All CosmicBytez Labs articles tagged #AI Tools, across news, security advisories, how-to guides, and projects.
ComfyUI v0.23.0 contains a critical unsafe deserialization vulnerability in the LoadTrainingDataset node. Unauthenticated attackers can upload a crafted pickle file and trigger arbitrary Python code execution. CVSS 9.8.
DeepJack: two clicks in Cursor IDE silently installs a malicious MCP server with full user privileges, stealing source code and secrets. Unpatched in July 2026.
CISA added CVE-2026-55255, a CVSS 9.9 IDOR authorization bypass in Langflow, to its Known Exploited Vulnerabilities catalog on July 7, ordering U.S....
Transform Claude Code from a chatbot into a DevOps co-pilot. Set up CLAUDE.md templates, custom hooks, reusable agents, deployment skills, and MCP server...
A SmartLoader campaign distributes a trojanized Model Context Protocol (MCP) server disguised as Oura Health's legitimate tool, deploying StealC...