{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T12:59:41.857Z", "stack": { "id": "ai", "label": "AI / LLM tooling", "kind": "ecosystem", "url": "https://pwn.watch/s/ai", "feed": "https://pwn.watch/s/ai/feed.xml" }, "counts": { "incidents": 13, "live": 3, "notFullyPatched": 1, "patched": 12 }, "incidents": [ { "slug": "litellm-1-107-0-pypi-compromise", "title": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise", "json": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise.json", "status": "live", "severity": "critical", "patchStatus": "patched", "product": "LiteLLM (PyPI + official Docker/GHCR images)", "stacks": [ "python", "pypi", "docker", "ai" ], "cveIds": [ "MAL-2026-2144" ], "affectedVersions": [ "litellm==1.107.0; Docker/GHCR tags v1.107.0, latest, main-latest, main-stable during the Oct 21 window" ], "fixedVersions": [ "1.106.2 (pin; last known safe). Malicious 1.107.0 removed from PyPI, Docker Hub and GHCR" ], "startedAt": "2026-10-21", "closedAt": null, "updatedAt": "2026-10-22T14:02:37+02:00", "summary": "On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026." }, { "slug": "opencode-mcp-oauth-rce-windows", "title": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)", "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows", "json": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows.json", "status": "live", "severity": "critical", "patchStatus": "patched", "product": "OpenCode AI coding agent (Anomaly) on Windows and WSL", "stacks": [ "ai", "devtools" ], "cveIds": [], "affectedVersions": [ "OpenCode 1.0.137 through 1.18.32 on Windows and WSL" ], "fixedVersions": [ "OpenCode 1.18.33" ], "startedAt": "2026-10-19", "closedAt": null, "updatedAt": "2026-10-22T14:02:37+02:00", "summary": "A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when they started the MCP OAuth sign-in. The server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on Sep 28 without a CVE or advisory, so scanners won't flag 1.0.137 through 1.18.32. macOS and Linux are not affected. Pillar Security found it and rates it 9.8; no in-the-wild exploitation reported." }, { "slug": "opencode-console-provider-key-breach", "title": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "url": "https://pwn.watch/i/opencode-console-provider-key-breach", "json": "https://pwn.watch/i/opencode-console-provider-key-breach.json", "status": "live", "severity": "high", "patchStatus": "partial", "product": "OpenCode Console (hosted service by Anomaly)", "stacks": [ "ai" ], "cveIds": [], "affectedVersions": [ "OpenCode Console workspaces with saved OpenAI, Anthropic or Google provider keys (~1.4% of Console users; affected users were emailed)" ], "fixedVersions": [], "startedAt": "2026-10-17T00:30:00Z", "closedAt": null, "updatedAt": "2026-10-22T14:30:50+02:00", "summary": "On the night of Oct 16 2026 an intruder reached a legacy OpenCode Console system that was being decommissioned and may have exposed third-party AI provider keys saved in Console workspaces. OpenCode says 1.4% of Console users (those with external providers linked) were affected and tied it to a large-scale distillation attack. Users reported unauthorized charges up to ~$1,700 and some Google Cloud project suspensions. Anthropic and Google revoked/blocked exposed keys; OpenAI refunded drawn credits. The OpenCode app itself (local keys) was not affected." }, { "slug": "berriai-litellm-cve-2026-59822", "title": "BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability", "url": "https://pwn.watch/i/berriai-litellm-cve-2026-59822", "json": "https://pwn.watch/i/berriai-litellm-cve-2026-59822.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "BerriAI LiteLLM", "stacks": [ "python", "ai" ], "cveIds": [ "CVE-2026-59822" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-02", "closedAt": "2026-09-02", "updatedAt": "2026-09-02", "summary": "BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Added to CISA KEV on 2026-09-02." }, { "slug": "mlflow-mlflow-cve-2026-64849", "title": "MLflow MLflow: MLflow Server-Side Request Forgery Vulnerability", "url": "https://pwn.watch/i/mlflow-mlflow-cve-2026-64849", "json": "https://pwn.watch/i/mlflow-mlflow-cve-2026-64849.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "MLflow MLflow", "stacks": [ "python", "ai" ], "cveIds": [ "CVE-2026-64849" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-19", "closedAt": "2026-08-19", "updatedAt": "2026-08-19", "summary": "MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body. Added to CISA KEV on 2026-08-19." }, { "slug": "ray-project-ray-cve-2025-62593", "title": "Ray-Project Ray: Ray-Project Ray Code Injection Vulnerability", "url": "https://pwn.watch/i/ray-project-ray-cve-2025-62593", "json": "https://pwn.watch/i/ray-project-ray-cve-2025-62593.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Ray-Project Ray", "stacks": [ "python", "ai" ], "cveIds": [ "CVE-2025-62593" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-17", "closedAt": "2026-08-17", "updatedAt": "2026-08-17", "summary": "Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. Added to CISA KEV on 2026-08-17." }, { "slug": "ibm-langflow-cve-2026-9198", "title": "IBM Langflow: IBM Langflow Code Injection Vulnerability", "url": "https://pwn.watch/i/ibm-langflow-cve-2026-9198", "json": "https://pwn.watch/i/ibm-langflow-cve-2026-9198.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "IBM Langflow", "stacks": [ "python", "ai" ], "cveIds": [ "CVE-2026-9198" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-04", "closedAt": "2026-08-04", "updatedAt": "2026-08-04", "summary": "Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. Added to CISA KEV on 2026-08-04." }, { "slug": "langflow-langflow-cve-2026-0770", "title": "Langflow Langflow: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability", "url": "https://pwn.watch/i/langflow-langflow-cve-2026-0770", "json": "https://pwn.watch/i/langflow-langflow-cve-2026-0770.