Findings
Published vulnerabilities where an AI-assisted change introduced the flaw, exposed the vulnerable path, or left a security fix incomplete. Open a finding to see its evidence, caveats, contributing change, and fix status.
284 findings
- Nodemailer's address parser appends each address part to one growing string. A Claude-co-authored change in 9.1.0 reads that string's last character before every append, which V8 can turn into a copy of the whole string, so comment-separated addresses parse in quadratic time. Mailparser feeds inbound headers here. Release 10.0.5 caches the last character.
HighCVE-2026-90776nodemailer/nodemailer
TypeScript
ClaudeDirect introductionResource abuse & availabilitySep 11, 2026 - When Nodemailer's address parser cannot read an address strictly, it scans the free text. A Claude-co-authored repair in 10.0.6 replaced the slow regular expression with a scanner whose two new probes still searched the rest of the value, so long headers could stall the event loop until 10.0.9 bounded them. Found by source analysis, not timing.
HighGHSA-V53P-9FQP-M79Jnodemailer/nodemailer
TypeScriptClaudeIncomplete remediationResource abuse & availabilitySep 11, 2026 - Claude-assisted browser gateway used an unanchored pattern to validate Chrome extension origins, so a crafted page could open the debugging WebSocket from any domain.
CVE-2026-55536mervinpraison/praisonai
PythonClaudeDirect introductionAuthentication & access controlAug 25, 2026 - AI-assisted scope hardening on the user-list route left ordinary sessions exempt from capability checks and relied on an administrator check that the existing service did not perform. The exposure predated that hardening. Other dashboard routes and the separate WebSocket log path also lack required role authorization, but those independent omissions are not attributed to this change. Version 4.5.1 adds an administrator check for user listing only. Dashboard and log-stream exposure remains in the inspected source revision; no complete advisory repair or binary equivalence is established.
CVE-2026-79665lin-snow/ech0
Go
CursorFlawed AI-written codeAuthentication & access controlAug 25, 2026 - PraisonAI added an agent-invocation route without enforcing the configured API key. The repair installs shared authentication middleware on the application.
HighCVE-2026-55538mervinpraison/praisonai
Python
AI-assisted; tool not identifiedFlawed AI-written codeAuthentication & access controlAug 25, 2026 - PraisonAI checked literal IP addresses without resolving ordinary hostnames before Spider requests. The repair checks DNS results for blocked addresses and rejects resolution failures.
HighCVE-2026-55526mervinpraison/praisonai
PythonClaudeDirect introductionSSRF & network boundariesAug 25, 2026 - Hardening of the FrameNet corpus reader tightened the checks on the names that are interpolated into XML file paths, but a corpus subdirectory can hold a symlink whose name passes those checks and points outside the corpus root, so the reader returns text from a file outside the corpus.
CVE-2026-62384nltk/nltk
PythonClaudeFlawed AI-written codePath & link handlingAug 22, 2026 - A CLI coding assistant co-authored the commit that added the transaction API, and its single-transaction endpoint fetched any record by primary key without company scoping or a permission check.
CVE-2026-77759roskus/prospero-flow-crm
PHPClaudeDirect introductionAuthentication & access controlAug 21, 2026 - AI-written code exposed a Management API that fail-open authenticated an empty token and passed user input to shell exec, enabling remote OS command injection.
MediumCVE-2026-76761chenhg5/cc-connect
GoClaudeNew attack surfaceInjection & unsafe executionAug 20, 2026 - AI-written webhook code treated an empty configured token as authenticated, then passed a caller-supplied command to a shell, enabling unauthenticated remote code execution.
MediumCVE-2026-76760chenhg5/cc-connect
GoClaudeDirect introductionInjection & unsafe executionAug 20, 2026 - An AI-assisted webhook request/test component adds response readback to an earlier outbound-request primitive. The shipped SQL-backed test path can cross the intended destination boundary when an admitted client can configure and test webhooks.
CriticalCVE-2026-64849mlflow/mlflow
PythonClaudeFlawed AI-written codeSSRF & network boundariesAug 17, 2026 - The AI-written code loads the first .so file matching a broad glob pattern without verifying integrity, enabling arbitrary code execution via a malicious module.
CriticalCVE-2026-74872jahlives/openssl_encrypt
PythonClaudeDirect introductionOther / insufficient public mechanism detailAug 17, 2026 - AI-written code interpolated a caller-controlled username into a shell command executed via execAsync, allowing command substitution and arbitrary OS command execution as the server user.
CVE-2026-55157ooples/token-optimizer-mcp
JavaScriptClaudeDirect introductionInjection & unsafe executionAug 14, 2026 - AI-written web server code exposed session log endpoints without authentication, letting unauthenticated users read files via path traversal.
MediumCVE-2026-55156ooples/token-optimizer-mcp
JavaScriptClaudeDirect introductionPath & link handlingAug 14, 2026 - The AI-assisted change that added the MCP server also added a markdown renderer for report text, and its link conversion writes the URL into an href attribute without escaping quotes, so a stored link can run script when a report is opened.
CVE-2026-19744ccyl13/pentestify
PythonClaudeDirect introductionInjection & unsafe executionAug 13, 2026 - An AI-assisted dictionary-redaction repair left deeply nested JSON lists behind the recursion cutoff, allowing sensitive-key values to appear unmasked in authorized Variable responses and the UI.
MediumCVE-2026-54183apache/airflow
PythonClaudeIncomplete remediationPath & link handlingAug 12, 2026 - A CLI coding assistant co-authored the commit that added the in-process TURN relay server, and its UDP receive loop was started fire and forget with the only exception handler outside the loop.
GHSA-PFVM-W89X-94JWsipsorcery-org/sipsorcery
C#ClaudeDirect introductionOther / insufficient public mechanism detailAug 12, 2026 - A coding assistant co-authored the commit that added follows and notifications to this Python web app, and the four new endpoints that change that state were exposed as plain GET routes, so any page could trigger them for a signed-in user.
CVE-2026-73162misp/cti-transmute
PythonClaudeDirect introductionAuthentication & access controlAug 11, 2026 - With the optional DeepStream stack installed, request-level video settings can activate GPU decoding without startup authorization and omit the normal metadata pixel check.
CVE-2026-78684vllm-project/vllm
PythonClaudeDirect introductionAuthentication & access controlAug 11, 2026 - A coding assistant co-authored the commit that added emoji reactions to the comment system of this Python web app, and the new reaction endpoint never checked whether the caller was allowed to see the comment it changed.
CVE-2026-73155misp/cti-transmute
PythonClaudeDirect introductionAuthentication & access controlAug 11, 2026