Mechanistic Interpretability of LLM Jailbreaks Via Internal Attribution Graphs

Large language models LLMs exhibit remarkable capabilities but remain highly vulnerable to adversarial prompts and jailbreak attacks. Existing approaches primarily analyze these failures through input-output behaviors or attribution methods, offering limited insight into how adversarial...

PT-2026-56417

Name of the Vulnerable Software and Affected Versions bentoml OpenLLM version 0.6.30 Description Command injection is possible within the Model Repository Directory Name Handler component. This occurs when the cmd argument is manipulated in the async run command function located in the...

Exploit for Command Injection in Litellm

─── CVE-2026-42271 ─── 🛡️ AMN SECURITY 🛡️ مركز أ...

CGA-772P-X4VG-PM67

Bulletin has no description...

CVE-2026-58473

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

CVE-2026-58473 Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

CVE-2026-58473

CVE-2026-58473 (Cognee) vulnerability affects Cognee prior to 1.2.0. An improper access-control flaw allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which lacks admin/superuser checks. This enabl...

EUVD-2026-42095

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

EUVD-2026-7982

Open WebUI vulnerable to Stored XSS via iFrame in citations model...

GHSA-XC8P-9RR6-97R2 Open WebUI vulnerable to Stored XSS via iFrame in citations model

Summary Manually modifying chat history allows setting the html property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponised document...

GO-2026-5925 Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder...

PYSEC-2026-1909 Sentencepiece has a a heap overflow issue

Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure...

bigquery-fdw (>=2.1.1, <=2.1.2), bxsolana-trader (1.7.0) +6 more potentially affected by CVE-2026-0994 via protobuf (4.21.8)

protobuf PYPI version 4.21.8 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - bigquery-fdw =2.1.1, =0.0.13, =0.2.0, =0.0.2, =0.4.0, =0.2.0, =0.1.0, =0.1.1 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

Sentencepiece has a a heap overflow issue

Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure...

py-model-versioning (>=0.4.0, <=0.5.0), qudi-iqo-modules (>=0.4.0, <=0.5.1) +3 more potentially affected by CVE-2026-0994 via protobuf (4.21.5)

protobuf PYPI version 4.21.5 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - py-model-versioning =0.4.0, =0.4.0, =0.0.2, =1.0.0, =2.14.6, =2.15.1 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

vLLM affected by RCE via auto_map dynamic module loading during model initialization

SummaryvLLM loads Hugging Face automap dynamic modules during model resolution without gating on trustremotecode, allowing attacker-controlled Python code in a model repo/path to execute at server startup.--- ImpactAn attacker who can influence the model repo/path local directory or remote Huggin...

PYSEC-2026-2010 vLLM affected by RCE via auto_map dynamic module loading during model initialization

Summary vLLM loads Hugging Face automap dynamic modules during model resolution without gating on trustremotecode, allowing attacker-controlled Python code in a model repo/path to execute at server startup. --- Impact An attacker who can influence the model repo/path local directory or remote...

Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length

SummaryPicklescan uses the numpy.f2py.crackfortran.evallength function a NumPy F2PY helper to execute arbitrary Python code during unpickling. DetailsPicklescan fails to detect a malicious pickle that uses the gadget numpy.f2py.crackfortran.evallength in reduce, allowing arbitrary command executi...

PYSEC-2026-1783 Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length

Summary Picklescan uses the numpy.f2py.crackfortran.evallength function a NumPy F2PY helper to execute arbitrary Python code during unpickling. Details Picklescan fails to detect a malicious pickle that uses the gadget numpy.f2py.crackfortran.evallength in reduce, allowing arbitrary command...

gesture-classifying-model (>=0.1.2, <=0.1.3) potentially affected by CVE-2025-12060 via keras (1.2.2)

keras PYPI version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - gesture-classifying-model =0.1.2, =0.1.3 Source cves: CVE-2025-12060 Source advisory: OSV:PYSEC-2026-1486...