# AI vulnerability database — Anomity Security Database

> Public CVEs and security advisories for AI agents, MCP servers, IDE extensions, agent skills and the packages they pull in — severity, CVSS, affected versions, and how to fix each one.

167 advisories, newest first. Canonical page: https://catalog.anomity.ai/vuln

| ID | Component | Severity | CVSS | Attack type | Published | URL |
| --- | --- | --- | --- | --- | --- | --- |
| trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace | anthropic.claude-code | critical |  | Supply chain compromise | 2026-10-30 | https://catalog.anomity.ai/vuln/trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace |
| load-mine-31-fake-qwen2-repositories-on-hugging-face-and-modelscope | Any machine that loaded one of the campaign's Hugging Face or ModelScope repositories with trust_remote_code enabled | high |  | Supply chain compromise | 2026-10-29 | https://catalog.anomity.ai/vuln/load-mine-31-fake-qwen2-repositories-on-hugging-face-and-modelscope |
| GHSA-53mr-w429-c597 | @modelcontextprotocol/server-filesystem | high | 7.7 | Authentication bypass, Server-side request forgery, Path traversal | 2026-10-25 | https://catalog.anomity.ai/vuln/ghsa-53mr-w429-c597 |
| CVE-2026-115726 | aider-chat | high | 8.5 | Remote code execution | 2026-10-23 | https://catalog.anomity.ai/vuln/cve-2026-115726 |
| CVE-2026-115419 | mem0ai | high | 8.1 | Other | 2026-10-23 | https://catalog.anomity.ai/vuln/cve-2026-115419 |
| CVE-2026-114090 | obsidian-tc | high | 7.6 | Remote code execution, Authentication bypass | 2026-10-23 | https://catalog.anomity.ai/vuln/cve-2026-114090 |
| GHSA-7xgj-8392-5q4r | fastmcp | medium | 6.8 | Authentication bypass | 2026-10-23 | https://catalog.anomity.ai/vuln/ghsa-7xgj-8392-5q4r |
| CVE-2026-114612 | litellm | critical | 9.9 | Remote code execution, Authentication bypass, Privilege escalation | 2026-10-22 | https://catalog.anomity.ai/vuln/cve-2026-114612 |
| forever-security-an-agents-md-planted-in-downloads-got-codex-to | Any coding agent that loads AGENTS.md | high |  | Prompt injection, Supply chain compromise | 2026-10-22 | https://catalog.anomity.ai/vuln/forever-security-an-agents-md-planted-in-downloads-got-codex-to |
| CVE-2026-111079 | Goose with the terminal integration enabled | high | 7.4 | Authentication bypass, Server-side request forgery, Information disclosure | 2026-10-22 | https://catalog.anomity.ai/vuln/cve-2026-111079 |
| CVE-2025-49596 | @modelcontextprotocol/inspector | critical | 9.6 | Remote code execution | 2026-10-21 | https://catalog.anomity.ai/vuln/cve-2025-49596 |
| litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook | litellm | critical |  | Supply chain compromise, Credential theft, Malware | 2026-10-21 | https://catalog.anomity.ai/vuln/litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook |
| beyondtrust-a-hidden-comment-on-a-github-issue-hijacked-the-copilot | GitHub Copilot coding agent | high |  | Prompt injection, Credential theft | 2026-10-21 | https://catalog.anomity.ai/vuln/beyondtrust-a-hidden-comment-on-a-github-issue-hijacked-the-copilot |
| microsoft-china-aligned-storm-0940-ran-the-artex-agentic-pen-test | Microsoft | high |  | Supply chain compromise | 2026-10-21 | https://catalog.anomity.ai/vuln/microsoft-china-aligned-storm-0940-ran-the-artex-agentic-pen-test |
| CVE-2026-35616 | Not a vulnerability in OpenCode or any AI tool. Victims were reached through unpatched FortiClient EMS | high |  | Other | 2026-10-20 | https://catalog.anomity.ai/vuln/cve-2026-35616 |
| openai-two-internal-gpt-6-coding-agents-weakened-misalignment | OpenAI internal deployments of GPT- | medium |  | Other | 2026-10-20 | https://catalog.anomity.ai/vuln/openai-two-internal-gpt-6-coding-agents-weakened-misalignment |
| CVE-2026-103091 | Google OSS Agent Mesh | critical | 9.3 | Authentication bypass, Server-side request forgery | 2026-10-19 | https://catalog.anomity.ai/vuln/cve-2026-103091 |
| opencode-console-breach-saved-openai-anthropic-and-google-provider-keys | OpenCode Console | high |  | Credential theft | 2026-10-17 | https://catalog.anomity.ai/vuln/opencode-console-breach-saved-openai-anthropic-and-google-provider-keys |
| CVE-2026-96620 | claude-agent-sdk | critical | 9.2 | Remote code execution | 2026-10-16 | https://catalog.anomity.ai/vuln/cve-2026-96620 |
| CVE-2026-32871 | fastmcp | critical |  | Remote code execution | 2026-10-16 | https://catalog.anomity.ai/vuln/cve-2026-32871 |
| CVE-2026-105740 | langflow | critical | 9.9 | Remote code execution | 2026-10-15 | https://catalog.anomity.ai/vuln/cve-2026-105740 |
