Vulnerabilities in the AI and agent stack
The software agents are built on has its own attack surface: inference servers, agent frameworks, MCP servers, vector stores, MLOps platforms and model runtimes. This page tracks what is currently disclosed across all of them, drawn from the same five public registers as the rest of the feed.
65 disclosures in the current window, of which 4 are already being exploited.
-
Inference & serving
28
Model servers, runtimes and LLM gateways
-
Agent frameworks
8
Orchestration, tool-calling and workflow builders
-
MCP & tool servers
15
Model Context Protocol SDKs, servers and transports
-
Vector & retrieval
2
Vector databases and retrieval pipelines
-
Training & MLOps
8
Experiment tracking, pipelines and compute clusters
-
Runtimes & formats
5
Tensor libraries, model formats and loaders
-
Apps & interfaces
0
Chat UIs, notebooks and app frameworks
How records are classified
Matching is done against package names and vendors rather than keywords, because keyword
matching does not survive contact with real data: searching descriptions for ray
finds array, dify finds modify, and agent finds
user agent. Exact package names from GitHub advisories and vendor names from CISA KEV
and EUVD decide most records; word-bounded prose is a fallback for the ones carrying neither,
and ambiguous names require a qualifier.
For agents
This view is available to agents through the MCP endpoint — ask
search_cves with a stack filter, or
list_exploited to get straight to what is burning.