instead of the literal `b.headerField`.\n\n## Why this is a Pattern-8 sibling, not a new CVE class\n\nThe combination of:\n\n1. CVE-2026-33433's fix scope (case-canonicalization for `headerField`)\n2. CVE-2026-39858's fix scope (underscore-variant for `XHeadersSet`)\n3. The defective primitive remaining at HEAD (the `Del` + literal-write pair at four call sites)\n\nestablishes that the maintainer accepts the threat model and has architectural primitives to fix it \u2014 but did not cross the two cohorts. The \"primitive depth-audit\" of the CVE-2026-33433 fix (reading the actual `Header.Del` implementation against the documented threat model and Go's canonicalization semantics) reveals the gap.\n\nI confirmed there is no public PoC mentioning underscore-variant siblings of CVE-2026-33433 (WebSearched 2026-05-23). The fix-flurry from the April 2026 security release batch addressed the X-Forwarded family but not the headerField family.\n\n## Credit\n\nMatteo Panzeri (GitHub `matte1782`). CVE credit requested.\n\n## AI-assistance disclosure\n\nStatic analysis, hypothesis writing, and hostile-review confirmation were assisted by Anthropic Claude (Opus 4.7). Live PoC reproduction, code-citation verification, and submission decision were made by the human author.\n\n\n\n\n---",
            "date_published": "2026-08-07T01:00:02+00:00",
            "date_modified": "2026-08-07T01:00:02+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd83b-8b21-73a4-a517-a6437e83d486",
            "title": "CVE-2026-43622: llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1bat",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43622",
            "content_html": "llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management mismatch to cause denial of service through process crashes or potentially achieve arbitrary code execution depending on allocator state.",
            "summary": "llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management mismatch to cause denial of service through process crashes or potentially achieve arbitrary code execution depending on allocator state.",
            "date_published": "2026-08-07T12:00:06+00:00",
            "date_modified": "2026-08-07T12:00:06+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd83b-6ee8-735c-8b0f-92546c6916ad",
            "title": "Meta AI model hacked a company during misconfigured cyber test",
            "url": "https://www.bleepingcomputer.com/news/security/meta-ai-model-hacked-a-company-during-misconfigured-cyber-test/",
            "content_html": "Meta has become the latest AI company to confirm that one of its models hacked a real organization during cybersecurity testing, as similar incidents continue to emerge following OpenAI'sOpenAI's initial disclosure that its agents breached Hugging Face. [...]",
            "summary": "Meta has become the latest AI company to confirm that one of its models hacked a real organization during cybersecurity testing, as similar incidents continue to emerge following OpenAI'sOpenAI's initial disclosure that its agents breached Hugging Face. [...]",
            "date_published": "2026-08-08T04:00:13+00:00",
            "date_modified": "2026-08-08T04:00:13+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd83b-8b1b-70af-b086-13e50ea45814",
            "title": "CVE-2026-19039: A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted ",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19039",
            "content_html": "A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function ssh_exec of the file src\/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host\/username results in command injection. The attack requires a local approach. The actual existence of this vulnerability is currently in question. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project maintainer explains: \"The intended threat model is that this MCP server is a local\/trusted tool for an agent to execute commands over SSH, so callers already have meaningful execution capability through the exposed shell.\"",
            "summary": "A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function ssh_exec of the file src\/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host\/username results in command injection. The attack requires a local approach. The actual existence of this vulnerability is currently in question. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project maintainer explains: \"The intended threat model is that this MCP server is a local\/trusted tool for an agent to execute commands over SSH, so callers already have meaningful execution capability through the exposed shell.\"",
            "date_published": "2026-08-07T12:00:06+00:00",
            "date_modified": "2026-08-07T12:00:06+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd75f-b4e5-705b-aff3-04c497e0d9c2",
            "title": "Zero-Click AI Browser Hacking: Claude and ChatGPT Atlas Hijacked via Emails, X Posts",
            "url": "https://www.securityweek.com/zero-click-ai-browser-hacking-claude-and-chatgpt-atlas-hijacked-via-emails-x-posts/",
            "content_html": "Zenity researchers reported the findings to Anthropic and OpenAI in late 2025 and early 2026, but they remain unpatched.\nThe post Zero-Click AI Browser Hacking: Claude and ChatGPT Atlas Hijacked via Emails, X Posts appeared first on SecurityWeek.",
