AINewsnow

17 CVEs across 12 AI agent frameworks — one disclosure wave, same three design failures.

This story is from 2026-10-20. It is preserved in the archive; the latest stories are on the live feed.

6× CVSS 9.8 unauthenticated RCE: Piflow: POST /chat → exec_shell, no auth Langchain-Chatchat: /tools/call invokes shell tool, no auth DB-GPT: mock auth grants everyone admin Letta: compose.yaml omits LETTA_SERVER_SECURE, all routes open Cognition: no auth on REST/SSE API (fixed: 0.13.0) 5× 8.8: app…

Read the full story at DEV Community — AI ↗

Timeline · 1 report

  1. 2026-10-20 11:27 · DEV Community — AI
    17 CVEs across 12 AI agent frameworks — one disclosure wave, same three design failures.

More stories

  1. US bans China's DeepSeek from government in race for AI dominance — BBC Technology
  2. DHS Orders DeepSeek Technology Removed From Federal Civilian IT Systems — Wall Street Journal Technology
  3. DeepSeek V4.1 Flash (1017) Now Leads Open-Weight Models — r/LocalLLaMA
  4. Welcome to Google Gemini 4 Argon — Towards Data Science
  5. Nscale, Anthropic in Talks for $45 Billion AI Computing Deal — Bloomberg AI
  6. DeepSeek open-sources DeepInfer, its internal production stack designed to accelerate inference, optimize chip performance, and reduce energy and compute costs — Techmeme
  7. Homebase Launches AI Assistant to Fill Shifts and Ease Hiring and Payroll — Unite.AI
  8. You need a better headshot. — OpenAI YouTube

Get the daily brief of stories like this at 6:30 every morning →