Skip to content

VSRVibe Security Radar

Findings Trends How we verify

Loading case details…

Vibe Security Radar

A mechanism-level study of vulnerabilities contributed by AI-written code. Each finding connects an advisory to the relevant change, residual vulnerability, and security fix.

Sources: first-party security advisories · public Git history · release artifacts

Data through Sep 26, 2026

By AI tool

Claude
GitHub Copilot
Cursor
ChatGPT/Codex

By root cause

Authentication & access control
Injection & unsafe execution
SSRF & network boundaries
Path & link handling
Validation & fail-open logic
Resource abuse & availability

Project

GitHub Data (CSV)Atom feed Contact

Findings

Published vulnerabilities where an AI-assisted change introduced the flaw, exposed the vulnerable path, or left a security fix incomplete. Open a finding to see its evidence, caveats, contributing change, and fix status.

AI tool

AI contribution

Severity

Root cause

Language

Search/

AI toolAI contributionSeverityRoot causeLanguage

310 findings

RepositoryAdvisory monthCSVSort

Codex- and OpenCode-assisted changes in Vitest 5 replaced Vite's default file deny list with a token-only list, so a running UI, API or Browser Mode server could serve .env files, keys and .git contents.
CVE-2026-112948Oct 21, 2026vitest-dev/vitestTypeScriptChatGPT/CodexDirect introductionOther or unclear
A Claude Code change added a local MCP tool that opened any absolute path, so a local client could probe which files exist and read handler names from them.
CVE-2026-113731Oct 21, 2026djust-org/djustPythonClaudeDirect introductionPath & link handling
The MCP TypeScript SDK followed redirects to any origin; a Claude Code change also attached transport custom headers to OAuth requests, so a redirecting authorization server could leak API keys.
CVE-2026-111769Oct 20, 2026modelcontextprotocol/typescript-sdkTypeScriptClaudeFlawed AI-written codeSSRF & network boundaries
A2A Java let any caller read other callers' tasks; a Claude-co-authored change added task authorization only as an opt-in, so the default setup stayed open until 1.3.0.Final.
CVE-2026-111764Oct 20, 2026a2aproject/a2a-javaJavaClaudeFlawed AI-written codeAuthentication & access control
A Claude-assisted change ran the C preprocessor over Fortran files in indexed trees, and preprocessor includes pulled other files from the host into the generated graph.
GHSA-PCC4-RVHR-2PR8Oct 19, 2026Graphify-Labs/graphifyPythonClaudeDirect introductionPath & link handling
A Claude-assisted change added a table view whose message listener accepted data from any origin, so a page embedding it could spoof what the view showed and disturb its startup handshake.
CVE-2026-76894Oct 16, 2026ondata/ckan-mcp-serverTypeScriptClaudeDirect introductionValidation & fail-open logic
Leantime's JSON-RPC exposed API-key creation without authorization; a Claude-co-authored refactor added the createApiKeyWithProjects method the advisory names, letting any logged-in user mint an admin key.
CVE-2026-85990Oct 15, 2026Leantime/leantimePHPClaudeFlawed AI-written codeAuthentication & access control
Claude-co-authored changes stopped requiring items on OpenAPI 3.1 arrays and made that the default, so requests reached human-written decoders that crash when the items schema is missing.
CVE-2026-97394Oct 15, 2026getkin/kin-openapiGoClaudeFlawed AI-written codeValidation & fail-open logic
A Claude-co-authored change turned on JSON Schema 2020-12 validation by default for OpenAPI 3.1 requests, routing them through a human-written path that skipped the NaN/Inf guard and crashed.
CVE-2026-100352Oct 15, 2026getkin/kin-openapiGoClaudeFlawed AI-written codeValidation & fail-open logic
Claude-co-authored changes let OpenAPI 3.1 arrays without items pass validation, so query, deepObject and urlencoded requests reached human-written decoders that crash, until 0.149.0.
CVE-2026-100353Oct 15, 2026getkin/kin-openapiGoClaudeFlawed AI-written codeInjection & unsafe execution
WPF sent default Windows credentials to any host; a Copilot-co-authored mitigation limited them to trusted zones but cached its private-address DNS answer, so DNS rebinding could still capture NTLM or Kerberos credentials.
CVE-2026-96234Oct 13, 2026dotnet/wpfC#GitHub CopilotFlawed AI-written codeSSRF & network boundaries
TinaCMS's markdown web component set link and image URLs without a scheme check; a Claude-co-authored XSS hardening sanitized raw HTML but deliberately left those URL sinks, which shipped in 0.2.0.
CVE-2026-108260Oct 9, 2026tinacms/tinacmsTypeScriptClaudeFlawed AI-written codeInjection & unsafe execution
A Claude-co-authored change to node authentication stored each request body on disk before checking its signature, so unauthenticated clients could fill temporary storage.
CVE-2026-107805Oct 9, 20260xJacky/nginx-uiGoClaudeFlawed AI-written codeResource abuse & availability
A change committed through Vikunja's LLM-assisted bot let an inherited admin grant override a lower permission on a child project, so restricted users kept admin access in 2.6.0.
GHSA-PJR3-86V4-5P7WOct 9, 2026go-vikunja/vikunjaGoUnidentified AI toolDirect introductionAuthentication & access control
Coraza read a decoy multipart filename when filename* used an uncommon charset; Claude-co-authored 3.8.0 fixes checked continuations only when no plain filename* was present.
GHSA-3WR7-993Q-JRFFOct 8, 2026corazawaf/corazaGoClaudeFlawed AI-written codeOther or unclear
Coraza's JSON flattening let colliding keys hide a nested value from WAF rules; a Claude-assisted 3.8.0 fix closed dotted-name collisions but left case-variant collisions open until 3.8.1.
GHSA-5GJ4-9GM7-2FX2Oct 8, 2026corazawaf/corazaGoClaudeFlawed AI-written codeOther or unclear
A human fix had stopped deeply nested JSON from crashing Coraza; Claude-co-authored 3.8.0 hardening added early returns that skipped the depth check, so one request could crash the process again.
CVE-2026-107826Oct 8, 2026corazawaf/corazaGoClaudeFlawed AI-written codeResource abuse & availability
A Claude-assisted change to the MP4 sample-description parser let a zero-size entry stop the cursor from advancing, so a crafted file locks the Node.js event loop while memory grows.
CVE-2026-107391Oct 8, 2026Borewit/music-metadataTypeScriptClaudeDirect introductionResource abuse & availability
Coraza mis-split cookies with control bytes; a Claude-co-authored 3.8.0 fix trimmed them but dropped cookies whose name was only control bytes, letting a client hide a cookie value from rules.
GHSA-G4QM-M288-5CP9Oct 8, 2026corazawaf/corazaGoClaudeFlawed AI-written codeOther or unclear
Coraza skipped body parsing for unusual Content-Type values; a Claude-co-authored 3.8.0 fix handled parameters but not duplicate headers or leading whitespace, which hid form fields until 3.8.1.
GHSA-W253-M66G-RX24Oct 8, 2026corazawaf/corazaGoClaudeFlawed AI-written codeOther or unclear

Page 1 of 16

Page 1 of 16
…