Verno Index

Known vulnerabilities in AI agents, MCP servers and agent tooling that attackers can use today. Every entry has a public proof of concept and a Critical or High CVSS score, and is mapped to the Verno Labs attack taxonomy.

305 entries, updated Oct 21, 2026
Last 12 weeks

New entries per week

Total CVEs by publication date. Hover or tap the chart to see the attack-class breakdown.

Week of Aug 3: 27 CVEs; Week of Aug 10: 8 CVEs; Week of Aug 17: 7 CVEs; Week of Aug 24: 26 CVEs; Week of Aug 31: 1 CVEs; Week of Sep 7: 5 CVEs; Week of Sep 14: 23 CVEs; Week of Sep 21: 21 CVEs; Week of Sep 28: 5 CVEs; Week of Oct 5: 6 CVEs; Week of Oct 12: 13 CVEs; Week of Oct 19: 9 CVEs010203040Aug 3Aug 10Aug 17Aug 24Aug 31Sep 7Sep 14Sep 21Sep 28Oct 5Oct 12Oct 199

Vulnerabilities

Showing 20 of 305 entries
CVEVulnerabilityDetails
HighCVE-2026-109440
LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode (CVE-2026-109440)
Indirect / Cross-Domain Prompt Injection
Oct 20, 2026
8.1
0.43%
CriticalCVE-2026-109442
piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell (CVE-2026-109442)
Tool, Function-Call & MCP Abuse
Oct 20, 2026
9.8
0.69%
HighCVE-2026-109444
OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection (CVE-2026-109444)
Direct Prompt Injection & Instruction HijackingExcessive Agency & Action Exploitation
Oct 20, 2026
8.8
0.45%
CriticalCVE-2026-75128
Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint (CVE-2026-75128)
Tool, Function-Call & MCP Abuse
Oct 20, 2026
9.8
0.52%
HighCVE-2026-77926
Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool (CVE-2026-77926)
Tool, Function-Call & MCP Abuse
Oct 20, 2026
8.8
0.7%
HighCVE-2026-77934
Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner (CVE-2026-77934)
General (no AC class applies)
Oct 20, 2026
8.8
0.55%
HighCVE-2026-77935
Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers (CVE-2026-77935)
General (no AC class applies)
Oct 20, 2026
8.3
0.34%
CriticalCVE-2026-77936
Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access (CVE-2026-77936)
General (no AC class applies)
Oct 20, 2026
9.8
0.47%
HighCVE-2026-77937
Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header (CVE-2026-77937)
Identity, Impersonation & Human Manipulation
Oct 20, 2026
8.1
0.4%
HighCVE-2026-88755
CVE-2026-88755: Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared…
Tool, Function-Call & MCP Abuse
Oct 16, 2026
7.8
0.21%
HighCVE-2026-110202
Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping (CVE-2026-110202)
Excessive Agency & Action ExploitationIndirect / Cross-Domain Prompt Injection
Oct 13, 2026
8.8
0.35%
HighCVE-2026-110203
Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization (CVE-2026-110203)
Excessive Agency & Action ExploitationIndirect / Cross-Domain Prompt Injection
Oct 13, 2026
8.8
0.47%
HighCVE-2026-110204
Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution (CVE-2026-110204)
Excessive Agency & Action ExploitationIndirect / Cross-Domain Prompt Injection
Oct 13, 2026
8.8
0.51%
HighCVE-2026-110205
Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution (CVE-2026-110205)
Excessive Agency & Action ExploitationIndirect / Cross-Domain Prompt Injection
Oct 13, 2026
8.8
0.47%
HighCVE-2026-110206
Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position (CVE-2026-110206)
Excessive Agency & Action ExploitationIndirect / Cross-Domain Prompt Injection
Oct 13, 2026
8.8
0.47%
HighCVE-2026-84312
Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
General (no AC class applies)
Oct 12, 2026
7.1
0.18%
HighCVE-2026-84313
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
Identity, Impersonation & Human Manipulation
Oct 12, 2026
8.8
0.43%
HighCVE-2026-84316
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
Tool, Function-Call & MCP Abuse
Oct 12, 2026
8.8
0.4%
HighCVE-2026-84317
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
Tool, Function-Call & MCP AbuseDirect Prompt Injection & Instruction Hijacking
Oct 12, 2026
8.8
0.38%
HighCVE-2026-84318
Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
