Security
Vulnerabilities, advisories and incidents in AI tools, models and agents from the last 14 days, newest first. Check the linked advisory before acting; evidence shows how well each report is confirmed.
5 topics
-
Nov 10
GPUStack auth bypass grants unauthenticated admin (GHSA-gj9m-f8ph-pmhr)
A GitHub advisory says GPUStack before v2.2.0 treats requests from a loopback source as the built-in administrator when force_auth_localhost is False, the default.
-
Nov 10
Claude Code Edit tool race allows writes outside workspace (GHSA-5xjx-9qx6-jcrv)
GitHub published an advisory for a time-of-check to time-of-use race in the Claude Code Edit tool.
- GHSA-5xjx-9qx6-jcrv: Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspacegithub.com · GitHub Advisory · 17h ago
-
Nov 10
Fireworks AI breach exposes Notion AI chat sessions
Notion says a security incident at its vendor Fireworks AI may have exposed some Notion AI chat sessions.
- Fireworks AI security breach impacts Notion and their customersnotion.com · HN · 8h ago · 123 pts · 43 comments
- Fireworks AI Hackedbloomberg.com · HN · 18h ago · 13 pts · 4 comments
- Tell HN: Notion AI chat sessions have been exposed via Fireworks AI hacknews.ycombinator.com · HN · 10h ago · 14 pts · 1 comments
-
Nov 10
GPUStack authentication flaw CVE-2026-102895 exploited in the wild
CVE-2026-102895 is an improper authentication flaw in GPUStack, listed in CISA's known exploited vulnerabilities catalog.
- CVE-2026-102895: GPUStack Improper Authentication Vulnerability (actively exploited, CISA KEV)nvd.nist.gov · GitHub Advisory · Nov 9
-
Nov 10
Microsoft FORGE Lab finds Rust memory-safety bugs with agents
Microsoft's FORGE Lab published a post saying it uses agentic tools to find memory safety issues in Rust code.
- FORGE Lab uses agentic tools to identify memory safety issues in Rustmicrosoft.com · Microsoft · 19h ago