4 min read
Vulnerabilities Three high-severity vulnerabilities in the OpenClaw AI assistant allow a remotely-sent WhatsApp message to trigger host code execution, SSH key theft, and Docker socket escape. All three are patched in version 2026.6.6.
Vulnerabilities
CVEs, exploits, and security flaws in AI frameworks, models, and infrastructure.
6 min read
Vulnerabilities A 15-year-old Linux kernel use-after-free bug with a public 97%-reliable exploit gives any local attacker root in under five seconds. GPU training clusters, Jupyter servers, and LLM inference nodes are directly in scope.
5 min read
Vulnerabilities CVE-2026-21858 gives unauthenticated attackers full code execution on n8n workflow servers. Langflow's new IDOR vulnerability has been added to CISA KEV. GitHub Copilot's MCP integration carries a prompt-injection-to-RCE chain. AI automation infrastructure is becoming a primary attack surface.
5 min read
Vulnerabilities Nine vulnerabilities including a hardcoded authentication bypass and critical MCP command injection were disclosed in PraisonAI, with scanners targeting the auth bypass endpoint less than four hours after the advisory went public.
3 min read
Vulnerabilities Two critical vulnerabilities in Cursor IDE, CVE-2026-50548 and CVE-2026-50549 (collectively DuneSlide), allow prompt injection attacks to escape the editor's sandbox and execute arbitrary code at the OS level — with no user click required. All Cursor versions before 3.0 are affected. Cato Networks disclosed publicly on July 3, 2026.