AI Security Threat Feed

vLLM vulnerable to Denial of Service by abusing xgrammar cache

xgrammar Vulnerable to Denial of Service (DoS) by abusing unbounded cache in memory

Picklescan missing detection when calling built-in python library function timeit.timeit()

Picklescan failed to detect to some unsafe global function in Numpy library

SageMaker Workflow component allows possibility of MD5 hash collisions

LlamaIndex Uncontrolled Resource Consumption vulnerability

A vulnerability in langchain-core versions >=0.1.17,<0.1.53, >=0.2.0,<0.2.43, and >=0.3.0,<0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from...

picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP...

ray vulnerable to Insertion of Sensitive Information into Log File

Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis

PyTorch Model Files Can Bypass Pickle Scanners via Unexpected Pickle Extensions

Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint

Gradio's dropdown component pre-process step does not limit the values to those in the dropdown list

Denial of service in langchain-community

Heartex - Label Studio Community Edition vulnerable to SSRF in the Data Import module

Cross-site scripting in Jupyter Notebook