| CVE-2026-57496 | netlicensing-mcp | high | 9.6 | Command injection, Authentication bypass, Path traversal | 2026-10-15 | https://catalog.anomity.ai/vuln/cve-2026-57496 |
| CVE-2026-111091 | JetBrains Junie CLI | high | 7.8 | Remote code execution | 2026-10-15 | https://catalog.anomity.ai/vuln/cve-2026-111091 |
| CVE-2026-109527 | @modelcontextprotocol/sdk | high | 7.7 | Authentication bypass, Information disclosure | 2026-10-15 | https://catalog.anomity.ai/vuln/cve-2026-109527 |
| symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot | Not a software vulnerability. The listed agents are not vulnerable | high |  | Credential theft, Malware | 2026-10-15 | https://catalog.anomity.ai/vuln/symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot |
| GHSA-rqfc-q7j9-5v59 | omnigent | critical | 9.9 | Authentication bypass, Sandbox escape | 2026-10-13 | https://catalog.anomity.ai/vuln/ghsa-rqfc-q7j9-5v59 |
| CVE-2026-103572 | Visual Studio | high | 8.8 | Remote code execution, Prompt injection | 2026-10-13 | https://catalog.anomity.ai/vuln/cve-2026-103572 |
| CVE-2026-110202 | @continuedev/cli | high | 8.8 | Command injection, Prompt injection | 2026-10-13 | https://catalog.anomity.ai/vuln/cve-2026-110202 |
| CVE-2026-88066 | @anthropic-ai/claude-code | high | 7.5 | Remote code execution, Path traversal, Data exfiltration | 2026-10-13 | https://catalog.anomity.ai/vuln/cve-2026-88066 |
| slugfest-npm-trusted-publishing-bound-packages-to-reclaimable-github | npm Trusted Publishing configurations | high |  | Supply chain compromise | 2026-10-13 | https://catalog.anomity.ai/vuln/slugfest-npm-trusted-publishing-bound-packages-to-reclaimable-github |
| CVE-2026-96893 | GitLab EE | high | 7.3 | Prompt injection | 2026-10-13 | https://catalog.anomity.ai/vuln/cve-2026-96893 |
| apex-accelerator-ref8801-a-fake-web3-accelerator-s-npm-coding-agent | npm @apexacc/cli and @apexacc/audit | high |  | Supply chain compromise, Malware | 2026-10-12 | https://catalog.anomity.ai/vuln/apex-accelerator-ref8801-a-fake-web3-accelerator-s-npm-coding-agent |
| CVE-2026-108592 | mini-swe-agent | high | 6 | Prompt injection | 2026-10-10 | https://catalog.anomity.ai/vuln/cve-2026-108592 |
| CVE-2026-107824 | x | critical | 9.3 | Remote code execution, Authentication bypass | 2026-10-09 | https://catalog.anomity.ai/vuln/cve-2026-107824 |
| tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm | tensorlake | critical |  | Supply chain compromise, Credential theft, Malware | 2026-10-08 | https://catalog.anomity.ai/vuln/tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm |
| ghostaction-returns-a-security-audit-yml-workflow-pushed-from | GitHub repositories into which a compromised maintainer account pushed security-audit.yml from | high |  | Supply chain compromise, Credential theft | 2026-10-08 | https://catalog.anomity.ai/vuln/ghostaction-returns-a-security-audit-yml-workflow-pushed-from |
| cryptographic-context-injection-an-encrypted-web-page-got-github | GitHub Copilot CLI in autopilot mode with a permissive model or Auto model routing. GitHub does not treat it as a vulnerability | medium |  | Prompt injection, Data exfiltration | 2026-10-06 | https://catalog.anomity.ai/vuln/cryptographic-context-injection-an-encrypted-web-page-got-github |
| CVE-2025-6514 | opencode-ai | critical | 9.8 | Remote code execution, Command injection | 2026-10-04 | https://catalog.anomity.ai/vuln/cve-2025-6514 |
| CVE-2026-104120 | mcp-server-fetch | medium | 4 | Prompt injection, Server-side request forgery | 2026-10-02 | https://catalog.anomity.ai/vuln/cve-2026-104120 |
| CVE-2026-102437 | reasonix | high | 3.1 | Remote code execution | 2026-10-02 | https://catalog.anomity.ai/vuln/cve-2026-102437 |
| CVE-2026-97662 | awslabs.security-agent-mcp-server | high | 8.2 | Other | 2026-10-01 | https://catalog.anomity.ai/vuln/cve-2026-97662 |
| manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction | Manus cloud agent | high |  | Remote code execution, Prompt injection, Credential theft | 2026-10-01 | https://catalog.anomity.ai/vuln/manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction |
| CVE-2026-102911 | @zosmaai/pi-llm-wiki | critical | 9.9 | Command injection | 2026-09-30 | https://catalog.anomity.ai/vuln/cve-2026-102911 |
| CVE-2026-104850 | @modelcontextprotocol/sdk | high | 7.5 | Credential theft | 2026-09-30 | https://catalog.anomity.ai/vuln/cve-2026-104850 |
| pixelleak-coding-agents-posted-13-000-internal-screenshots-to-public | Not a product CVE. Any coding agent with gh or git push access acting on a developer's personal GitHub credentials | high |  | Other | 2026-09-29 | https://catalog.anomity.ai/vuln/pixelleak-coding-agents-posted-13-000-internal-screenshots-to-public |
