Nine CVEs Landed on AI Agent Projects in Under Six Seconds

Between 20:20:14 and 20:20:20 UTC on 28 August — a window of under six seconds — nine CVE records from a single numbering authority were published against AI agent projects. Querying the national vulnerability database over the batch window returns them as a contiguous block.

What is covered

Two records against an agent framework, and seven across five projects: server-side request forgery and path traversal in Qwen-Agent, SSRF in the Portkey AI Gateway, missing ownership validation on prompt and chat endpoints in Quivr, missing conversation-ownership checks in VoltAgent, and unvalidated output filenames in gpt-crawler. Scores run from 7.1 to 8.6.

The detail in the version strings

Seven of the nine describe the affected range as "through" the current release — through 0.0.34, through 1.15.2, through 0.0.322, through 2.1.20, through 1.5.1 — with no fixed version named. A CVE that names a patched version tells an operator what to upgrade to. These do not, because there is nothing to upgrade to. The two exceptions, both against the same agent framework, do name fixes.

What the common framing gets wrong

A cluster of CVEs published seconds apart reads as a coordinated campaign against the AI agent ecosystem. It is one researcher's batch clearing a numbering authority's queue — the timing reflects publication automation, not attacker activity, and the underlying findings were disclosed to the projects publicly weeks earlier and largely went unanswered. The second misreading runs the other way: because the projects are small and the scores are not critical, the batch reads as noise. Between them these repositories carry over a hundred thousand stars, and an unfixed SSRF in a gateway that holds provider credentials is a live problem regardless of how it was catalogued.

The score to read twice

The framework record scored 8.3 HIGH in the national database under one CVSS version is published at a higher, critical figure under a newer version elsewhere. Both numbers describe the same defect. Its exploitation precondition is also worth stating plainly: the attacker must first compromise a third-party repository that the victim's configuration already trusts.