Threat Library

CVE-2026-8452 is an improper memory buffer restriction vulnerability in Citrix NetScaler ADC and NetScaler Gateway that can result in denial of service. CISA has added this CVE to its Known Exploited Vulnerabilities catalog with a short remediation window, indicating active exploitation in the wild. Organizations using NetScaler appliances as gateways or load balancers should prioritize patching due to the aggressive due date.

CVE-2022-0995 is an out-of-bounds write vulnerability in the Linux Kernel's watch_queue event notification subsystem that allows a local attacker to escalate privileges or crash the system. It is listed in CISA's Known Exploited Vulnerabilities catalog, indicating confirmed active exploitation in the wild. Organizations running affected Linux kernel versions must remediate promptly per CISA's mandated due date.

CVE-2015-5287 is a local privilege escalation vulnerability in Red Hat's Automatic Bug Reporting Tool (ABRT), exploitable via a symlink attack on a predictably named file. The flaw allows local users with certain permissions to escalate privileges on affected Linux systems. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild despite its age.

This is an academic research paper (not an active exploit) describing 'TrustShift', a class of attacks where a malicious MCP tool server behaves benignly during an initial conditioning period to build trust, then switches to adversarial behavior once agents rely on it heavily. The researchers built an attack taxonomy and a benchmark showing ~69.5% attack success rate against frontier agents, plus a runtime defense (SHIELD) that reduces this to ~42.7%.

This is an academic security analysis (not an active exploit) of Google's Agent Payments Protocol v0.2, which is used by LLM-driven shopping agents to authorize payments. The researchers show that while signed Checkout and Payment Mandates protect transaction integrity after signing, the A2A and MCP interactions that shape the transaction beforehand are unprotected, enabling an agent to be manipulated into signing a mandate that does not reflect the user's true intent. The paper identifies 48 catalogued threats across five attack families, with eight rated High severity, and provides proof-of-concept demonstrations plus a deployment-aware scanner.

Researchers at Oasis Security found that a malicious webpage can reach an unauthenticated local Ollama instance running behind NVIDIA NemoClaw and use it to implant hidden instructions into the AI model itself. This effectively lets a remote attacker who only controls a webpage a victim visits achieve persistent, unauthenticated tampering with a locally hosted AI agent's behavior.

AnonyMousKIT is a phishing-as-a-service platform that uses voice AI agents to impersonate Apple support and trick victims into revealing codes needed to unlock stolen iPhones and disable Activation Lock. This is primarily a human-facing social engineering threat that leverages AI voice generation to scale traditional vishing rather than an attack on agent infrastructure or protocols. Severity is high due to real-world financial and privacy harm to victims and the commoditization of AI-driven fraud tooling.

CISA added CVE-2026-60004, a code injection vulnerability in Gitea, to its Known Exploited Vulnerabilities catalog based on confirmed active exploitation. Federal agencies are required under BOD 26-04 to remediate this vulnerability on a prioritized basis, and CISA urges all organizations to do the same given the risk of total asset compromise.

Rently Smart Home versions 20.1.0 and earlier contain a vulnerability that insufficiently protects credentials, allowing an attacker to retrieve PINs, including the Master PIN, and override standard user permissions. Rently has released a patch as of late June 2026, and no known public exploitation has been reported.

MCP tools in the sublinear-time-solver and consciousness-explorer packages accept a user-supplied file path parameter and pass it directly to filesystem operations without validating or restricting the destination. This allows any client able to invoke these MCP tools to read, write, or overwrite arbitrary files accessible to the server process, leading to data exposure, tampering, or service disruption. The issue is fixed in later versions of both packages.

The genieacs-mcp MCP server, prior to version 0.3.2, exposes an unauthenticated HTTP listener on localhost by default and fails to validate Host/Origin headers, making it vulnerable to DNS rebinding attacks from malicious websites. An attacker who lures a victim to a malicious webpage can pivot through the victim's browser into the local MCP server and issue commands against the GenieACS TR-069 ACS backend, potentially rebooting devices, altering firmware tasks, or changing CPE configuration. This is a genuine, well-documented vulnerability with a clear exploitation path and meaningful impact on managed device fleets.

A missing authorization check in Dradis Community Edition lets any authenticated non-admin user redirect the built-in Roslin AI agent to an arbitrary attacker-controlled or internal URL. This creates a server-side request forgery vulnerability whose responses are reflected back to the attacker, enabling access to internal services and cloud metadata endpoints like AWS IMDS.

A vulnerability in Amazon Strands Agents Tools' python_repl tool allows attackers to craft prompts that bypass the human-in-the-loop consent gate by forwarding a non_interactive_mode keyword argument through the batch tool. This can lead to arbitrary Python code execution on the agent's host without human approval, effectively defeating a key safety control. Upgrading to version 0.8.5 or later remediates the issue.

The mcp-shell MCP server, intended to safely execute allowlisted shell commands on behalf of an AI agent, fails to properly validate command arguments when the executable is bash. An attacker or a compromised/malicious agent can invoke the shell_exec tool with '/bin/bash -c <command>' to run arbitrary commands as the mcpuser, completely bypassing the intended security allowlist. This is a high-severity tool-layer vulnerability that gives an attacker code execution wherever the fixed pre-0.6.0 mcp-shell server is deployed.

PraisonAI's local MCP HTTP Stream server uses a flawed startswith() check to validate the HTTP Origin header, allowing an attacker-controlled domain like 'localhost.evil.example' to pass as if it were 'localhost'. A malicious webpage visited by a victim can exploit this to send unauthenticated tools/call requests directly to the victim's local MCP server, invoking any exposed tool without an API key.

Attackers are actively exploiting two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, allowing forgery of SAML responses to gain unauthorized administrator access. Sites running vulnerable versions of the plugin are at immediate risk of full site takeover.

An unpatched vulnerability in Calix GS7 XGS (GS5239XG) residential routers allows remote, unauthenticated attackers to create arbitrary port-forwarding rules, bypassing NAT protections and exposing internal network devices directly to the internet. The flaw affects devices deployed by multiple U.S. broadband providers, putting a large base of residential and small-office networks at risk of direct exposure of internal systems such as NAS devices, cameras, and smart home hubs.

CISA has added CVE-2026-21962, an improper access control vulnerability affecting Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities (KEV) catalog based on confirmed active exploitation. Federal civilian agencies are required under BOD 26-04 to remediate this vulnerability on a priority basis, and CISA urges all organizations to do the same given the active exploitation in the wild.

The Continue CLI's headless/auto mode relies solely on an incomplete denylist to block dangerous shell commands, missing paths like /home, /root, /var, and failing to properly handle variable expansion such as $HOME. An attacker who can inject instructions into content the agent reads (web pages, repo files, issues) can trigger destructive commands like recursive deletion, causing unattended agent runs to destroy user data.

This is an academic research paper (not an active exploit) demonstrating that persistent agent memory systems are highly vulnerable to simple, plainly worded false statements: poisoning just 1.2% of a memory corpus dropped answer accuracy from 0.85 to 0.30. The authors show that both write-time content screening and provenance-weighted retrieval defenses fail to catch these low-effort attacks, exposing a fundamental architectural gap rather than a specific software bug.