Research
Novel technique, papers, AI and infrastructure security research
-
Nine MCP servers take command-injection CVEs in one batch, and every one is scored as a local attack
VulnCheck published nine command-injection CVEs against nine unrelated MCP servers inside two minutes on Tuesday morning, eight of them with no fix, and every one scored as a…
-
A2A and MCP both shipped a task store called InMemoryTaskStore that answers any caller who knows a task ID
Two agent protocols, two reference SDKs, two languages, two reporters — and the same class, with the same name, missing the same check. What happened On October 20,…
-
Thirteen AI agent framework records published in ten seconds, and in most of them the shipped default is the vulnerability
One researcher team, one CNA, nine AI agent projects: a batch of records published in a ten-second window overnight, in which the thing being reported is almost never…
-
Apache Camel published 39 advisories in 64 minutes, and a scanning tool is the credited finder on 27
Apache Camel published 39 CVE records between 10:03 and 11:07 a.m. UTC on Monday, October 19, and the project’s own advisory pages name a scanning tool rather than…
-
Stable Diffusion web UI executes Python from a YAML file beside the safetensors model, and the record scores it 6.3 where the reporter asked for 8.8
Four records published today against AUTOMATIC1111’s web UI; the code execution comes from a same-basename YAML sidecar, and the inert file in the attacker’s package is the safetensors…
-
Nine CVEs land against EnergizeLab’s Eilik robots, and the researcher says a third party had webshells on the server first
Nine CVE records for EnergizeLab’s Eilik and EilikO companion robots were published on October 15, 2026, assigned by a researcher-run CNA after four months in which the vendor…
-
AWS closed Zenity’s AgentCore metadata finding as ‘informative,’ and the agent-takeover chain it opens has no CVE and no advisory
One prompt to a public-facing agent reached the instance metadata service and returned the execution role’s credentials, and the only published record of what AWS changed is Zenity’s…
-
MindSearch runs its planner’s generated Python through exec() on an unauthenticated port that defaults to all interfaces
A new 10.0 CVE names an argument that lives in a different file, and reading the source shows the execution is the design — the defect is the…
-
Half the flaws Google attributes to AI are remote code execution, and its method only counts the ones a vendor credited
Google’s threat intelligence group published its AI-era vulnerability trends report on September 30, 2026, and its sharpest number rests on a sample the report itself says is structurally…
-
Mooncake fixed a 9.8 unauthenticated memory read-write in a performance commit, and the 9.4 beside it is unfixed in the newest release
Two critical CVE records landed against Mooncake overnight: the 9.8 was already closed in August by a commit about connection-lane scheduling that never mentions security, and the 9.4…
-
AI coding agents published 13,000 internal screenshots to public GitHub repos, and the tool behind a third of them warns against exactly that
Glow Labs says AI coding agents routed screenshots through public GitHub repositories to get around a missing upload API — and the tool a third of the affected…
-
VulnCheck has now filed ten CVEs against LightLLM, nine in seventeen days, and the project has answered none of them
VulnCheck filed three more LightLLM records this afternoon, bringing the catalog to ten CVEs against one inference server — nine of them in seventeen days, six scored 9.8,…
-
Two new LightLLM CVEs put unauthenticated pickle deserialization on the network, and the project’s last such report is still open
VulnCheck published CVE-2026-103040 and CVE-2026-103041 on Tuesday night, both scored 9.8, both reaching code execution through RPyC services that accept pickled objects from any host, and neither names…
-
Cloudflare’s container disks returned unzeroed blocks to a shared pool, and the researcher pulled 2,700 foreign inodes out of them
Cloudflare’s own postmortem says a researcher recovered filesystem metadata belonging to other customers from recycled container storage, and the only record of the flaw is the blog post.…
-
Transluce found agent attack traffic in a public URL scanner’s archive from March 6, two months before the incidents that dated the start
Transluce classified 6,467 of 37,649 public urlquery.net reports as significant evidence of agent activity, named three targets, and said none of the attempts it found appears to have…