cve

A spike in high- and critical-severity CVE disclosures followed Anthropic's release of Claude Mythos Preview, which can autonomously discover software vulnerabilities, leading to a 3.5x increase in monthly records.

A practical solution using AnySearch to enable local AI agents to efficiently query multiple specialized sources (CVEs, SEC filings) and return structured JSON/Markdown, avoiding rate limits and broken SDKs.

AutoCVE is an open-source tool that uses multi-agent collaboration to automatically complete the entire process from project screening, code audit, vulnerability verification to generating CVE reports, supporting one-click CVE vulnerability mining.

A single vulnerability in Chrome's V8 JIT compiler, CVE-2026-6307, allows attackers to gain arbitrary read/write primitives within the V8 sandbox and escape it to achieve remote code execution, affecting Chrome versions since 106.

AISLE discovered 6 new CVEs in curl, including the oldest vulnerability ever reported (over 25 years old), using its model-agnostic AI system. All findings were fixed in curl 8.21.0.

CVE-2026-42530 discloses a use-after-free vulnerability in nginx's HTTP/3 QUIC module.

An analysis of how memory safety CVEs are reported differently in Rust vs C/C++, arguing that Rust's design reduces certain classes of vulnerabilities even when bugs exist.

CVE-2026-52884 describes a zero-click remote code execution vulnerability in Notepad++ via path traversal, affecting users on Windows.

A heap use-after-free vulnerability has been reported in the OpenSSL PKCS7_verify() function, potentially allowing attackers to exploit memory corruption.

A single faulty character in the Linux kernel introduced a use-after-free vulnerability (CVE-2026-53111) allowing unprivileged users to escalate privileges to root on Debian and Ubuntu systems; the bug has been fixed and backported.

Marcelo Trylesinski shares his perspective on CVE-2026-48710, a security vulnerability in Starlette involving path-based authorization bypass via manipulated Host headers. He argues the vulnerability stems from application patterns and deployment, not the framework itself.

A critical host-header authentication bypass vulnerability (CVE-2026-48710) in Starlette and FastAPI affects many Python ASGI applications, including AI inference servers (e.g., vLLM), AI proxy servers (e.g., LiteLLM), and MCP gateways, potentially allowing unauthorized access.

A critical vulnerability (CVE-2026-48710, named BadHost) in the open-source ASGI framework Starlette exposes millions of AI agents and servers to potential data theft and credential compromise, affecting frameworks like FastAPI, vLLM, and LiteLLM. Patched in Starlette 1.0.1, the flaw is trivial to exploit and underscores risks in the AI tooling ecosystem.

Apple released security updates for macOS Tahoe 26.5 addressing multiple vulnerabilities including kernel bugs, denial-of-service, and sandbox escapes. The update includes fixes for CVEs discovered by various researchers, one of which (CVE-2026-28952) was reportedly found by Claude AI.

The article introduces the Agent Vulnerability Enumeration (AVE) record as a new standard designed to address the inadequacies of CVE for AI agent vulnerabilities, covering scoring, detection, and standardization challenges specific to agentic AI.

A security researcher discovered CVE-2026-46529, a 10-year-old remote code execution vulnerability in Linux PDF viewers XReader, Evince, and Atril, caused by insufficient argument quoting when spawning child processes to open remote document links.

Qualys discloses a logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333), allowing local privilege escalation and information disclosure. The vulnerability, present since 2016, affects multiple distributions with four proof-of-concept exploits developed by Qualys.

CVE-2026-40369 describes a vulnerability in Windows kernel's NtQuerySystemInformation function that allows arbitrary kernel address increment, enabling privilege escalation from unprivileged processes including Chrome sandbox. The exploit is deterministic on Windows 11 24H2-25H2.

PostgreSQL has released security updates for versions 18.4, 17.10, 16.14, 15.18, and 14.23, fixing 11 CVEs and over 60 bugs. Notable fixes include CVE-2026-6473 (integer wraparound, CVSS 8.8) and CVE-2026-6475 (symlink overwrite, CVSS 8.8).

A critical heap buffer overflow vulnerability in Nginx's rewrite module (CVE-2026-42945) allows unauthenticated remote code execution, with a proof-of-concept exploit released. The bug affects Nginx versions from 0.6.27 to 1.30.0 and various Nginx Plus releases.