Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
Beam · CVE database

AI agent vulnerability database

1,618 known vulnerabilities in 57 AI coding agents, MCP servers, agent frameworks and model servers, with affected and fixed versions, exploit status and how to check your install. It also tracks every CVE in CISA’s Known Exploited Vulnerabilities catalog and critical open-source package advisories. Updated twice a day; last change Oct 21, 2026.

Vulnerabilities tracked
1,618
Critical
200
Known exploited (CISA KEV)
11
Published in the last 30 days
39

Latest AI agent vulnerabilities

Newest first, across every AI tool in the database.

Browse by tool

Every reviewed advisory for each tool, with the command to check your version.

LLM gateways and model serving

Proxies, inference servers and model libraries that agents call or that load model files.

Recently added to CISA KEV

Vulnerabilities with confirmed exploitation in the wild, across all vendors. Fix these first.

Known exploited vulnerabilities by vendor

Methodology and sources

Advisory data comes from the GitHub Advisory Database (reviewed advisories, CC BY 4.0), exploitation status from CISA’s KEV catalog, scores for KEV entries without a GitHub advisory from the NVD, and exploit probability from FIRST EPSS. This product uses the NVD API but is not endorsed or certified by the NVD.

The AI tool list and the packages behind each tool are curated. Advisories for any other MCP server or tool are found automatically by package name and advisory text. A fixed program writes every data field; nothing on the data panel is written by a model.

Analyses (what an attacker can do, who is affected, how to fix and detect it) are written by an AI model from the sources each page lists, then checked by automated rules: the data must be unchanged, the fixed version must match the advisory, and every CVE id must trace to a source. 0 of 3,361 entries have one so far; new AI tool advisories go first.

Missing an advisory or found an error? Tell us.

Questions

What does the Beam CVE database cover?
Three groups. First, every reviewed GitHub advisory for 50+ AI tools: coding agents such as Claude Code, Codex CLI and Gemini CLI, MCP SDKs and servers, agent frameworks such as LangChain and LlamaIndex, and gateways and model servers such as LiteLLM, vLLM and Ollama. Second, every CVE in CISA's Known Exploited Vulnerabilities catalog. Third, critical open-source package advisories published since 2024.
How often is it updated?
Twice a day, at 13:00 and 23:00 UTC. Each update pulls new and changed advisories from the GitHub Advisory Database, the CISA KEV catalog, the NVD and FIRST EPSS. Withdrawn advisories stay listed and are marked as withdrawn.
How are new MCP servers added?
Each update also scans every new reviewed GitHub advisory for packages that are MCP servers, clients or tools, by package name and advisory text. Matches appear under Other MCP servers and tools without a manual step.
Who writes the analysis on each entry?
An AI model writes it from the advisory, the fix and the vendor's or researcher's write-up, and lists the pages it read. Automated checks then confirm that the data fields are unchanged, the fixed version matches the advisory, and no CVE id appears from nowhere. Entries without an analysis show the advisory data only.
What do EPSS and KEV mean?
EPSS (from FIRST) is the estimated probability that a CVE is exploited in the next 30 days. KEV is CISA's catalog of vulnerabilities with confirmed exploitation in the wild; a KEV entry should be fixed first.