Threat Library

The mcp-florence2 MCP server contains a server-side request forgery vulnerability in its get_images function, allowing a remote attacker to supply a malicious 'src' argument that causes the server to make unauthorized HTTP requests. This could be used to probe internal networks, access cloud metadata endpoints, or interact with internal services reachable by the MCP server. A public exploit exists, increasing the urgency of remediation.

Threema, a secure messaging service, suffered multiple large-scale DDoS attacks that caused severe disruptions to user communications. The attacks appear focused on service availability rather than data compromise, with no evidence of encryption bypass or user data exposure reported.

Cryptocurrency hardware wallet vendor SafePal disclosed a data breach affecting approximately 39,798 customers after an application flaw was exploited to exfiltrate customer order information. A threat actor is now advertising the stolen data for sale on underground forums, raising risk of targeted phishing and social engineering against affected customers.

This report highlights that attacks against Google Workspace increasingly bypass traditional phishing defenses by exploiting stolen OAuth tokens to gain access to Gmail, Drive, and connected third-party applications. Material Security emphasizes that organizations must defend the entire Workspace attack chain, not just the initial login, since attackers can pivot through connected integrations and persistent tokens. This represents a shift toward identity- and token-centric attack paths rather than credential phishing alone.

Evooo1Bot is a newly identified Mirai-based modular Linux botnet targeting internet-facing gateway devices and routers. Once compromised, infected devices are converted into SOCKS5 traffic relay nodes, likely to support proxy-for-hire services or to anonymize other malicious traffic.

Siemens LOGO! Soft Comfort versions prior to V9 contain two vulnerabilities affecting project-file encryption and password protection: a hardcoded AES master key and unsalted SHA-256 password hashes. A local attacker could exploit these flaws to decrypt project files, bypass or remove passwords, and perform efficient offline brute-force attacks, potentially gaining unauthorized access to sensitive PLC project logic and configurations.

Law enforcement in Brazil and Europe arrested seven individuals connected to a fraud scheme that exploited a vulnerability at a third-party service provider to withdraw approximately €30 million from Commerzbank customer accounts. The case highlights the ongoing risk that vulnerabilities in banking service providers and payment intermediaries pose to end customers.

Johnson Controls Airwall versions 4.0.4 and earlier contain two vulnerabilities: a hard-coded cryptographic key used identically across all deployments, and an arbitrary file read flaw via path traversal. Combined, these could allow an attacker with local access or code/binary access to decrypt sensitive configuration data or read arbitrary files including credential stores and private keys. No public exploitation has been reported, and both flaws require local access or high attack complexity, limiting immediate risk.

The CKAN MCP Server had a flaw where request parameters were serialized into cache keys using unescaped delimiter characters (&, =, |), allowing different logical queries to produce identical cache keys. An attacker could exploit this collision to poison the shared cache with attacker-controlled data that gets served back to a victim making a distinct, legitimate query.

The CKAN MCP Server's data quality tools validate the server_url parameter using a prefix-only regular expression intended to restrict requests to dati.gov.it, but the check can be bypassed with suffix-host or userinfo tricks in the URL. This allows an attacker to redirect the MCP tool's outbound request to an attacker-controlled host and return spoofed data to the agent as if it came from the trusted source.

Trigger.dev's run replay API looks up task runs by a friendly ID without checking that the run belongs to the caller's environment/tenant, allowing any valid API key holder to replay another tenant's agent task run. This lets an attacker consume victim compute resources and repeat side effects of that run, and in combination with a separate object-store path-traversal bug, potentially inject attacker-controlled payload bytes into the victim's replayed task. The issue is fixed in 4.5.0-rc.4.

Picus Labs' Blue Report 2026 analyzed over 338 million attack simulations across production environments in H1 2026, finding that while perimeter/edge defenses have improved significantly, internal detection and containment capabilities have deteriorated. Attackers are increasingly succeeding not through loud, high-signature attacks but through low-noise techniques that evade internal detection once initial defenses are bypassed.

A denial-of-service vulnerability (CVE-2026-59693) affects Siemens Desigo DXR and PXC building automation controllers. An attacker with adjacent network access can send a malformed BACnet packet to cause the device to stop responding, requiring a manual reset or reboot to restore functionality. Siemens has released firmware updates to remediate the issue.

An MCP server (mcp-dominican-layer) exposes a PDF-parsing tool that accepts a remote URL without adequate validation, allowing an attacker to force the server to make arbitrary outbound requests (SSRF). This could be used to probe internal networks, hit cloud metadata endpoints, or interact with internal services reachable from the MCP host. The vendor has not responded to the disclosure and a public exploit exists, increasing near-term risk for any deployment using this component.

An MCP server tool called parse-csv accepts a user-supplied URL (csvUrl) and fetches it with axios.get without validating the destination, allowing an attacker to force the server to make requests to arbitrary internal or external endpoints. This is a classic server-side request forgery (SSRF) vulnerability exposed through an agent tool interface, remotely exploitable, with a public exploit and no vendor response yet. Severity is moderate given CVSS 6.3, but the risk is amplified in agent contexts where the MCP server may have network access to internal services, cloud metadata endpoints, or other agents.

The jshookmcp MCP server enforces an SSRF policy that blocks access to private and internal network addresses for most of its raw network tools, but the ICMP probe and traceroute tools bypass this policy entirely. This lets any MCP client with access to the network domain map internal network topology and probe internal hosts, even when private network access is explicitly disabled by policy.

This CVE describes a terminal escape sequence injection vulnerability in the Oh My Posh shell prompt renderer, not an AI agent-specific prompt injection despite the matched keyword. Attacker-controlled Git metadata (commit messages, author names, repo URLs) and directory names could contain unsanitized control characters that manipulate the terminal, spoof the display, or overwrite the clipboard when a victim's shell prompt renders that data. This is a legitimate but conventional software vulnerability with no direct relevance to AI agent architectures, LLM prompt injection, or inter-agent protocols.

HCL AION is vulnerable to indirect prompt injection where untrusted content processed by the agent can cause malicious HTML/markup to be injected into rendered output shown to users. This is a moderate-severity issue (CVSS 4.3) that could enable UI manipulation or phishing-style deception rather than direct system compromise. The vulnerability stems from insufficient output sanitization rather than a deep architectural flaw.

This is a research paper (not an active exploit) introducing ToolHazard, a framework for synthesizing scalable adversarial environments to test how LLM agents handle indirect prompt injections embedded in tool outputs and environmental states. The work demonstrates that current agents remain broadly vulnerable to such injections and that injection timing/placement matters, but also shows that training on ToolHazard-generated data improves robustness. Severity is medium because it is a defensive/evaluation contribution highlighting a well-known class of risk rather than disclosing a new live exploit.

A coordinated campaign involving 737 free VPN and proxy Chrome extensions, published across at least 40 developer accounts, has been found intercepting browser traffic and routing it through attacker-controlled proxy infrastructure. The campaign primarily targets Russian-speaking users attempting to bypass service blocks, with 274 extensions identified as impersonating 66 legitimate brands, and has amassed over 75,000 installs.