NewsGoogle Threat Intelligence
Vulnerability Discovery and Exploitation Trends in the AI Era
Linked advisories
- CVE-2026-5027Langflow: Pfadüberschreitung (Path Traversal)
- CVE-2026-1731BeyondTrust Remote Support (RS) und bestimmte ältere Versionen von Privileged Remote Access (PRA) enthalten eine kritische Schwachstelle für die vorauthentifizierte Fernausführung von Code.
- CVE-2025-3248Langflow Unauth RCE
- CVE-2025-3248Langflow: fehlende Authentifizierung für kritische Funktion
- CVE-2025-3248Langflow Unauth RCE
- CVE-2026-42271LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to pre…
- CVE-2026-42271LiteLLM: Authenticated command execution via MCP stdio test endpoints
- CVE-2026-1731BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) — BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
- CVE-2026-42271LiteLLM: Mehrere Schwachstellen
- CVE-2025-3248OSV-Eintrag
- CVE-2026-1731BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vuln
- CVE-2026-42271LiteLLM: Authenticated command execution via MCP stdio test endpoints
- CVE-2025-3248Langflow Langflow — Langflow Missing Authentication Vulnerability
- CVE-2026-5027Langflow: Pfadüberschreitung (Path Traversal)
- CVE-2025-3248Langflow: Missing Authentication Vulnerability
- CVE-2026-42271BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability
- CVE-2026-42271BerriAI LiteLLM — BerriAI LiteLLM Command Injection Vulnerability
- CVE-2026-42271BerriAI LiteLLM: Betriebssystem-Befehlsinjektion
- CVE-2025-3248Active Exploitation of Critical Vulnerability in Langflow
Affected vendors and products
More on Discovery
Other advisories
- HighCVE-2026-115486Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning
- MediumCVE-2026-99206scsi: target: iscsi: Fix race in discovery auth updates
- Not ratedosv:CVE-2026-99206scsi: target: iscsi: Fix race in discovery auth updates
- Not ratedosv:CVE-2026-93848Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator
- HighCVE-2026-62197OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs
- HighCVE-2026-62197OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs
- Not ratedosv:CVE-2026-87849Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
- Not ratedosv:CVE-2026-107597jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme
Other news entries
- OpenAI’s August fix for theft of reasoning traces was quickly bypassedNewsCSO Online
- The Internet goes on high alert after discovery of 8 compromised TLS certsNewsArs Technica — Security
- The Evolving Cybersecurity Lexicon: Vulnerability Discovery to ResilienceNewsDark Reading
- The Q3 Vulnerability Pulse: Discovery ≠ ExploitationNewsCisco Talos
- Criminal IP Introduces AITEM as the Next Evolution of Attack Surface ManagementNewsBleepingComputer
- Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection FlawsNewsThe Hacker News
- Google’s bug bounty pause highlights growing AI vulnerability triage challengeNewsCSO Online
- Microsoft says threat actors are ahead in the early AI raceNewsBleepingComputer
ID