CVE-2026-0004

Transient Execution Vulnerability Leading to Cache‑Based Data Leakage

A transient execution vulnerability in some AMD processors may allow an attacker with the ability to execute code on the system to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-36357

kernel: transient execution vulnerability in some AMD processors

A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-36350

kernel: information leak via transient execution vulnerability in some AMD processors

A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126767

OpsTree REMS through 1.0.0 Prompt Injection via RCA Chat Assistant

OpsTree REMS through 1.0.0 contains a prompt injection vulnerability that allows authenticated users to disclose the hidden system prompt by submitting crafted chat input to POST /api/v1/rca/chat. Attackers can instruct the assistant to ignore its rules and reveal internal orchestration instructions, aiding the crafting of further prompt injection attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-18448

Leak SMM RAM from the kernel (Simply TSA after an SMI)

EDK2 contains a vulnerability in BIOS where a privileged attacker may cause “Exposure of Sensitive Information during Transient Execution” by local access. Successful exploitation of this vulnerability may result in disclosure of SMRAM contents. It could also impact Confidentiality.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-123653

esengine DeepSeek-Reasonix doc.go discoverDocs llm prompting input

A security vulnerability has been detected in esengine DeepSeek-Reasonix up to 2.52.0. Affected is the function discoverDocs of the file internal/memory/doc.go. The manipulation leads to improper neutralization of input used for llm prompting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.53.0 is able to address this issue. The identifier of the patch is 4ca33493a673c2788aa8598fbca2b2f47a69e1b8. It is suggested to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Esengine

Products

Deepseek-reasonix

CVE-2026-106020

LLM Prompting Input Neutralization Failure Leading to Search Order Hijacking

Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking. This issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Johnsoncontrols

Products

Easyio Neo Io Manager And Tools Installer

CVE-2026-54140

OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitization

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context without neutralizing instructions or bounding the descriptive fields. The McpRemoteTool records produced by list_tools preserve this remote content, while tool filtering considers the tool name and the prompt-injection detector screens user messages rather than MCP definitions. A malicious or compromised MCP server can therefore return a poisoned description that is evaluated on every agent turn and may direct the model to invoke other available tools, disclose accessible data, or perform unauthorized actions without a separate malicious user message. The issue affects users who configure an attacker-controlled or compromised MCP server. This issue is fixed in version 0.57.13.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Tinyhumansai

Products

Openhuman

CVE-2026-123498

Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata

Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft ProjectTitle or task descriptions that the prime hook loads on SessionStart and PreCompact, causing the agent to modify the developer's checkout or run commands.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Vikunja

Products

Vikunja

CVE-2026-102344

Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server

Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Kunchenguid

Products

Lavish-axi

CVE-2026-120422

Insecure HTTP configuration retrieval in Sogou Input Method allows arbitrary code execution

Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network traffic to replace legitimate server responses with malicious configurations. An attacker can exploit this vulnerability to instruct SGTool.exe to download attacker-controlled files to arbitrary locations, including paths used by legitimate application components. This can result in arbitrary code execution when the downloaded files are subsequently executed or loaded by the application.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

Sogou

Products

Sogou Input Method

CVE-2026-54142

OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approval

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, background synchronization for connected services such as email, Slack, and Notion stores raw external content and later places it in the model context of autonomous background agents without neutralizing embedded instructions. ApprovalGate treats tool calls without an interactive chat context as pre-authorized automation, so attacker-authored content processed during a background tick can influence the model to invoke Composio actions without presenting an approval request. An attacker who can deliver content to a connected account can use this path to send or forward data, post messages, create or modify third-party content, or disclose information from OpenHuman memory and integrations. The issue requires an active integration and successful model interpretation of the injected instructions. This issue is fixed in version 0.57.13.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tinyhumansai

Products

Openhuman

CVE-2026-115415

Secret masking bypass in the environment tool in Strands Agents Tools

Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's secret masking. To remediate this issue, users should upgrade to version 0.8.6 or later and rotate any credentials that were present in the environment of agents that loaded the environment tool.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Amazon

Products

Strands-agents-tools

CVE-2026-110970

Lack of traffic encryption in Płatnik

Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 334 in version 10.02.002.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Zak Ad Ubezpiecze Spo Ecznych Zakład Ubezpieczeń Społecznych

Products

P Atnik Płatnik

CVE-2026-77931

MoviePilot 3.1.5 Command Injection via ExecuteCommandTool

MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_dangerous set to true, bypassing the validate_command_safety denylist and exploiting the admin session's is_admin context to achieve remote code execution on the host.

CVSS 4.0 · 8.7 High EPSS 1.0% KEV · Not listed

Vendors

Jxxghp

Products

Moviepilot

CVE-2026-109440

LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ginlix-ai

Products

Langalpha

CVE-2026-75130

Context7 2.1.2 Prompt Injection via Custom AI Instructions

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can poison the custom instructions to exfiltrate credentials from environment files to an attacker-controlled service and perform destructive file deletion on the victim's machine when the agent makes a routine library documentation request.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Uptash

Products

Context7

CVE-2026-114107

HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hkuds

Products

Vibe-trading

CVE-2024-28956

microcode_ctl: From CVEorg collector

Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2026-96893

Improper Neutralization of Input Used for LLM Prompting in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements in AI conversation context construction.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Gitlab

Products

Gitlab