VibeVulns

CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

Thu, 15 Oct 2026 00:00:00 GMT

The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA.

CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

Tue, 06 Oct 2026 00:00:00 GMT

In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to.

CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

Thu, 10 Sep 2026 00:00:00 GMT

Any authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself.

CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Tue, 08 Sep 2026 00:00:00 GMT

A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.

CVE-2026-37004: LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

Thu, 27 Aug 2026 00:00:00 GMT

BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.

CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Tue, 04 Aug 2026 00:00:00 GMT

Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error.

Supabase tables readable by anyone with no login

Sat, 01 Aug 2026 00:00:00 GMT

A scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login.

Supabase service_role / secret key shipped to the browser

Sat, 01 Aug 2026 00:00:00 GMT

The service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public.

Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variables

Sat, 01 Aug 2026 00:00:00 GMT

Prefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way.

CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

Fri, 24 Jul 2026 00:00:00 GMT

Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks.

CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validation

Thu, 16 Jul 2026 00:00:00 GMT

In affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation.

CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

Thu, 16 Jul 2026 00:00:00 GMT

In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session.

CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

Thu, 16 Jul 2026 00:00:00 GMT

In affected versions, the default request handlers installed by the experimental tasks feature (server.experimental.enable_tasks()) did not check which session created a task before acting on it.

CVE-2026-49468: LiteLLM: Authentication Bypass via Host Header Injection

Tue, 16 Jun 2026 00:00:00 GMT

A Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes.

CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed

Thu, 14 May 2026 00:00:00 GMT

The /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes.

CVE-2026-44578: Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades

Mon, 11 May 2026 00:00:00 GMT

Self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests.

CVE-2026-44574: Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

Mon, 11 May 2026 00:00:00 GMT

Applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass.

CVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader

Mon, 04 May 2026 00:00:00 GMT

Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader.

CVE-2026-12537: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

Fri, 24 Apr 2026 00:00:00 GMT

Gemini CLI (@google/gemini-cli) and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions.

CVE-2026-42208: LiteLLM has SQL Injection in Proxy API key verification

Fri, 24 Apr 2026 00:00:00 GMT

A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter.

CVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution

Fri, 24 Apr 2026 00:00:00 GMT

Claude Code used the git worktree commondir file when determining folder trust but did not validate its contents.

CVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

Tue, 21 Apr 2026 00:00:00 GMT

Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace.

CVE-2025-61260: OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files

Tue, 14 Apr 2026 00:00:00 GMT

A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository.

CVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

Tue, 31 Mar 2026 00:00:00 GMT

The OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service.

CVE-2026-27124: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

Tue, 31 Mar 2026 00:00:00 GMT

While testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub.

CVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

Thu, 19 Mar 2026 00:00:00 GMT

Claude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog.

CVE-2025-69196: FastMCP OAuth Proxy token reuse across MCP servers

Mon, 16 Mar 2026 00:00:00 GMT

While testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request.

CVE-2026-25725: Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json

Fri, 06 Feb 2026 00:00:00 GMT

Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup.

CVE-2026-25723: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions

Fri, 06 Feb 2026 00:00:00 GMT

Claude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope.

CVE-2026-25722: Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection

Fri, 06 Feb 2026 00:00:00 GMT

Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation.

CVE-2026-25536: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

Wed, 04 Feb 2026 00:00:00 GMT

Cross-client data leak via two distinct issues: (1) reusing a single StreamableHTTPServerTransport across multiple client requests, and (2) reusing a single McpServer/Server instance across multiple transports. Both are most common in stateless deployments.

CVE-2026-24887: Claude Code has a Command Injection in find Command Bypasses User Approval Prompt

Tue, 03 Feb 2026 00:00:00 GMT

Due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window.

CVE-2026-24053: Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes

Tue, 03 Feb 2026 00:00:00 GMT

Due to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts.

CVE-2026-24052: Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains

Tue, 03 Feb 2026 00:00:00 GMT

Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests.

CVE-2026-22778: vLLM has RCE In Video Processing

Mon, 02 Feb 2026 00:00:00 GMT

vLLM has RCE In Video Processing.

CVE-2025-9611: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools

Wed, 07 Jan 2026 00:00:00 GMT

Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections.

CVE-2026-0621: Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

Mon, 05 Jan 2026 00:00:00 GMT

A ReDoS vulnerability in the UriTemplate class allows attackers to cause denial of service. The partToRegExp() function generates a regex pattern with nested quantifiers (([^/]+(?:,[^/]+))) for exploded template variables (e.g., {/id}, {?tags*}), causing catastrophic backtracking on malicious input.

CVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operations

Thu, 18 Dec 2025 00:00:00 GMT

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.

CVE-2025-66032: Claude Code Command Validation Bypass Allows Arbitrary Code Execution

Wed, 03 Dec 2025 00:00:00 GMT

Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window.

CVE-2025-66416: Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

Tue, 02 Dec 2025 00:00:00 GMT

The Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers.

CVE-2025-66414: Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Tue, 02 Dec 2025 00:00:00 GMT

The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers.

CVE-2025-64755: @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes

Thu, 20 Nov 2025 00:00:00 GMT

Due to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system.

CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialog

Wed, 19 Nov 2025 00:00:00 GMT

When using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version.

CamoLeak: Copilot Chat leaked private source code

Wed, 08 Oct 2025 00:00:00 GMT

Legit Security reported a critical vulnerability in GitHub Copilot Chat that could leak private source code from a user’s repositories.

CVE-2025-59536: Claude Code can execute commands prior to the startup trust dialog

Fri, 03 Oct 2025 00:00:00 GMT

Due to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory.

Gemini Trifecta: three injection flaws in Google’s Gemini suite

Tue, 30 Sep 2025 00:00:00 GMT

Tenable found three now-fixed vulnerabilities in Gemini Cloud Assist, the Search Personalization model and the Browsing tool that exposed users to privacy risks, including search-injection.

CVE-2025-59828: Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

Wed, 24 Sep 2025 00:00:00 GMT

When using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version.

CVE-2025-59532: Codex has sandbox bypass due to bug in path configuration logic

Fri, 19 Sep 2025 00:00:00 GMT

Due to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session.

CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email

Wed, 10 Sep 2025 00:00:00 GMT

At startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace.

CVE-2025-58764: Claude Code rg vulnerability does not protect against approval prompt bypass

Wed, 10 Sep 2025 00:00:00 GMT

Due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window.