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Langflow Langflow", "stacks": [ "python", "ai" ], "cveIds": [ "CVE-2026-0770" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-21", "closedAt": "2026-07-21", "updatedAt": "2026-07-21", "summary": "Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. Added to CISA KEV on 2026-07-21." }, { "slug": "langflow-langflow-cve-2026-55255", "title": "Langflow Langflow: Langflow Authorization Bypass Through User-Controlled Key Vulnerability", "url": "https://pwn.watch/i/langflow-langflow-cve-2026-55255", "json": "https://pwn.watch/i/langflow-langflow-cve-2026-55255.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Langflow Langflow", "stacks": [ "python", "ai" ], "cveIds": [ "CVE-2026-55255" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-07", "closedAt": "2026-07-07", "updatedAt": "2026-07-07", "summary": "Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. Added to CISA KEV on 2026-07-07." }, { "slug": "berriai-litellm-cve-2026-42271", "title": "BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability", "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42271", "json": "https://pwn.watch/i/berriai-litellm-cve-2026-42271.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "BerriAI LiteLLM", "stacks": [ "python", "ai" ], "cveIds": [ "CVE-2026-42271", "CVE-2026-48710" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-06-08", "closedAt": "2026-06-08", "updatedAt": "2026-09-02", "summary": "BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host. CISA added CVE-2026-42271, CVE-2026-48710 to the Known Exploited Vulnerabilities catalog on 2026-06-08 based on evidence of active exploitation." }, { "slug": "langflow-langflow-cve-2025-34291", "title": "Langflow Langflow: Langflow Origin Validation Error Vulnerability", "url": "https://pwn.watch/i/langflow-langflow-cve-2025-34291", "json": "https://pwn.watch/i/langflow-langflow-cve-2025-34291.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Langflow Langflow", "stacks": [ "python", "ai" ], "cveIds": [ "CVE-2025-34291" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-21", "closedAt": "2026-05-21", "updatedAt": "2026-05-21", "summary": "Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints. Added to CISA KEV on 2026-05-21." }, { "slug": "berriai-litellm-cve-2026-42208", "title": "BerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerability", "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42208", "json": "https://pwn.watch/i/berriai-litellm-cve-2026-42208.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "BerriAI LiteLLM", "stacks": [ "python", "ai" ], "cveIds": [ "CVE-2026-42208" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-08", "closedAt": "2026-05-08", "updatedAt": "2026-05-08", "summary": "BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages. Added to CISA KEV on 2026-05-08." }, { "slug": "langflow-langflow-cve-2026-33017", "title": "Langflow Langflow: Langflow Code Injection Vulnerability", "url": "https://pwn.watch/i/langflow-langflow-cve-2026-33017", "json": "https://pwn.watch/i/langflow-langflow-cve-2026-33017.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Langflow Langflow", "stacks": [ "python", "ai" ], "cveIds": [ "CVE-2026-33017" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-03-25", "closedAt": "2026-03-25", "updatedAt": "2026-03-25", "summary": "Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication. Added to CISA KEV on 2026-03-25." } ], "changes": [ { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "LiteLLM root cause: attacker held three developer GitHub CLI tokens, likely scraped from logs of an internet-exposed internal LiteLLM deployment (Claude Code can echo a gh OAuth token into logged response bodies), disabled branch protection and ran the release workflow against lookalike repo Berri-AI/litellm.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "StepSecurity full teardown: payload exfiltrates to lookalike www.litellm.dev (registered Oct 13) and an hourly loader polls a GitHub dead drop (letters9813/pythonclient-test, now deleted). Infected hosts keep polling, so anyone re-registering that username could run code on them: kill the process holding /tmp/remote_code_loader.lock, delete cook.pth/cook.py/sitecustomize.py, pin 1.106.2 and rotate everything.", "body": null, "sourceUrl": "https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "opencode-mcp-oauth-rce-windows", "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "The Hacker News reports the flaw; upgrade to 1.18.33, run `opencode mcp list`, and remove unvetted remote MCP servers.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html", "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T11:39Z", "title": "Malicious 1.107.0 wheels appear on PyPI.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T11:39Z", "title": "Malicious litellm==1.107.0 (all seven wheels) live on PyPI 11:39-13:23 UTC; Docker tags v1.107.0/latest/main-latest/main-stable compromised 11:46-14:20 UTC.", "body": null, "sourceUrl": "https://docs.litellm.ai/blog/security-incident-oct-21-2026", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T13:23Z", "title": "PyPI quarantines/pulls the package (~2h window).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T14:20Z", "title": "Docker Hub tags cleaned / retargeted; GHCR images made unavailable earlier.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T16:20Z", "title": "Wiz sees stolen AWS instance-role credentials validated from 168.100.8.57 and 165.227.201.8 (sts:GetCallerIdentity, then Bedrock model listing), consistent with LLMjacking.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T20:30Z", "title": "LiteLLM posts containment update; investigation ongoing.