            "summary": "Zenity researchers reported the findings to Anthropic and OpenAI in late 2025 and early 2026, but they remain unpatched.\nThe post Zero-Click AI Browser Hacking: Claude and ChatGPT Atlas Hijacked via Emails, X Posts appeared first on SecurityWeek.",
            "date_published": "2026-08-08T04:00:13+00:00",
            "date_modified": "2026-08-08T04:00:13+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd75f-b32a-73b6-895d-ed5e9611ed1c",
            "title": "AI Recommendation Poisoning: How \"Ask AI\" Buttons Silently Alter LLM Memory",
            "url": "https://thehackernews.com/2026/08/ai-recommendation-poisoning-how-ask-ai.html",
            "content_html": "A new class of prompt injection is spreading across commercial websites. It requires no malware, no stolen credentials, and no zero-day exploit. It abuses a standard feature built into almost every major AI assistant: pre-filled deep links.\n\nWe observed production websites embedding hidden prompt injection payloads inside \"Ask AI\" buttons on marketing and competitor comparison pages. When a user",
            "summary": "A new class of prompt injection is spreading across commercial websites. It requires no malware, no stolen credentials, and no zero-day exploit. It abuses a standard feature built into almost every major AI assistant: pre-filled deep links.\n\nWe observed production websites embedding hidden prompt injection payloads inside \"Ask AI\" buttons on marketing and competitor comparison pages. When a user",
            "date_published": "2026-08-08T04:00:13+00:00",
            "date_modified": "2026-08-08T04:00:13+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd6f2-1bd1-711d-b659-0da6cc3b8aa9",
            "title": "CVE-2026-57819: Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the \"maxFormParameterCount\" co",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57819",
            "content_html": "Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the \"maxFormParameterCount\" configuration option. However, no default limit is set which may lead to denial of service attacks when processing\u00a0 requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.",
            "summary": "Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the \"maxFormParameterCount\" configuration option. However, no default limit is set which may lead to denial of service attacks when processing\u00a0 requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.",
            "date_published": "2026-08-07T06:00:19+00:00",
            "date_modified": "2026-08-07T06:00:19+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd683-f973-7099-9e38-a2f3e7252750",
            "title": "Meta AI Hacked External Systems During Cybersecurity Testing",
            "url": "https://www.securityweek.com/meta-ai-hacked-external-systems-during-cybersecurity-testing/",
            "content_html": "The incident involved a testing environment set up by Irregular, similar to what Anthropic reported last week.\nThe post Meta AI Hacked External Systems During Cybersecurity Testing appeared first on SecurityWeek.",
            "summary": "The incident involved a testing environment set up by Irregular, similar to what Anthropic reported last week.\nThe post Meta AI Hacked External Systems During Cybersecurity Testing appeared first on SecurityWeek.",
            "date_published": "2026-08-07T10:00:01+00:00",
            "date_modified": "2026-08-07T10:00:01+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd6f2-1bca-70db-9c3b-be5a64d63025",
            "title": "CVE-2026-64583: In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: bdc: free IRQ and drain func_wake",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64583",
            "content_html": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown\n\nThe Broadcom BDC UDC driver registers its IRQ handler with\ndevm_request_irq() in bdc_udc_init(), so the IRQ is released by devm\nonly after bdc_remove() returns.  devm releases resources in reverse\nLIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() ->\nbdc_mem_free() manually before returning: bdc_udc_exit() tears down\nindividual endpoint objects via bdc_free_ep(), while bdc_hw_exit() ->\nbdc_mem_free() frees and NULLs the DMA-coherent status-report ring\n(bdc->srr.sr_bds) and kfree()s bdc->bdc_ep_array.  Both happen while\nthe IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED)\nremains deliverable in the window up to the post-remove devm\nfree_irq().\n\nOn receipt of a shared interrupt in that window, bdc_udc_interrupt()\ndereferences bdc->srr.sr_bds[bdc->srr.dqp_index] (NULL or freed DMA)\nand dispatches sr_handler callbacks that index into bdc_ep_array,\ncausing a NULL-deref or use-after-free.\n\nThe same window affects the delayed_work bdc->func_wake_notify, which is\narmed from the IRQ handler via bdc_sr_uspc() -> handle_link_state_change()\n-> schedule_delayed_work() and may self-rearm from its own callback\nbdc_func_wake_timer().  No cancel exists anywhere in the driver, so a\nqueued work item that fires after bdc_remove() returns and the bdc\nstructure is devm-freed dereferences freed memory.\n\nReplace devm_request_irq() with request_irq() and add an explicit\nfree_irq(bdc->irq, bdc) in bdc_remove().  Clear BDC_GIE before\nfree_irq() to stop the device from asserting interrupts, then\nfree_irq() drains any in-flight handler, then cancel_delayed_work_sync()\ndrains the func_wake_notify delayed work.  This ordering ensures the\nIRQ handler and delayed work cannot interfere with the subsequent\nendpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit().  Wire the\nmatching free_irq() into the bdc_udc_init() error path so the IRQ is\nreleased on probe failure, and route the bdc_init_ep() failure through\nerr0 instead of returning directly.\n\nThis issue was found by an in-house static analysis tool.",
