https://vibevulns.pages.dev/https://vibevulns.pages.dev/tools/https://vibevulns.pages.dev/stats/https://vibevulns.pages.dev/checklist/https://vibevulns.pages.dev/submit/https://vibevulns.pages.dev/sponsor/https://vibevulns.pages.dev/disclosure/https://vibevulns.pages.dev/tools/lovable/https://vibevulns.pages.dev/tools/bolt/https://vibevulns.pages.dev/tools/v0/https://vibevulns.pages.dev/tools/replit/https://vibevulns.pages.dev/tools/base44/https://vibevulns.pages.dev/tools/firebase-studio/https://vibevulns.pages.dev/tools/cursor/https://vibevulns.pages.dev/tools/copilot/https://vibevulns.pages.dev/tools/windsurf/https://vibevulns.pages.dev/tools/claude-code/https://vibevulns.pages.dev/tools/codex/https://vibevulns.pages.dev/tools/gemini-cli/https://vibevulns.pages.dev/tools/cline/https://vibevulns.pages.dev/tools/roo/https://vibevulns.pages.dev/tools/devin/https://vibevulns.pages.dev/tools/amazon-q/https://vibevulns.pages.dev/tools/mcp/https://vibevulns.pages.dev/tools/openai/https://vibevulns.pages.dev/tools/anthropic/https://vibevulns.pages.dev/tools/gemini/https://vibevulns.pages.dev/tools/llama/https://vibevulns.pages.dev/tools/mistral/https://vibevulns.pages.dev/tools/deepseek/https://vibevulns.pages.dev/tools/xai/https://vibevulns.pages.dev/tools/langchain/https://vibevulns.pages.dev/tools/llamaindex/https://vibevulns.pages.dev/tools/ollama/https://vibevulns.pages.dev/tools/vllm/https://vibevulns.pages.dev/tools/litellm/https://vibevulns.pages.dev/tools/transformers/https://vibevulns.pages.dev/tools/open-webui/https://vibevulns.pages.dev/tools/nextjs/https://vibevulns.pages.dev/tools/supabase/https://vibevulns.pages.dev/category/builders/https://vibevulns.pages.dev/category/agents/https://vibevulns.pages.dev/category/mcp/https://vibevulns.pages.dev/category/models/https://vibevulns.pages.dev/category/frameworks/https://vibevulns.pages.dev/category/stack/https://vibevulns.pages.dev/issues/cve-2025-48757-lovable-missing-rls/https://vibevulns.pages.dev/issues/supabase-tables-readable-without-login/https://vibevulns.pages.dev/issues/supabase-service-role-key-in-frontend/https://vibevulns.pages.dev/issues/next-public-env-secret-leak/https://vibevulns.pages.dev/issues/base44-private-app-auth-bypass/https://vibevulns.pages.dev/issues/client-side-only-auth/https://vibevulns.pages.dev/issues/cve-2025-29927-nextjs-middleware-bypass/https://vibevulns.pages.dev/issues/middleware-only-route-protection/https://vibevulns.pages.dev/issues/cve-2025-54135-cursor-curxecute/https://vibevulns.pages.dev/issues/cve-2025-54136-cursor-mcpoison/https://vibevulns.pages.dev/issues/rules-file-backdoor/https://vibevulns.pages.dev/issues/slopsquatting-hallucinated-packages/https://vibevulns.pages.dev/issues/replit-agent-deleted-production-database/https://vibevulns.pages.dev/issues/mcp-tool-poisoning-attacks/https://vibevulns.pages.dev/issues/github-mcp-private-repo-leak/https://vibevulns.pages.dev/issues/supabase-mcp-prompt-injection/https://vibevulns.pages.dev/issues/cve-2025-53773-copilot-prompt-injection-rce/https://vibevulns.pages.dev/issues/camoleak-copilot-chat/https://vibevulns.pages.dev/issues/cve-2025-32711-echoleak-m365-copilot/https://vibevulns.pages.dev/issues/chatgpt-spaiware-memory-injection/https://vibevulns.pages.dev/issues/deepseek-exposed-clickhouse-database/https://vibevulns.pages.dev/issues/deepseek-r1-jailbreak-evaluation/https://vibevulns.pages.dev/issues/grok-4-echo-chamber-jailbreak/https://vibevulns.pages.dev/issues/many-shot-jailbreaking/https://vibevulns.pages.dev/issues/gemini-trifecta/https://vibevulns.pages.dev/