Tag archive

Cve 2026 42271

Coverage tagged cve 2026 42271.

Data graphic: A giant red "141" marks the exploited vulnerabilities Google's threat intelligence group recorded from January to August 2026, against 127 for all of 2025. Below it are the fixed versions for the two exploited AI-stack flaws, LiteLLM 1.83.7 CVE-2026-42271 and Langflow 1.9.0 CVE-2026-5027 .

Cve 2026 42271 AI Security

Google GTIG Counts 141 Exploited Flaws in 8 Months; Patch LiteLLM and Langflow First

Google's GTIG logged 141 exploited flaws in Jan–Aug 2026, more than all of 2025, and lists LiteLLM CVE-2026-42271 and Langflow CVE-2026-5027 as exploited.

Related desks

AI Security

Latest

Oct 3, 2026, 5:45 AM EDT · AI Security · Cve 2026 422718 minGoogle GTIG Counts 141 Exploited Flaws in 8 Months; Patch LiteLLM and Langflow First

Google's GTIG logged 141 exploited flaws in Jan–Aug 2026, more than all of 2025, and lists LiteLLM CVE-2026-42271 and Langflow CVE-2026-5027 as exploited.

Oct 3, 2026, 3:11 AM EDT · AI Security · Cve 2026 1033956 minLightLLM Visual Nodes Expose Unauthenticated Pickle RCE (CVE-2026-103395), With No Fix Yet

LightLLM through 1.2.0 runs an unauthenticated, pickle-enabled RPyC service on visual_only nodes. Anyone who can reach the port can run code, and no fix exists yet.

Oct 2, 2026, 5:20 PM EDT · AI Security · Cve 2026 909707 minGitLab AI Gateway Flaw CVE-2026-90970 Lets Duo Agent Users Run Commands on Self-Hosted Gateways

GitLab fixed a CVSS 9.9 prompt-template sandbox escape in its AI Gateway. Self-hosted gateways must move to 19.2.4, 19.3.2 or 19.4.1.

Oct 2, 2026, 5:02 PM EDT · AI Security · Cve 2026 1037585 minObot MCP Gateway Flaw CVE-2026-103758 Lets Basic Users Reach Restricted MCP Servers

Obot 0.21.1–0.24.1 skips its ACR check on the composite MCP route, so any signed-in user can reach restricted servers. Obot says v0.25.0 fixes it.