            "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown\n\nThe Broadcom BDC UDC driver registers its IRQ handler with\ndevm_request_irq() in bdc_udc_init(), so the IRQ is released by devm\nonly after bdc_remove() returns.  devm releases resources in reverse\nLIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() ->\nbdc_mem_free() manually before returning: bdc_udc_exit() tears down\nindividual endpoint objects via bdc_free_ep(), while bdc_hw_exit() ->\nbdc_mem_free() frees and NULLs the DMA-coherent status-report ring\n(bdc->srr.sr_bds) and kfree()s bdc->bdc_ep_array.  Both happen while\nthe IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED)\nremains deliverable in the window up to the post-remove devm\nfree_irq().\n\nOn receipt of a shared interrupt in that window, bdc_udc_interrupt()\ndereferences bdc->srr.sr_bds[bdc->srr.dqp_index] (NULL or freed DMA)\nand dispatches sr_handler callbacks that index into bdc_ep_array,\ncausing a NULL-deref or use-after-free.\n\nThe same window affects the delayed_work bdc->func_wake_notify, which is\narmed from the IRQ handler via bdc_sr_uspc() -> handle_link_state_change()\n-> schedule_delayed_work() and may self-rearm from its own callback\nbdc_func_wake_timer().  No cancel exists anywhere in the driver, so a\nqueued work item that fires after bdc_remove() returns and the bdc\nstructure is devm-freed dereferences freed memory.\n\nReplace devm_request_irq() with request_irq() and add an explicit\nfree_irq(bdc->irq, bdc) in bdc_remove().  Clear BDC_GIE before\nfree_irq() to stop the device from asserting interrupts, then\nfree_irq() drains any in-flight handler, then cancel_delayed_work_sync()\ndrains the func_wake_notify delayed work.  This ordering ensures the\nIRQ handler and delayed work cannot interfere with the subsequent\nendpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit().  Wire the\nmatching free_irq() into the bdc_udc_init() error path so the IRQ is\nreleased on probe failure, and route the bdc_init_ep() failure through\nerr0 instead of returning directly.\n\nThis issue was found by an in-house static analysis tool.",
            "date_published": "2026-08-07T06:00:19+00:00",
            "date_modified": "2026-08-07T06:00:19+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd6f2-1bc3-715a-b70c-9fc1c8c3852b",
            "title": "CVE-2026-19019: A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager._setup_",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19019",
            "content_html": "A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager._setup_session_persistence of the file executor\/app\/core\/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks.",
            "summary": "A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager._setup_session_persistence of the file executor\/app\/core\/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks.",
            "date_published": "2026-08-07T06:00:19+00:00",
            "date_modified": "2026-08-07T06:00:19+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd6f2-1bbe-7293-9d5f-6f9b69b39e91",
            "title": "CVE-2026-19005: A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file s",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19005",
            "content_html": "A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src\/modules\/agent-to-agent\/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
            "summary": "A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src\/modules\/agent-to-agent\/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
            "date_published": "2026-08-07T06:00:19+00:00",
            "date_modified": "2026-08-07T06:00:19+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd5a8-c5c8-7286-8ba3-1af7d0162980",
            "title": "CVE-2026-67531: FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:ex",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67531",
            "content_html": "FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute\u00a0tool exposes live host Zod\u00a0schema instances to the script via\u00a0getTool(), and because Zod v4 defines\u00a0_zod as a non-configurable, non-writable own property, the ECMAScript Proxy invariants force the security membrane to hand back the raw host object, letting a script reach\u00a0_zod.constr.constructor\u00a0(the host Function\u00a0constructor) and execute arbitrary code in the server process. A single tools\/call is sufficient to escape the sandbox and achieve remote code execution as the server user, exposing everything the process holds such as OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. Because the framework's\u00a0DEFAULT_AUTH_OPTIONS\u00a0is public mode, an unconfigured server serves this to unauthenticated callers, and on authenticated servers an indirect prompt injection in tool output or fetched content can trigger it without a human attackerThis issue is fixed in version 1.5.7.",
            "summary": "FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute\u00a0tool exposes live host Zod\u00a0schema instances to the script via\u00a0getTool(), and because Zod v4 defines\u00a0_zod as a non-configurable, non-writable own property, the ECMAScript Proxy invariants force the security membrane to hand back the raw host object, letting a script reach\u00a0_zod.constr.constructor\u00a0(the host Function\u00a0constructor) and execute arbitrary code in the server process. A single tools\/call is sufficient to escape the sandbox and achieve remote code execution as the server user, exposing everything the process holds such as OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. Because the framework's\u00a0DEFAULT_AUTH_OPTIONS\u00a0is public mode, an unconfigured server serves this to unauthenticated callers, and on authenticated servers an indirect prompt injection in tool output or fetched content can trigger it without a human attackerThis issue is fixed in version 1.5.7.",
            "date_published": "2026-08-07T00:00:10+00:00",
            "date_modified": "2026-08-07T00:00:10+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd7cd-c537-73e6-a023-c8e47c9cf455",
            "title": "Baseten on Hugging Face Inference Providers \ud83d\udd25",
            "url": "https://huggingface.co/blog/baseten",
            "content_html": "",
            "summary": "",
            "date_published": "2026-08-08T04:00:13+00:00",
            "date_modified": "2026-08-08T04:00:13+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad78-727a-9d31-443dfecdc1f6",
            "title": "CVE-2026-69111: Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69111",
            "content_html": "Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected \/management\/stop endpoint, which bypasses REST API authentication middleware, by supplying a 'role' parameter to shut down the proxy, datanode, or querynode components, resulting in denial of service.",
            "summary": "Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected \/management\/stop endpoint, which bypasses REST API authentication middleware, by supplying a 'role' parameter to shut down the proxy, datanode, or querynode components, resulting in denial of service.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad75-72c4-bb68-b3e532795252",
            "title": "CVE-2026-66298: Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger se",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66298",
            "content_html": "Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart.\n\nLivebook's JS-view feature renders notebook-defined JavaScript inside a sandboxed, cross-origin iframe specifically because that JavaScript is untrusted. The trusted iframe shell in iframe\/priv\/static\/iframe\/v5.html forwards every keydown event fired in its own window to the parent page without consulting Event.isTrusted, so an event synthesized by the untrusted script through window.dispatchEvent is forwarded exactly as a genuine keystroke would be. The parent-side relay in assets\/js\/hooks\/js_view.js reconstructs and re-dispatches it on the live page with no further validation, and because assets\/js\/hooks\/session.js registers the global shortcut handler on the document in the capture phase, that handler acts on the replicated event regardless of how it was produced.\n\nSandboxed output JavaScript can therefore drive Livebook's session-wide keyboard shortcuts. Two of them reach LivebookWeb.SessionLive and execute immediately with no confirmation: the shortcut for queueing full evaluation runs every cell in the notebook, and the shortcut for reconnecting the runtime disconnects and reconnects it, discarding in-memory state. A third shortcut deletes the focused cell behind a confirmation dialog that the user can permanently dismiss, after which it too executes silently.\n\nForced full evaluation is the significant consequence, because it causes the notebook's own Elixir code to run without the user choosing to evaluate anything. A user who merely opens a notebook obtained from a third party, or reached from published documentation, can have its code executed on their runtime. Livebook also mirrors cell outputs to every connected client, so a malicious output triggers in a collaborator's browser as soon as it renders.\n\nThis issue affects livebook: from 0.5.0 before 0.18.7 and from 0.19.0 before 0.19.9.",
            "summary": "Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart.\n\nLivebook's JS-view feature renders notebook-defined JavaScript inside a sandboxed, cross-origin iframe specifically because that JavaScript is untrusted. The trusted iframe shell in iframe\/priv\/static\/iframe\/v5.html forwards every keydown event fired in its own window to the parent page without consulting Event.isTrusted, so an event synthesized by the untrusted script through window.dispatchEvent is forwarded exactly as a genuine keystroke would be. The parent-side relay in assets\/js\/hooks\/js_view.js reconstructs and re-dispatches it on the live page with no further validation, and because assets\/js\/hooks\/session.js registers the global shortcut handler on the document in the capture phase, that handler acts on the replicated event regardless of how it was produced.\n\nSandboxed output JavaScript can therefore drive Livebook's session-wide keyboard shortcuts. Two of them reach LivebookWeb.SessionLive and execute immediately with no confirmation: the shortcut for queueing full evaluation runs every cell in the notebook, and the shortcut for reconnecting the runtime disconnects and reconnects it, discarding in-memory state. A third shortcut deletes the focused cell behind a confirmation dialog that the user can permanently dismiss, after which it too executes silently.\n\nForced full evaluation is the significant consequence, because it causes the notebook's own Elixir code to run without the user choosing to evaluate anything. A user who merely opens a notebook obtained from a third party, or reached from published documentation, can have its code executed on their runtime. Livebook also mirrors cell outputs to every connected client, so a malicious output triggers in a collaborator's browser as soon as it renders.\n\nThis issue affects livebook: from 0.5.0 before 0.18.7 and from 0.19.0 before 0.19.9.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad72-7057-bf01-72079f4e6a44",