| CVE-2026-105697 | langflow | critical | 9.9 | Remote code execution, Command injection | 2026-09-28 | https://catalog.anomity.ai/vuln/cve-2026-105697 |
| CVE-2026-63127 | Python `mcp` | high | 8.2 | Credential theft | 2026-09-28 | https://catalog.anomity.ai/vuln/cve-2026-63127 |
| GHSA-wp6x-29qx-fpr7 | brig | high | 8.2 | Credential theft, Path traversal, Sandbox escape | 2026-09-26 | https://catalog.anomity.ai/vuln/ghsa-wp6x-29qx-fpr7 |
| claude-code-mods-function-hooks-preview-gives-plugin-and-skills-folder | Claude Code builds with the function-hooks preview enabled | medium |  | Other | 2026-09-25 | https://catalog.anomity.ai/vuln/claude-code-mods-function-hooks-preview-gives-plugin-and-skills-folder |
| GHSA-632h-h47v-g4x4 | OpenCode | high |  | Remote code execution, Supply chain compromise | 2026-09-24 | https://catalog.anomity.ai/vuln/ghsa-632h-h47v-g4x4 |
| pluto-operation-mcp-147-of-179-internet-facing-mcp-servers-accepted | Not a single-product CVE — operational exposure of remotely reachable MCP servers that skip authentication on tools/c | high |  | Authentication bypass | 2026-09-24 | https://catalog.anomity.ai/vuln/pluto-operation-mcp-147-of-179-internet-facing-mcp-servers-accepted |
| salesbleed-zero-click-data-exfiltration-from-salesforce-agentforce-via | Salesforce Agentforce | high |  | Prompt injection, Data exfiltration | 2026-09-24 | https://catalog.anomity.ai/vuln/salesbleed-zero-click-data-exfiltration-from-salesforce-agentforce-via |
| memtensor-compromise-poisoned-openclaw-memory-plugin-and-memoryos | @memtensor/memos-cloud-openclaw-plugin | critical |  | Supply chain compromise, Credential theft | 2026-09-23 | https://catalog.anomity.ai/vuln/memtensor-compromise-poisoned-openclaw-memory-plugin-and-memoryos |
| CVE-2026-77244 | mcp-atlassian | critical | 10 | Authentication bypass | 2026-09-22 | https://catalog.anomity.ai/vuln/cve-2026-77244 |
| a-repo-defined-claude-code-subagent-downgraded-its-own-security-review | Claude Code | medium |  | Other | 2026-09-22 | https://catalog.anomity.ai/vuln/a-repo-defined-claude-code-subagent-downgraded-its-own-security-review |
| mcp-server-discover-instructions-field-can-inject-before-the-first-tool | Any MCP client that places server `instructions` into trusted model context. Protocol concern tracked as MCP- | high |  | Prompt injection | 2026-09-18 | https://catalog.anomity.ai/vuln/mcp-server-discover-instructions-field-can-inject-before-the-first-tool |
| zcode-z-ai-silently-uploaded-encrypted-full-workspace-snapshots | ZCode desktop | high |  | Data exfiltration | 2026-09-18 | https://catalog.anomity.ai/vuln/zcode-z-ai-silently-uploaded-encrypted-full-workspace-snapshots |
| plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code | Claude Code | critical |  | Remote code execution, Supply chain compromise | 2026-09-17 | https://catalog.anomity.ai/vuln/plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code |
| GHSA-6fwv-3h4c-37j9 | github.com/obot-platform/obot | high | 8.1 | Other | 2026-09-17 | https://catalog.anomity.ai/vuln/ghsa-6fwv-3h4c-37j9 |
| CVE-2026-90999 | sentry-seer | critical | 9.8 | Remote code execution, Prompt injection | 2026-09-16 | https://catalog.anomity.ai/vuln/cve-2026-90999 |
| mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across | Not a single-product CVE — IR case study of a hijacked live coding-assistant session used as the execution path for Shai-Hulud. Any assistant that can recommend and trigger dependency inst | critical |  | Supply chain compromise, Credential theft, Malware | 2026-09-16 | https://catalog.anomity.ai/vuln/mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across |
| openai-codex-two-sandbox-escapes-apply-patch-overpatch-in-codex-cli-and | Codex CLI | high |  | Remote code execution, Privilege escalation, Sandbox escape | 2026-09-15 | https://catalog.anomity.ai/vuln/openai-codex-two-sandbox-escapes-apply-patch-overpatch-in-codex-cli-and |
| CVE-2026-87987 | mistral-vibe | critical | 10 | Remote code execution, Prompt injection | 2026-09-11 | https://catalog.anomity.ai/vuln/cve-2026-87987 |
| CVE-2026-59822 | litellm | critical |  | Credential theft | 2026-09-10 | https://catalog.anomity.ai/vuln/cve-2026-59822 |
| anthropic-september-2026-threat-report-fake-claude-code-installers-and | Not a product defect — distribution and credential-handling risk. Inst | high |  | Supply chain compromise, Credential theft | 2026-09-10 | https://catalog.anomity.ai/vuln/anthropic-september-2026-threat-report-fake-claude-code-installers-and |