Tool, Function-Call & MCP Abuse
Oct 12, 2026
8.8
0.62%
HighCVE-2026-109440
LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode (CVE-2026-109440)
Indirect / Cross-Domain Prompt Injection
Published Oct 20, 2026 · CVSS 8.1 · EPSS 0.43%
CriticalCVE-2026-109442
piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell (CVE-2026-109442)
Tool, Function-Call & MCP Abuse
Published Oct 20, 2026 · CVSS 9.8 · EPSS 0.69%
HighCVE-2026-109444
OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection (CVE-2026-109444)
Direct Prompt Injection & Instruction HijackingExcessive Agency & Action Exploitation
Published Oct 20, 2026 · CVSS 8.8 · EPSS 0.45%
CriticalCVE-2026-75128
Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint (CVE-2026-75128)
Tool, Function-Call & MCP Abuse
Published Oct 20, 2026 · CVSS 9.8 · EPSS 0.52%
HighCVE-2026-77926
Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool (CVE-2026-77926)
Tool, Function-Call & MCP Abuse
Published Oct 20, 2026 · CVSS 8.8 · EPSS 0.7%
HighCVE-2026-77934
Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner (CVE-2026-77934)
General (no AC class applies)
Published Oct 20, 2026 · CVSS 8.8 · EPSS 0.55%
HighCVE-2026-77935
Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers (CVE-2026-77935)
General (no AC class applies)
Published Oct 20, 2026 · CVSS 8.3 · EPSS 0.34%
CriticalCVE-2026-77936
Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access (CVE-2026-77936)
General (no AC class applies)
Published Oct 20, 2026 · CVSS 9.8 · EPSS 0.47%
HighCVE-2026-77937
Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header (CVE-2026-77937)
Identity, Impersonation & Human Manipulation
Published Oct 20, 2026 · CVSS 8.1 · EPSS 0.4%
HighCVE-2026-88755
CVE-2026-88755: Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared…
Tool, Function-Call & MCP Abuse
Published Oct 16, 2026 · CVSS 7.8 · EPSS 0.21%
HighCVE-2026-110202
Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping (CVE-2026-110202)
Excessive Agency & Action ExploitationIndirect / Cross-Domain Prompt Injection
Published Oct 13, 2026 · CVSS 8.8 · EPSS 0.35%
HighCVE-2026-110203
Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization (CVE-2026-110203)
Excessive Agency & Action ExploitationIndirect / Cross-Domain Prompt Injection
Published Oct 13, 2026 · CVSS 8.8 · EPSS 0.47%
HighCVE-2026-110204
Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution (CVE-2026-110204)
Excessive Agency & Action ExploitationIndirect / Cross-Domain Prompt Injection
Published Oct 13, 2026 · CVSS 8.8 · EPSS 0.51%
HighCVE-2026-110205
Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution (CVE-2026-110205)
Excessive Agency & Action ExploitationIndirect / Cross-Domain Prompt Injection
Published Oct 13, 2026 · CVSS 8.8 · EPSS 0.47%
HighCVE-2026-110206
Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position (CVE-2026-110206)
Excessive Agency & Action ExploitationIndirect / Cross-Domain Prompt Injection
Published Oct 13, 2026 · CVSS 8.8 · EPSS 0.47%
HighCVE-2026-84312
Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
General (no AC class applies)
Published Oct 12, 2026 · CVSS 7.1 · EPSS 0.18%
HighCVE-2026-84313
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
Identity, Impersonation & Human Manipulation
Published Oct 12, 2026 · CVSS 8.8 · EPSS 0.43%
HighCVE-2026-84316
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
Tool, Function-Call & MCP Abuse
Published Oct 12, 2026 · CVSS 8.8 · EPSS 0.4%
HighCVE-2026-84317
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
Tool, Function-Call & MCP AbuseDirect Prompt Injection & Instruction Hijacking
Published Oct 12, 2026 · CVSS 8.8 · EPSS 0.38%
HighCVE-2026-84318
Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
Tool, Function-Call & MCP Abuse
Published Oct 12, 2026 · CVSS 8.8 · EPSS 0.62%

How entries are selected: we track public CVEs affecting agentic AI systems and list one once it has a published proof of concept and a CVSS score of 7.0 or higher. Severity, CVSS and EPSS come from NVD and FIRST; attack class is assigned by Verno Labs.