            "title": "CVE-2026-18954: Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might al",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18954",
            "content_html": "Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic.\n\n\n\nTo remediate this issue, users should upgrade to version 1.0.12 or later.",
            "summary": "Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic.\n\n\n\nTo remediate this issue, users should upgrade to version 1.0.12 or later.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad70-71c8-a611-d97bcb8a881f",
            "title": "CVE-2026-9205: IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the\u00a0ensure_fernet_key() function.",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9205",
            "content_html": "IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the\u00a0ensure_fernet_key() function.",
            "summary": "IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the\u00a0ensure_fernet_key() function.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad6e-73ef-ad88-4d9aee984a14",
            "title": "CVE-2026-9201: IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptogra",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9201",
            "content_html": "IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component validation mechanism. When the optional hardening mode that restricts execution to trusted component templates is enabled, the application validates component code using a truncated SHA\u2011256 hash. Because the hash comparison relies on only a portion of the digest, an attacker can craft malicious component code that collides with a trusted template hash and bypasses validation. Successful exploitation allows the attacker to introduce and execute unauthorized Python code within the Langflow process, defeating the intended security control and potentially leading to full compromise of the affected instance.",
            "summary": "IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component validation mechanism. When the optional hardening mode that restricts execution to trusted component templates is enabled, the application validates component code using a truncated SHA\u2011256 hash. Because the hash comparison relies on only a portion of the digest, an attacker can craft malicious component code that collides with a trusted template hash and bypasses validation. Successful exploitation allows the attacker to introduce and execute unauthorized Python code within the Langflow process, defeating the intended security control and potentially leading to full compromise of the affected instance.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad6b-7358-91da-9d76e28a957b",
            "title": "CVE-2026-9196: IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic As",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9196",
            "content_html": "IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM\u2011generated components. The application executes model\u2011generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.",
            "summary": "IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM\u2011generated components. The application executes model\u2011generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad69-7080-968b-20e38e98e19a",
            "title": "CVE-2026-9130: IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows a",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9130",
            "content_html": "IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The MemoryComponent.retrieve_messages and store_message methods filter on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple authenticated API endpoints including \/api\/v1\/run\/*, \/api\/v1\/responses, and \/api\/v2\/workflow\/*. This vulnerability only affects multi-user deployments with LANGFLOW_AUTO_LOGIN=False.",
            "summary": "IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The MemoryComponent.retrieve_messages and store_message methods filter on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple authenticated API endpoints including \/api\/v1\/run\/*, \/api\/v1\/responses, and \/api\/v2\/workflow\/*. This vulnerability only affects multi-user deployments with LANGFLOW_AUTO_LOGIN=False.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad67-7079-8b83-56e573cef04a",
            "title": "CVE-2026-8478: IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the i",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8478",
            "content_html": "IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.",
            "summary": "IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad64-735e-8b21-30a983016c1a",
