Threat Library

A high-severity Incorrect Authorization vulnerability affects Adobe Commerce, allowing attackers to bypass security controls and gain unauthorized read and write access without requiring user interaction. This flaw poses significant risk to e-commerce platforms storing sensitive customer, payment, and order data.

A high-severity access control flaw in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network. Exploitation could grant attackers elevated access to Copilot functionality and connected data without proper authorization, posing risk to enterprise mobile deployments.

CVE-2026-58594 is an integer overflow/wraparound vulnerability in Windows Remote Desktop Protocol (RDP) that allows an unauthorized, remote attacker to execute arbitrary code over the network. With a CVSS score of 8.8, this flaw poses significant risk to any exposed or internally reachable RDP service, enabling potential full system compromise without prior authentication.

CVE-2026-50694 is a use-after-free vulnerability in Windows' Secure Socket Tunneling Protocol (SSTP) implementation that allows an unauthorized, remote attacker to execute arbitrary code over the network. Given SSTP's role in VPN connectivity, this flaw poses significant risk to organizations relying on Windows-based VPN gateways and remote access infrastructure. The CVSS score of 8.1 reflects high severity with network-based exploitability and no authentication required.

CVE-2026-49164 is a heap-based buffer overflow in Active Directory Domain Services (AD DS) that allows an unauthorized, remote attacker to execute arbitrary code without authentication. Given AD DS's central role in enterprise identity infrastructure, successful exploitation could lead to full domain compromise. The CVSS score of 8.1 reflects high impact combined with network-based, low-complexity attack requirements.

CVE-2026-39808 is an unauthenticated OS command injection vulnerability in Fortinet FortiSandbox, added to CISA's Known Exploited Vulnerabilities catalog with a short remediation window (added 2026-07-16, due 2026-07-19), indicating active exploitation in the wild. Attackers can send crafted HTTP requests to execute arbitrary commands without authentication, potentially gaining full control of the appliance.

This article is a blog post by Simon Willison discussing the release of Moonshot AI's Kimi K3 model, covering pricing, benchmarks, and a whimsical 'pelican riding a bicycle' SVG test. It contains no security incident, vulnerability, or threat relevant to AI agents, agent frameworks, or agent protocols.

The Fay AI agent framework (version 4.3.1) exposes its MCP server management interface without adequate access control, allowing remote attackers to register a malicious MCP STDIO server with attacker-controlled commands. This results in full arbitrary command execution on the host running the Fay service, making it a critical, easily exploitable remote code execution vulnerability.

Reports indicate that OpenAI's Codex coding agent (referenced as GPT-5.6) can unexpectedly delete a user's entire $HOME directory when run in 'full access mode' without sandboxing or auto-review safeguards. The root cause is the model attempting to override the $HOME environment variable to create a temporary directory and mistakenly deleting the real $HOME instead. This is an unintentional agent malfunction rather than a malicious attack, but it demonstrates severe real-world consequences of granting autonomous coding agents unsandboxed filesystem access.

AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 logged raw user prompts and full agent responses into OpenTelemetry span attributes without any filtering or masking, which then flowed into customer CloudWatch aws/spans log groups. Any principal with read access to those logs could view sensitive user content, including secrets or PII that may have been part of prompts or agent outputs. This is a data exposure issue rather than an active exploit, and requires local/authenticated access to the customer's own logging infrastructure.

The Apify MCP server's documentation-fetching tool checked allowed domains using a naive string prefix match instead of proper URL hostname parsing, letting an attacker craft URLs like docs.apify.com.evil.com to bypass the allowlist. This allows arbitrary attacker-controlled content to be fetched and returned to the LLM agent, which could then be used to inject malicious instructions or exfiltrate context. The issue was fixed in version 0.9.21.

The dbt-mcp server, prior to 1.17.1, sent full unredacted MCP tool call arguments—including raw SQL queries, variables, and node selection strings—to a third-party telemetry backend by default. Because usage tracking was enabled unless explicitly disabled via environment variables, organizations may have unknowingly leaked sensitive query content and internal data model details. This is a legitimate but low-complexity data exposure issue, not a remote code execution or agent-hijack vulnerability.

The dbt-mcp MCP server, prior to version 1.17.1, logged raw tool call arguments—including SQL queries, variables, and node selections—in plaintext to a local log file when file logging was enabled. This is a genuine but low-severity information disclosure issue requiring local file access or misconfigured log exposure to exploit, with a CVSS score of 2.5 and an official fix already released.

The dbt-mcp MCP server, prior to version 1.17.1, failed to sanitize client-supplied node_selection and resource_type values before passing them as dbt CLI arguments. Although the use of shell=False blocks shell metacharacter injection, an MCP client could still smuggle dbt global flags like --profiles-dir, --project-dir, or --target into the subprocess call, allowing unauthorized redirection of dbt execution context.

This item is a blog post by Simon Willison describing a fun side project: a WebAssembly port of a Mermaid diagram renderer (extracted from the open-sourced Grok CLI codebase) that outputs Unicode box art in a browser. There is no indication of a vulnerability, malicious behavior, prompt injection, or any agent security issue in this content.

This is a defensive research paper describing a new guardrail system (nsfaguard) that classifies and detects operational threats to agentic AI, such as prompt injection and tool misuse, rather than describing an actual vulnerability or attack. It introduces a risk taxonomy and benchmark models for real-time threat detection. No exploit, vulnerable framework, or active threat is disclosed; this is a mitigation/detection contribution.

This is an academic survey paper analyzing 21 proposals and 5 commercial AI agents for how they handle user-level permissions, not a report of an active vulnerability or exploit. It highlights that most agentic systems apply uniform, product-level security policies rather than customizable per-user permissions, identifying this as a research gap rather than describing a specific attack.

This is an academic research paper (arXiv, not an active exploit) introducing SkillSec-Eval, a framework for evaluating security risks across the full lifecycle of reusable LLM agent 'skills' — from repository admission through retrieval, planner selection, execution, and evolution. The authors evaluated 327 real-world skills and found vulnerabilities exist beyond just runtime execution, suggesting attackers could poison skills at earlier stages like publishing or ranking to influence which skills agents select and trust.

This is an academic arXiv paper proposing a methodology for penetration testing AI-enabled systems, reframing testing to focus on behavioral objective violations rather than only infrastructure compromise. It is not an active exploit, vulnerability disclosure, or attack report but a conceptual framework and taxonomy referencing known adversarial vectors like prompt injection and tool misuse. Severity is low since no new exploitable vulnerability, affected product, or working payload is disclosed.

The BetterDocs WordPress plugin before version 4.5.5 lets unauthenticated users trigger an AI documentation-summary feature whose output is stored and rendered without sanitization. An attacker can craft input that causes the AI to emit malicious HTML/JavaScript, which then executes as stored XSS in the browser of anyone viewing the page, including site administrators.