CWE-1427
28 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 28Published CVEs28 of them scored
- 22Last 12 monthspublished in the last year
- 2Critical13 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-123498
Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata
go-vikunja · vikunja
Low2.1 - CVE-2026-102344
Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server
kunchenguid · lavish-axi
High8.1 - CVE-2026-106020
Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order…
Johnson Controls · EasyIO Neo IO Manager and Tools Installer
High8.6 - CVE-2026-123653
esengine DeepSeek-Reasonix doc.go discoverDocs llm prompting input
esengine · DeepSeek-Reasonix
Medium5.3 - CVE-2026-54142
OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approval
tinyhumansai · openhuman
High8.7 - CVE-2026-54140
OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitization
tinyhumansai · openhuman
High8.3 - CVE-2026-115415
Secret masking bypass in the environment tool in Strands Agents Tools
amazon · strands-agents-tools
Medium5.9 - CVE-2026-114107
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool
HKUDS · Vibe-Trading
High8.7 - CVE-2026-109440
LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode
ginlix-ai · LangAlpha
High8.7 - CVE-2026-77931
MoviePilot 3.1.5 Command Injection via ExecuteCommandTool
jxxghp · MoviePilot
High8.7