| CVE-2026-88938 | knowns | high | 7.1 | Path traversal, Data exfiltration | 2026-09-10 | https://catalog.anomity.ai/vuln/cve-2026-88938 |
| CVE-2026-82533 | DeepSeek Harness | critical | 9.4 | Remote code execution, Authentication bypass, Sandbox escape | 2026-09-08 | https://catalog.anomity.ai/vuln/cve-2026-82533 |
| gen-digital-infostealers-callbackbeaver-amatera-remus-djinn-now-harvest | Not | high |  | Credential theft, Malware | 2026-09-08 | https://catalog.anomity.ai/vuln/gen-digital-infostealers-callbackbeaver-amatera-remus-djinn-now-harvest |
| shai-hulud-wave-c-payload-returns-after-111-days-including-feishu-docx | feishu-docx-mcp | critical |  | Supply chain compromise, Credential theft, Malware | 2026-09-07 | https://catalog.anomity.ai/vuln/shai-hulud-wave-c-payload-returns-after-111-days-including-feishu-docx |
| CVE-2026-19516 | mcp-grafana | critical | 9.1 | Credential theft, Authentication bypass, Server-side request forgery | 2026-09-02 | https://catalog.anomity.ai/vuln/cve-2026-19516 |
| deadbugz-an-mcp-server-that-behaves-for-exactly-three-tool-calls-then | No affected | critical |  | Supply chain compromise, Credential theft | 2026-09-02 | https://catalog.anomity.ai/vuln/deadbugz-an-mcp-server-that-behaves-for-exactly-three-tool-calls-then |
| vendor-documentation-told-the-agent-to-install-a-package-nobody-had | Not a product defect and no CVE: any agent that inst | high |  | Supply chain compromise | 2026-09-02 | https://catalog.anomity.ai/vuln/vendor-documentation-told-the-agent-to-install-a-package-nobody-had |
| CVE-2026-72718 | Eight findings across seven agents. Goose fixed | high | 7 | Remote code execution | 2026-09-01 | https://catalog.anomity.ai/vuln/cve-2026-72718 |
| owasp-publishes-the-2026-llm-top-10-and-an-agent-control-standard-for | Not applicable - guidance | low |  | Other | 2026-09-01 | https://catalog.anomity.ai/vuln/owasp-publishes-the-2026-llm-top-10-and-an-agent-control-standard-for |
| kiro-powers-a-steering-file-renders-your-local-files-into-a-markdown | Kiro IDE | high |  | Prompt injection, Data exfiltration | 2026-08-27 | https://catalog.anomity.ai/vuln/kiro-powers-a-steering-file-renders-your-local-files-into-a-markdown |
| CVE-2026-64849 | MLflow | critical | 9.3 | Server-side request forgery | 2026-08-18 | https://catalog.anomity.ai/vuln/cve-2026-64849 |
| CVE-2026-75130 | @upstash/context7-mcp | critical | 9 | Prompt injection | 2026-08-18 | https://catalog.anomity.ai/vuln/cve-2026-75130 |
| CVE-2026-24301 | Microsoft Copilot Personal | high |  | Prompt injection, Data exfiltration | 2026-08-18 | https://catalog.anomity.ai/vuln/cve-2026-24301 |
| claude-code-makes-auto-mode-the-default-permission-mode-for-paid-plans | Claude Code on Pro | medium |  | Other | 2026-08-14 | https://catalog.anomity.ai/vuln/claude-code-makes-auto-mode-the-default-permission-mode-for-paid-plans |
| the-model-is-the-malware-four-evaluation-agents-reached-real-production | Four Evaluation Agents Reached Real Production Systems | high |  | Supply chain compromise | 2026-08-13 | https://catalog.anomity.ai/vuln/the-model-is-the-malware-four-evaluation-agents-reached-real-production |
| CVE-2026-73498 | mcp-atlassian | high | 7.7 | Path traversal, Data exfiltration | 2026-08-12 | https://catalog.anomity.ai/vuln/cve-2026-73498 |
| ghostsplice-malicious-mcp-servers-split-one-instruction-across-two | Any MCP client that lets one tool's output reach another tool's arguments | high |  | Prompt injection, Data exfiltration | 2026-08-11 | https://catalog.anomity.ai/vuln/ghostsplice-malicious-mcp-servers-split-one-instruction-across-two |
| CVE-2025-68668 | n | critical |  | Remote code execution, Sandbox escape | 2026-08-10 | https://catalog.anomity.ai/vuln/cve-2025-68668 |
| ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the | No patchable | high |  | Prompt injection, Credential theft, Data exfiltration | 2026-08-10 | https://catalog.anomity.ai/vuln/ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the |
| shai-hulud-reaches-the-official-mcp-registry-shipping-poisoned-claude | MCP Registry entry "V.A.P.E" and five linked GitHub repositories | critical |  | Supply chain compromise, Credential theft, Malware | 2026-08-09 | https://catalog.anomity.ai/vuln/shai-hulud-reaches-the-official-mcp-registry-shipping-poisoned-claude |
| CVE-2026-12537 | Gemini CLI | critical | 10 | Remote code execution | 2026-08-07 | https://catalog.anomity.ai/vuln/cve-2026-12537 |
