Showing 41–43 of 43 threats, newest first
A low-severity vulnerability was identified in LangGraph's Task Result Cache where the internal _freeze function uses a weak hash for generating default cache keys. Exploitation requires high attack complexity and remote access, with a CVSS score of 3.1, making practical exploitation difficult. A fix is pending via an open pull request.
Updated Jul 5, 2026 · CVSS 3.1
This is an academic research paper (not an active exploit) introducing SafeClawArena, a benchmark that systematically measures security failures in always-on 'Claw-like' agents such as OpenClaw, which hold persistent credentials, files, and tool access. The findings show alarmingly high attack success rates (up to 70%, and 100% for malicious plugins), indicating that current agent platforms lack the isolation and mediation protections found in traditional OS design. Because this is a controlled research disclosure rather than an in-the-wild attack, severity is rated high (not critical) but warrants urgent defensive attention given the demonstrated real-world exploitability.
Updated Jul 5, 2026
The MCP Inspector developer tool shipped a proxy that lacked authentication, allowing browser-based attackers to reach it from a malicious web page and execute code on the developer's machine. Reported by Oligo Security with a CVSS score of 9.4.
Updated Jul 3, 2026 · CVSS 9.4