Thursday, July 30, 2026 · 3 of 5

1. RufRoot: CVSS 10.0 RCE in the Ruflo agent harness

   — an unauthenticated MCP bridge exposing 233 tools (incl. shell exec) allowed RCE + AI-memory poisoning; patched in 3.16.3 (Jul 28–29)

   SecurityAgents