| CVE-2026-43631 | llama.cpp builds b | critical | 9.2 | Remote code execution | 2026-08-07 | https://catalog.anomity.ai/vuln/cve-2026-43631 |
| CVE-2026-54316 | Claude Code | high |  | Credential theft, Data exfiltration | 2026-08-07 | https://catalog.anomity.ai/vuln/cve-2026-54316 |
| rovoblast-one-link-makes-atlassian-rovo-exfiltrate-jira-and-confluence | Atlassian Rovo | high |  | Prompt injection, Data exfiltration | 2026-08-07 | https://catalog.anomity.ai/vuln/rovoblast-one-link-makes-atlassian-rovo-exfiltrate-jira-and-confluence |
| CVE-2026-18830 | Amazon Bedrock AgentCore | high |  | Privilege escalation | 2026-08-06 | https://catalog.anomity.ai/vuln/cve-2026-18830 |
| prompt-injection-is-not-the-bug-check-point-discloses-11-flaws-inside | LangChain | high |  | Remote code execution, Prompt injection | 2026-08-05 | https://catalog.anomity.ai/vuln/prompt-injection-is-not-the-bug-check-point-discloses-11-flaws-inside |
| chaindrop-opening-a-repository-is-enough-to-execute-attacker-code | Opening a Repository Is Enough to Execute Attacker Code | critical |  | Remote code execution, Supply chain compromise, Malware | 2026-08-04 | https://catalog.anomity.ai/vuln/chaindrop-opening-a-repository-is-enough-to-execute-attacker-code |
| keyv-cacheable-npm-worm-writes-auto-run-hooks-into-claude-settings-json | keyv and cacheable namespace releases published during the campaign | critical |  | Supply chain compromise, Credential theft, Malware | 2026-08-04 | https://catalog.anomity.ai/vuln/keyv-cacheable-npm-worm-writes-auto-run-hooks-into-claude-settings-json |
| claude-code-silently-patched-five-permission-and-hook-bypasses-across-2 | Claude Code | high |  | Privilege escalation, Sandbox escape | 2026-08-04 | https://catalog.anomity.ai/vuln/claude-code-silently-patched-five-permission-and-hook-bypasses-across-2 |
| open-vsx-removes-77-malicious-evil-twin-ide-extensions | Open VSX Removes 77 Malicious "Evil Twin" IDE Extensions | high |  | Supply chain compromise, Credential theft | 2026-08-04 | https://catalog.anomity.ai/vuln/open-vsx-removes-77-malicious-evil-twin-ide-extensions |
| CVE-2026-67357 | ArcadeDB | high | 7.7 | Credential theft, Privilege escalation | 2026-08-02 | https://catalog.anomity.ai/vuln/cve-2026-67357 |
| a-hole-in-every-one-one-malicious-agent-skill-defeats-all-eight-open | One Malicious Agent Skill Defeats All Eight Open-Source Skil | high |  | Prompt injection | 2026-07-30 | https://catalog.anomity.ai/vuln/a-hole-in-every-one-one-malicious-agent-skill-defeats-all-eight-open |
| CVE-2026-59726 | Unauthenticated | critical | 10 | Remote code execution, Privilege escalation | 2026-07-29 | https://catalog.anomity.ai/vuln/cve-2026-59726 |
| macsync-a-fake-claude-install-guide-hosted-on-claude-ai-delivers-a | A Fake Claude Install Guide Hosted on claude.ai Delivers a m | high |  | Credential theft | 2026-07-29 | https://catalog.anomity.ai/vuln/macsync-a-fake-claude-install-guide-hosted-on-claude-ai-delivers-a |
| CVE-2026-46331 | Claude Cowork with local execution on a host with a vulnerable kernel | high |  | Credential theft, Privilege escalation, Sandbox escape | 2026-07-23 | https://catalog.anomity.ai/vuln/cve-2026-46331 |
| a-hidden-pull-request-comment-turns-your-ai-reviewer-into-the-attacker | Azure DevOps MCP server | high |  | Prompt injection, Data exfiltration | 2026-07-22 | https://catalog.anomity.ai/vuln/a-hidden-pull-request-comment-turns-your-ai-reviewer-into-the-attacker |
| CVE-2026-48124 | Cursor, Codex CLI, Gemini CLI and Antigravity All Broke Out | critical |  | Remote code execution, Sandbox escape | 2026-07-20 | https://catalog.anomity.ai/vuln/cve-2026-48124 |
| CVE-2026-10591 | Kiro IDE | critical | 8.8 | Remote code execution, Prompt injection | 2026-07-20 | https://catalog.anomity.ai/vuln/cve-2026-10591 |
| agent-data-injection-tricks-ai-agents-into-misreading-tool-data | Agent Data Injection Tricks AI Agents into Misreading Tool D | medium |  | Prompt injection | 2026-07-16 | https://catalog.anomity.ai/vuln/agent-data-injection-tricks-ai-agents-into-misreading-tool-data |
| asyncapi-npm-packages-backdoored-with-miasma-malware-framework | @asyncapi/generator-helpers | critical |  | Supply chain compromise, Credential theft, Malware | 2026-07-15 | https://catalog.anomity.ai/vuln/asyncapi-npm-packages-backdoored-with-miasma-malware-framework |
| CVE-2025-54133 | Cursor | high |  | Remote code execution | 2026-07-15 | https://catalog.anomity.ai/vuln/cve-2025-54133 |
| CVE-2026-15643 | awslabs.healthlake-mcp-server | medium |  | Credential theft, Server-side request forgery | 2026-07-15 | https://catalog.anomity.ai/vuln/cve-2026-15643 |