            "title": "CVE-2026-8470: IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8470",
            "content_html": "IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.",
            "summary": "IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad62-707a-808a-bd6a49cf22c9",
            "title": "CVE-2026-8183: IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8183",
            "content_html": "IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot \" sequences ( \/.. \/) to v i ew arbitrary files on the system.",
            "summary": "IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot \" sequences ( \/.. \/) to v i ew arbitrary files on the system.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad60-7385-881c-d7bd5dfc9781",
            "title": "CVE-2026-8182: IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8182",
            "content_html": "IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP requests.",
            "summary": "IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP requests.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad5d-7253-b642-cb913fc77b62",
            "title": "CVE-2026-7869: IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API (`POST \/api\/v1\/knowledg",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7869",
            "content_html": "IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API (`POST \/api\/v1\/knowledge_bases`). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem.",
            "summary": "IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API (`POST \/api\/v1\/knowledge_bases`). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad5b-70fe-95a8-3712980f17a6",
            "title": "CVE-2026-7658: IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path t",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7658",
            "content_html": "IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing key deletion leading to session invalidation.",
            "summary": "IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing key deletion leading to session invalidation.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad58-735b-acc3-2250f4d1a6f2",
            "title": "CVE-2026-48168: PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vuln",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48168",
            "content_html": "PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comment to trigger the job regardless of whether the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork whose branch name contains shell metacharacters and comment @claude, causing Bash to execute arbitrary shell code in the GitHub Actions runner. Because these commands run in a job holding a GitHub App token with write permissions, OIDC access, and gh\/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse. This issue has been fixed in version 4.6.40.",
            "summary": "PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comment to trigger the job regardless of whether the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork whose branch name contains shell metacharacters and comment @claude, causing Bash to execute arbitrary shell code in the GitHub Actions runner. Because these commands run in a job holding a GitHub App token with write permissions, OIDC access, and gh\/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse. This issue has been fixed in version 4.6.40.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad56-7132-b928-f9f9dab3e543",
            "title": "CVE-2026-17633: IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code ",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17633",
            "content_html": "IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection.",
            "summary": "IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad54-71d6-a78f-0eac5a66d697",
            "title": "CVE-2026-17632: IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to impro",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17632",
            "content_html": "IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning.",
            "summary": "IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad51-7090-9747-6ff28ce7da70",
            "title": "CVE-2026-17624: IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17624",
            "content_html": "IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of module imports.",
            "summary": "IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of module imports.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        },
        {
            "id": "https://vulnwatch.ai/019fd45e-ad4f-70a2-abe6-ed7f3485b731",
            "title": "CVE-2026-10547: IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST \/api\/v1\/build\/{flow_id",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10547",
            "content_html": "IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST \/api\/v1\/build\/{flow_id}\/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized workflow execution, or denial of service.",
            "summary": "IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST \/api\/v1\/build\/{flow_id}\/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized workflow execution, or denial of service.",
            "date_published": "2026-08-06T18:00:08+00:00",
            "date_modified": "2026-08-06T18:00:08+00:00",
            "authors": [{ "name": "VulnWatch" }],
            "tags": [  ]
        }        
    ]
}