issues/cve-2025-8217-amazon-q-malicious-code/https://vibevulns.pages.dev/issues/cve-2024-50050-llama-stack-pickle/https://vibevulns.pages.dev/issues/windsurf-prompt-injection-secrets/https://vibevulns.pages.dev/issues/owasp-llm01-prompt-injection/https://vibevulns.pages.dev/issues/cve-2026-86063-claude-code-plugin-hash-pin-bypass-allows-bypass/https://vibevulns.pages.dev/issues/cve-2026-55607-claude-code-sandbox-escape-via-git-worktree-path/https://vibevulns.pages.dev/issues/cve-2026-40068-claude-code-trust-dialog-bypass-via-git-worktree/https://vibevulns.pages.dev/issues/cve-2026-39861-claude-code-sandbox-escape-via-symlink-following/https://vibevulns.pages.dev/issues/cve-2026-33068-claude-code-has-a-workspace-trust-dialog-bypass/https://vibevulns.pages.dev/issues/cve-2026-25725-claude-code-has-sandbox-escape-via-persistent/https://vibevulns.pages.dev/issues/cve-2026-25723-claude-code-vulnerable-to-command-injection-via/https://vibevulns.pages.dev/issues/cve-2026-25722-claude-code-vulnerable-to-command-injection-via/https://vibevulns.pages.dev/issues/cve-2026-24887-claude-code-has-a-command-injection-in-find/https://vibevulns.pages.dev/issues/cve-2026-24053-claude-code-has-a-path-restriction-bypass-via-zsh/https://vibevulns.pages.dev/issues/cve-2026-24052-claude-code-has-a-domain-validation-bypass-which/https://vibevulns.pages.dev/issues/cve-2025-66032-claude-code-command-validation-bypass-allows/https://vibevulns.pages.dev/issues/cve-2025-64755-anthropic-ai-claude-code-has-sed-command/https://vibevulns.pages.dev/issues/cve-2025-65099-claude-code-vulnerable-to-command-execution-prior/https://vibevulns.pages.dev/issues/cve-2025-59536-claude-code-can-execute-commands-prior-to-the/https://vibevulns.pages.dev/issues/cve-2025-59828-claude-code-vulnerable-to-arbitrary-code/https://vibevulns.pages.dev/issues/cve-2025-59041-claude-code-vulnerable-to-arbitrary-code/https://vibevulns.pages.dev/issues/cve-2025-58764-claude-code-rg-vulnerability-does-not-protect/https://vibevulns.pages.dev/issues/cve-2025-55284-claude-code-s-permissive-default-allowlist/https://vibevulns.pages.dev/issues/cve-2025-54795-claude-code-echo-command-allowed-bypass-of-user/https://vibevulns.pages.dev/issues/cve-2025-54794-claude-code-research-preview-has-a-path/https://vibevulns.pages.dev/issues/cve-2025-52882-claude-code-improper-authorization-via-websocket/https://vibevulns.pages.dev/issues/cve-2025-61260-openai-codex-cli-enables-code-execution-through/https://vibevulns.pages.dev/issues/cve-2025-59532-codex-has-sandbox-bypass-due-to-bug-in-path/https://vibevulns.pages.dev/issues/cve-2026-12537-gemini-cli-remote-code-execution-via-workspace/https://vibevulns.pages.dev/issues/cve-2026-104850-mcp-typescript-sdk-oauth-client-could-send/https://vibevulns.pages.dev/issues/cve-2026-59950-mcp-python-sdk-websocket-server-transport-does/https://vibevulns.pages.dev/issues/cve-2026-52869-mcp-python-sdk-http-transports-serve-session/https://vibevulns.pages.dev/issues/cve-2026-52870-mcp-python-sdk-experimental-task-handlers-allow/https://vibevulns.pages.dev/issues/cve-2026-32871-fastmcp-openapi-provider-has-an-ssrf-path/https://vibevulns.pages.dev/issues/cve-2026-27124-fastmcp-missing-consent-verification-in-oauth/https://vibevulns.pages.dev/issues/cve-2025-69196-fastmcp-oauth-proxy-token-reuse-across-mcp/https://vibevulns.pages.dev/issues/cve-2026-25536-modelcontextprotocol-sdk-has-cross-client-data/https://vibevulns.pages.dev/issues/cve-2025-9611-microsoft-playwright-mcp-server-vulnerable-to-dns/https://vibevulns.pages.dev/issues/cve-2026-0621-anthropic-s-mcp-typescript-sdk-has-a-redos/https://vibevulns.pages.dev/issues/cve-2025-66416-model-context-protocol-mcp-python-sdk-does-not/https://vibevulns.pages.dev/issues/cve-2025-66414-model-context-protocol-mcp-typescript-sdk-does/https://vibevulns.pages.dev/issues/cve-2025-58444-mcp-inspector-is-vulnerable-to-potential-command/https://vibevulns.pages.dev/issues/cve-2025-6514-mcp-remote-exposed-to-os-command-injection-via/https://vibevulns.pages.dev/issues/cve-2025-53366-mcp-python-sdk-vulnerability-in-the-fastmcp/https://vibevulns.pages.dev/issues/cve-2025-53365-mcp-python-sdk-has-unhandled-exception-in/https://vibevulns.pages.dev/issues/cve-2025-53110-modelcontextprotocol-server-filesystem/https://vibevulns.pages.dev/issues/cve-2025-53109-modelcontextprotocol-server-filesystem-allows-for/https://vibevulns.pages.dev/issues/cve-2025-49596-mcp-inspector-proxy-server-lacks-authentication/https://vibevulns.pages.dev/issues/cve-2024-46946-langchain-experimental-eval-injection/https://vibevulns.pages.dev/issues/cve-2024-27444-langchain-experimental-vulnerable-to-arbitrary/https://vibevulns.pages.dev/issues/cve-2023-32785-langchain-sql-injection/https://vibevulns.pages.dev/issues/cve-2025-1793-llama-index-vulnerable-to-sql/https://vibevulns.pages.dev/issues/cve-2024-45201-llamaindex-includes-an-exec-call-for-import-cls/https://vibevulns.pages.dev/issues/cve-2024-3271-llama-index-core-command-injection/https://vibevulns.pages.dev/issues/cve-2025-63389-ollama-platform-has-missing-authentication/https://vibevulns.pages.dev/issues/cve-2026-7482-ollama-contains-a-heap-out-of-bounds-read/https://vibevulns.pages.dev/issues/cve-2024-28224-ollama-dns-rebinding/https://vibevulns.pages.dev/issues/cve-2025-32444-vllm-vulnerable-to-remote-code-execution-via/https://vibevulns.pages.dev/issues/cve-2026-22778-vllm-has-rce-in-video/https://vibevulns.pages.dev/issues/cve-2025-47277-vllm-allows-remote-code-execution-via-pyncclpipe/https://vibevulns.pages.dev/issues/cve-2026-37004-litellm-vulnerable-to-server-side-template/https://vibevulns.pages.dev/issues/cve-2026-49468-litellm-authentication-bypass-via-host-header/https://vibevulns.pages.dev/issues/cve-2026-42208-litellm-has-sql-injection-in-proxy-api-key/https://vibevulns.pages.dev/issues/cve-2026-45672-open-webui-jupyter-code-execution-works-despite/https://vibevulns.pages.dev/issues/cve-2026-87995-open-webui-same-origin-xss-to-account-takeover/https://vibevulns.pages.dev/issues/cve-2026-70492-open-webui-stored-xss-via-unescaped-katex-render/https://vibevulns.pages.dev/issues/cve-2023-6730-transformers-has-a-deserialization-of-untrusted/https://vibevulns.pages.dev/issues/cve-2024-11393-deserialization-of-untrusted-data-in-hugging-face/https://vibevulns.pages.dev/issues/cve-2024-11394-deserialization-of-untrusted-data-in-hugging-face/https://vibevulns.pages.dev/issues/cve-2026-75604-next-js-unauthenticated-remote-code-execution-on/https://vibevulns.pages.dev/issues/cve-2026-44578-next-js-vulnerable-to-server-side-request-forgery/https://vibevulns.pages.dev/issues/cve-2026-44574-next-js-has-a-middleware-proxy-bypass-through/https://vibevulns.pages.dev/issues/cve-2026-59951-mcp-python-sdk-unbounded-session-accumulation-in/https://vibevulns.pages.dev/issues/ghsa-vcvr-r3jv-pc5j-next-js-remote-code-execution-in-next-og/https://vibevulns.pages.dev/issues/ghsa-2xp9-vwfh-vxw4-next-js-unauthenticated-remote-code-execution-in/https://vibevulns.pages.dev/issues/cve-2026-87016-open-webui-sign-in-as-another-user-via-wildcard/https://vibevulns.pages.dev/issues/cve-2026-84377-litellm-authenticated-ssrf-and-provider/