| CVE-2026-50510 | GitHub Copilot plugin for JetBrains | high | 7.8 | Other | 2026-07-14 | https://catalog.anomity.ai/vuln/cve-2026-50510 |
| jscrambler-npm-package-hijacked-to-drop-ai-config-infostealer | jscrambler | critical |  | Supply chain compromise, Credential theft | 2026-07-11 | https://catalog.anomity.ai/vuln/jscrambler-npm-package-hijacked-to-drop-ai-config-infostealer |
| friendly-fire-claude-code-and-codex-driven-to-rce-from-untrusted-repos | Claude Code CLI | high |  | Remote code execution, Prompt injection | 2026-07-09 | https://catalog.anomity.ai/vuln/friendly-fire-claude-code-and-codex-driven-to-rce-from-untrusted-repos |
| ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf | Symlink Bypass Hits Claude Code, Cursor, Windsurf | high |  | Remote code execution, Path traversal, Sandbox escape | 2026-07-09 | https://catalog.anomity.ai/vuln/ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf |
| hallusquatting-weaponizes-ai-package-hallucinations-for-malware-delivery | HalluSquatting Weaponizes AI Package Hallucinations for Malw | high |  | Prompt injection, Supply chain compromise | 2026-07-08 | https://catalog.anomity.ai/vuln/hallusquatting-weaponizes-ai-package-hallucinations-for-malware-delivery |
| workflow-jailbreak-defeats-github-copilot-safety-guardrails | Workflow Jailbreak Defeats GitHub Copilot Safety Guardrails | medium |  | Other | 2026-07-08 | https://catalog.anomity.ai/vuln/workflow-jailbreak-defeats-github-copilot-safety-guardrails |
| gitlost-a-public-github-issue-makes-agentic-workflows-leak-private-repos | GitHub Agentic Workflows | high |  | Prompt injection, Information disclosure | 2026-07-06 | https://catalog.anomity.ai/vuln/gitlost-a-public-github-issue-makes-agentic-workflows-leak-private-repos |
| indirect-prompt-injection-observed-in-the-wild-ai-agents-paid-attackers | Any web-browsing agent able to transact | medium |  | Prompt injection | 2026-07-02 | https://catalog.anomity.ai/vuln/indirect-prompt-injection-observed-in-the-wild-ai-agents-paid-attackers |
| CVE-2026-50548 | Zero-Click | critical | 9.8 | Remote code execution, Prompt injection | 2026-07-01 | https://catalog.anomity.ai/vuln/cve-2026-50548 |
| CVE-2026-50143 | @apify/actors-mcp-server | high | 8.1 | Credential theft | 2026-07-01 | https://catalog.anomity.ai/vuln/cve-2026-50143 |
| phantom-squatting-attackers-register-the-domains-that-models-hallucinate | Attackers Register the Domains That Models Hallucinate | medium |  | Other | 2026-06-30 | https://catalog.anomity.ai/vuln/phantom-squatting-attackers-register-the-domains-that-models-hallucinate |
| CVE-2026-46406 | Claude Code | medium | 6.1 | Path traversal, Information disclosure | 2026-06-29 | https://catalog.anomity.ai/vuln/cve-2026-46406 |
| multiple-github-actions-npm-packages-compromised-teampcp-miasma-like | codfish/semantic-release-action | high |  | Supply chain compromise | 2026-06-25 | https://catalog.anomity.ai/vuln/multiple-github-actions-npm-packages-compromised-teampcp-miasma-like |
| agentjacking-public-sentry-dsn-hijacks-claude-code-cursor-codex-via-mcp | AI coding agents integrating a Sentry DSN / Sentry MCP | high |  | Prompt injection, Supply chain compromise | 2026-06-24 | https://catalog.anomity.ai/vuln/agentjacking-public-sentry-dsn-hijacks-claude-code-cursor-codex-via-mcp |
| CVE-2026-41947 | Dify | critical | 9.1 | Other | 2026-06-23 | https://catalog.anomity.ai/vuln/cve-2026-41947 |
| CVE-2026-49468 | litellm | critical |  | Authentication bypass | 2026-06-18 | https://catalog.anomity.ai/vuln/cve-2026-49468 |
| mastra-npm-packages-trojanized-via-maintainer-account-compromise | easy-day-js | high |  | Supply chain compromise, Malware | 2026-06-17 | https://catalog.anomity.ai/vuln/mastra-npm-packages-trojanized-via-maintainer-account-compromise |
| fifteen-jetbrains-marketplace-plugins-harvested-ai-provider-api-keys | Fifteen JetBrains Marketplace Plugins Harvested AI Provider | high |  | Supply chain compromise, Credential theft | 2026-06-16 | https://catalog.anomity.ai/vuln/fifteen-jetbrains-marketplace-plugins-harvested-ai-provider-api-keys |
| atomic-arch-aur-npm-supply-chain-compromise-atomic-lockfile | atomic-lockfile | high |  | Supply chain compromise, Credential theft | 2026-06-12 | https://catalog.anomity.ai/vuln/atomic-arch-aur-npm-supply-chain-compromise-atomic-lockfile |
| claude-code-github-action-prompt-injection-credential-theft-microsoft | Claude Code GitHub Action | high |  | Prompt injection, Credential theft | 2026-06-06 | https://catalog.anomity.ai/vuln/claude-code-github-action-prompt-injection-credential-theft-microsoft |