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-20", "title": "Anthropic credit restoration still in progress; OpenCode says it will cover them itself if not done this week.", "body": null, "sourceUrl": "https://ctxsec.com/items/opencode-console-provider-key-breach-2026-10", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-19", "title": "LiteLLM temporarily expands release permissions for two internal engineers (daily bugfix backports).", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "opencode-mcp-oauth-rce-windows", "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-19", "title": "Pillar Security discloses the flaw publicly. Anomaly declined to request a CVE, saying user-configured MCP servers are outside its trust boundary.", "body": null, "sourceUrl": "https://x.com/Pillar_sec/status/2112166888985722937", "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-19", "title": "BleepingComputer and The Hacker News report unauthorized charges up to ~$1,700 and Google Cloud project suspensions; OpenAI says it refunded affected credits.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-console-breach-may-have.html", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-18", "title": "Dax says attackers have been 'non stop' attacking OpenCode's systems for 48 hours; systems being hardened.", "body": null, "sourceUrl": "https://x.com/thdxr/status/2111790511409258796", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-17T00:30Z", "title": "Earliest possible exposure of saved provider keys (per OpenCode's email to affected users).", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-console-breach-may-have.html", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-17", "title": "OpenCode emails affected users, then announces the breach on X, tied to a 'large scale distillation attack' affecting 1.4% of Console users.", "body": null, "sourceUrl": "https://x.com/opencode/status/2111519637049319818", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-17", "title": "Dax (OpenCode) clarifies only the hosted Console is affected; keys used locally with the OpenCode app never reach OpenCode. Anthropic and Google revoke/block exposed keys; refunds start.", "body": null, "sourceUrl": "https://x.com/thdxr/status/2111572618340188393", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "opencode-mcp-oauth-rce-windows", "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-09-28", "title": "OpenCode 1.18.33 ships the fix as a routine browser-launch refactor; release notes don't mention security.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html", "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows" }, { "incident": "berriai-litellm-cve-2026-59822", "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-02", "title": "CISA added CVE-2026-59822 to the KEV catalog (due 2026-09-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/berriai-litellm-cve-2026-59822" }, { "incident": "opencode-mcp-oauth-rce-windows", "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-08-29", "title": "Pillar Security privately reports the flaw to Anomaly.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html", "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows" }, { "incident": "mlflow-mlflow-cve-2026-64849", "incidentTitle": "MLflow MLflow: MLflow Server-Side Request Forgery Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-19", "title": "CISA added CVE-2026-64849 to the KEV catalog (due 2026-09-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/mlflow-mlflow-cve-2026-64849" }, { "incident": "ray-project-ray-cve-2025-62593", "incidentTitle": "Ray-Project Ray: Ray-Project Ray Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-17", "title": "CISA added CVE-2025-62593 to the KEV catalog (due 2026-08-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ray-project-ray-cve-2025-62593" }, { "incident": "ibm-langflow-cve-2026-9198", "incidentTitle": "IBM Langflow: IBM Langflow Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-04", "title": "CISA added CVE-2026-9198 to the KEV catalog (due 2026-08-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ibm-langflow-cve-2026-9198" }, { "incident": "langflow-langflow-cve-2026-0770", "incidentTitle": "Langflow Langflow: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-21", "title": "CISA added CVE-2026-0770 to the KEV catalog (due 2026-07-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2026-0770" }, { "incident": "langflow-langflow-cve-2026-55255", "incidentTitle": "Langflow Langflow: Langflow Authorization Bypass Through User-Controlled Key Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-07", "title": "CISA added CVE-2026-55255 to the KEV catalog (due 2026-07-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2026-55255" }, { "incident": "berriai-litellm-cve-2026-42271", "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-08", "title": "CISA added CVE-2026-42271, CVE-2026-48710 to the KEV catalog (due 2026-06-22).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42271" }, { "incident": "langflow-langflow-cve-2025-34291", "incidentTitle": "Langflow Langflow: Langflow Origin Validation Error Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-21", "title": "CISA added CVE-2025-34291 to the KEV catalog (due 2026-06-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2025-34291" }, { "incident": "berriai-litellm-cve-2026-42208", "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-08", "title": "CISA added CVE-2026-42208 to the KEV catalog (due 2026-05-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42208" }, { "incident": "langflow-langflow-cve-2026-33017", "incidentTitle": "Langflow Langflow: Langflow Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-25", "title": "CISA added CVE-2026-33017 to the KEV catalog (due 2026-04-08).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2026-33017" } ] }