CVE-2026-59318 DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege...

CVE-2026-59318 DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege...

CVE-2026-59318

CVE-2026-59318 is an Incorrect Authorization flaw in Spring AI 's tool calling support, specifically in DefaultToolCallingManager within the org.springframework.ai:spring-ai-model package. The per-request tool list is advertised to the model as a boundary but is not fully enforced at dispatch tim...

CVE-2026-62676: Incomplete List of Disallowed Inputs

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...

PT-2026-79457

Name of the Vulnerable Software and Affected Versions Xinference versions prior to 2.7.0 Description Xinference passes attacker-influenced Llama3 tool-call output to the eval function within xinference/model/llm/tool parsers/llama3 tool parser.py and xinference/model/llm/utils.py. Requests sent t...

SecureAI-Scan v0.10.0

SecureAI-Scan The AI security scanner that proves its findings. SecureAI-Scan finds LLM, MCP, Agent Skill, and RAG vulnerabilities in TypeScript, JavaScript, and Python — and shows you the evidence: the exact source → flow → sink path for every dataflow finding, resolved through real imports, not...

EUVD-2026-63135

Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the filename argument passed to readfile, savetofile, or runpythonfile tool actions...

CVE-2026-76832 Agno PythonTools Path Traversal via joinpath file_name argument

Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the filename argument passed to readfile, savetofile, or runpythonfile tool actions...

CVE-2026-54689

creationtimestamp| type| source ---|---|--- 2026-08-19 20:35:08+00:00| published-proof-of-concept| https://github.com/ihor-sokoliuk/mcp-searxng/security/advisories/GHSA-wppf-h75h-6pm6...

GHSA-RR55-JP92-8WP2 claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

Summary claude-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

Summary faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be made to...

GHSA-CC2G-GQ8C-R332 grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools

Summary Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

WordPress Contest Gallery plugin < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts vulnerability

Subscriber+ OpenAI Prompt History Disclosure via postcggetopenaiprompts vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Contest Gallery versions 30.0.7...

PYSEC-2026-3704 vLLM: Completion prompt lists fan out into unbounded engine requests

Summary The /v1/completions request model accepts prompt as a list of text prompts or a list of token-id prompts without any outer prompt-count bound. The serving path turns each element into a separate engine input, creates one engine generator per element, merges all generators, and allocates a...

mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

Summaryconfluenceuploadattachment passes filepath directly to openfilepath, "rb" with no path validation. Any authenticated MCP client — or an AI agent manipulated via prompt injection — can read any file the server process can access and exfiltrate it to Confluence as an attachment. DetailsRoot...

PYSEC-2026-3683 mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

Summary confluenceuploadattachment passes filepath directly to openfilepath, "rb" with no path validation. Any authenticated MCP client — or an AI agent manipulated via prompt injection — can read any file the server process can access and exfiltrate it to Confluence as an attachment. Details Roo...

When Agents Go Rogue: The OpenClaw Supply Chain Crisis

When Agents Go Rogue: The OpenClaw Supply Chain Crisis By Aniket Choukde, Vikas Mishra and Yadunadh · August 19, 2026 This blog was also written by Akhil Reddy and Pavan Kumar Podila Executive Summary The cybersecurity landscape is currently undergoing a seismic shift driven by the adoption of...

PT-2026-78837

Name of the Vulnerable Software and Affected Versions Agno affected versions not specified Description PythonTools in libs/agno/agno/tools/python.py contains a path traversal issue. This occurs when parent-directory traversal sequences are supplied in the file name argument passed to the read fil...

CVE-2026-75130

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can poison the custom instruction...

EUVD-2026-61099

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can poison the custom instruction...