| teampcp-injects-malware-into-microsoft-linked-github-repositories | Azure / Azure-Samples / Microsoft GitHub repos touched | high |  | Supply chain compromise, Malware | 2026-06-05 | https://catalog.anomity.ai/vuln/teampcp-injects-malware-into-microsoft-linked-github-repositories |
| binding-gyp-supply-chain-attack-enables-npm-ci-cd-worm-propagation | binding.gyp Supply Chain Attack Enables npm CI/CD Worm Propa | high |  | Supply chain compromise, Malware | 2026-06-04 | https://catalog.anomity.ai/vuln/binding-gyp-supply-chain-attack-enables-npm-ci-cd-worm-propagation |
| github-repository-exfiltration-campaign-using-compromised-pats | Organizations with exposed/compromised classic GitHub PATs | high |  | Credential theft | 2026-06-03 | https://catalog.anomity.ai/vuln/github-repository-exfiltration-campaign-using-compromised-pats |
| CVE-2026-45618 | liquidjs | critical |  | Remote code execution | 2026-06-02 | https://catalog.anomity.ai/vuln/cve-2026-45618 |
| miasma-npm-worm-compromises-31-red-hat-cloud-services-packages-via-ci | @redhat-cloud-services | critical |  | Supply chain compromise, Credential theft, Malware | 2026-06-01 | https://catalog.anomity.ai/vuln/miasma-npm-worm-compromises-31-red-hat-cloud-services-packages-via-ci |
| trustfall-one-click-rce-via-claude-code-trust-dialog-regression | Claude Code | high |  | Remote code execution | 2026-06-01 | https://catalog.anomity.ai/vuln/trustfall-one-click-rce-via-claude-code-trust-dialog-regression |
| symjack-symlink-disguised-file-copy-tricks-ai-coding-agents-into-rce | Symlink-Disguised File Copy Tricks AI Coding Agents into | high |  | Remote code execution | 2026-05-26 | https://catalog.anomity.ai/vuln/symjack-symlink-disguised-file-copy-tricks-ai-coding-agents-into-rce |
| trapdoor-cross-ecosystem-supply-chain-attack-poisons-ai-assistant | Cross-Ecosystem Supply Chain Attack Poisons AI Assistant Con | critical |  | Prompt injection, Supply chain compromise, Credential theft | 2026-05-25 | https://catalog.anomity.ai/vuln/trapdoor-cross-ecosystem-supply-chain-attack-poisons-ai-assistant |
| three-typosquatted-ai-labs-sdk-pypi-packages-exfiltrate-developer | "AI Labs SDK" PyPI packages | high |  | Supply chain compromise | 2026-05-19 | https://catalog.anomity.ai/vuln/three-typosquatted-ai-labs-sdk-pypi-packages-exfiltrate-developer |
| nx-console-v18-95-0-malicious-vs-code-extension-harvests-claude-code | nrwl.angular-console | critical |  | Supply chain compromise, Credential theft | 2026-05-18 | https://catalog.anomity.ai/vuln/nx-console-v18-95-0-malicious-vs-code-extension-harvests-claude-code |
| CVE-2026-32211 | Azure MCP Server | critical | 9.1 | Authentication bypass | 2026-05-16 | https://catalog.anomity.ai/vuln/cve-2026-32211 |
| openai-confirms-security-breach-via-tanstack-npm-supply-chain-attack | Downstream of @tanstack/* npm packages compromised May | critical |  | Supply chain compromise, Credential theft | 2026-05-15 | https://catalog.anomity.ai/vuln/openai-confirms-security-breach-via-tanstack-npm-supply-chain-attack |
| three-mcp-database-server-flaws-hit-apache-doris-alibaba-rds-apache | Apache Doris MCP server | high |  | Prompt injection, Information disclosure | 2026-05-14 | https://catalog.anomity.ai/vuln/three-mcp-database-server-flaws-hit-apache-doris-alibaba-rds-apache |
| CVE-2026-35435 | Azure AI Foundry M | high | 8.6 | Privilege escalation | 2026-05-13 | https://catalog.anomity.ai/vuln/cve-2026-35435 |
| mistralai-pypi-package-v2-4-6-backdoored-with-credential-stealer | mistralai | critical |  | Supply chain compromise, Credential theft | 2026-05-12 | https://catalog.anomity.ai/vuln/mistralai-pypi-package-v2-4-6-backdoored-with-credential-stealer |
| mini-shai-hulud-170-npm-pypi-packages-compromised-in-coordinated | TanStack @tanstack/* | critical |  | Supply chain compromise, Credential theft, Malware | 2026-05-11 | https://catalog.anomity.ai/vuln/mini-shai-hulud-170-npm-pypi-packages-compromised-in-coordinated |
| CVE-2026-44338 | praisonai | critical |  | Authentication bypass | 2026-05-09 | https://catalog.anomity.ai/vuln/cve-2026-44338 |
| CVE-2026-33032 | nginx-ui | critical | 9.8 | Remote code execution, Authentication bypass | 2026-05-07 | https://catalog.anomity.ai/vuln/cve-2026-33032 |
| palo-alto-unit-42-double-agents-hijack-gcp-vertex-ai-agent-engine | GCP Vertex AI Agent Engine | high |  | Credential theft | 2026-05-06 | https://catalog.anomity.ai/vuln/palo-alto-unit-42-double-agents-hijack-gcp-vertex-ai-agent-engine |
| CVE-2026-44112 | OpenClaw | high |  | Privilege escalation | 2026-05-04 | https://catalog.anomity.ai/vuln/cve-2026-44112 |
| CVE-2026-40576 | excel-mcp-server | critical | 9.4 | Path traversal | 2026-04-23 | https://catalog.anomity.ai/vuln/cve-2026-40576 |
| checkmarx-supply-chain-compromise-malicious-vs-code-extensions-and | Checkmarx KICS Docker images | critical |  | Supply chain compromise, Credential theft | 2026-04-22 | https://catalog.anomity.ai/vuln/checkmarx-supply-chain-compromise-malicious-vs-code-extensions-and |
| self-propagating-npm-supply-chain-worm-targets-ai-agent-packages | Multiple Namastex Labs npm packages | critical |  | Supply chain compromise, Credential theft, Malware | 2026-04-22 | https://catalog.anomity.ai/vuln/self-propagating-npm-supply-chain-worm-targets-ai-agent-packages |
| google-patches-antigravity-ide-prompt-injection-sandbox-escape | Google Antigravity IDE | high |  | Remote code execution, Prompt injection, Sandbox escape | 2026-04-21 | https://catalog.anomity.ai/vuln/google-patches-antigravity-ide-prompt-injection-sandbox-escape |
| claude-desktop-silently-installs-browser-extension-bridges-privacy | Claude Desktop | high |  | Other | 2026-04-18 | https://catalog.anomity.ai/vuln/claude-desktop-silently-installs-browser-extension-bridges-privacy |
| comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to | Claude Code Security Review | critical | 9.4 | Prompt injection, Data exfiltration | 2026-04-16 | https://catalog.anomity.ai/vuln/comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to |
| anthropic-mcp-design-vulnerability-enables-rce-200k-servers-at-risk | MCP SDK | critical |  | Remote code execution, Supply chain compromise | 2026-04-15 | https://catalog.anomity.ai/vuln/anthropic-mcp-design-vulnerability-enables-rce-200k-servers-at-risk |
| malicious-ai-assistant-extensions-harvest-llm-chat-histories-from-vs | Multiple malicious VS Code extensions | high |  | Data exfiltration | 2026-04-03 | https://catalog.anomity.ai/vuln/malicious-ai-assistant-extensions-harvest-llm-chat-histories-from-vs |
| axios-npm-supply-chain-attack-north-korean-rat-via-ai-agent-auto-install | axios | critical |  | Supply chain compromise | 2026-04-01 | https://catalog.anomity.ai/vuln/axios-npm-supply-chain-attack-north-korean-rat-via-ai-agent-auto-install |
| CVE-2026-33579 | OpenClaw | critical | 9.8 | Privilege escalation | 2026-03-29 | https://catalog.anomity.ai/vuln/cve-2026-33579 |
| CVE-2026-25536 | @modelcontextprotocol/sdk | high |  | Information disclosure | 2026-03-18 | https://catalog.anomity.ai/vuln/cve-2026-25536 |
| CVE-2025-59536 | Claude Code | critical |  | Remote code execution | 2026-02-25 | https://catalog.anomity.ai/vuln/cve-2025-59536 |
| CVE-2026-21852 | Claude Code | high |  | Credential theft, Data exfiltration | 2026-02-25 | https://catalog.anomity.ai/vuln/cve-2026-21852 |
| clinejection-cline-v2-3-0-supply-chain-attack-via-github-issue-bot | Cline | critical |  | Prompt injection, Supply chain compromise | 2026-02-20 | https://catalog.anomity.ai/vuln/clinejection-cline-v2-3-0-supply-chain-attack-via-github-issue-bot |
| toxicskills-36-percent-of-audited-agent-skills-carried-security-flaws | 36 Percent of Audited Agent Skills Carried Security | high |  | Prompt injection, Supply chain compromise | 2026-02-05 | https://catalog.anomity.ai/vuln/toxicskills-36-percent-of-audited-agent-skills-carried-security-flaws |
| palo-alto-unit-42-mcp-sampling-prompt-injection-for-persistent-session | Any MCP host implementing sampling without sandbox | high |  | Prompt injection | 2026-02-01 | https://catalog.anomity.ai/vuln/palo-alto-unit-42-mcp-sampling-prompt-injection-for-persistent-session |
| vscode-fork-recommended-extension-namespace-squatting-supply-chain | Cursor | high |  | Supply chain compromise | 2026-01-22 | https://catalog.anomity.ai/vuln/vscode-fork-recommended-extension-namespace-squatting-supply-chain |
| CVE-2026-26118 | MarkItDown MCP server | critical |  | Server-side request forgery | 2026-01-20 | https://catalog.anomity.ai/vuln/cve-2026-26118 |
| CVE-2026-21520 | Copilot Studio | high |  | Prompt injection, Data exfiltration | 2026-01-17 | https://catalog.anomity.ai/vuln/cve-2026-21520 |
| a-marketplace-plugin-quietly-chose-where-claude-code-installed-your | Plugin "Python Dependency Helper" exposing the manage_python_dependencies skill | high |  | Supply chain compromise | 2026-01-05 | https://catalog.anomity.ai/vuln/a-marketplace-plugin-quietly-chose-where-claude-code-installed-your |

JSON: https://catalog.anomity.ai/api/entries?kind=vuln · Full dump: https://catalog.anomity.ai/llms-full.txt