AI Threat Alert

ISO 42001 Compliance Tracker

ISO/IEC 42001 is the international standard for AI management systems (AIMS). It provides a framework for organizations to manage the development, deployment, and use of AI systems responsibly. Each control below maps to specific AI security vulnerabilities found in real-world AI/ML packages.

2853
CVEs Mapped
6
Controls with CVEs
3647
Total Mappings
ISO 42001 EU AI Act NIST AI RMF OWASP LLM Top 10

Controls & Mapped Vulnerabilities

A.5.4

AI system impact assessment process

0 CVEs
A.6.2.4

AI system risk assessment

68 CVEs
CRITICAL
CVE-2025-11201 CVSS 9.8

mlflow: Path Traversal enables file access

CRITICAL
GHSA-g38g-8gr9-h9xp CVSS 9.8

picklescan: Allowlist Bypass evades input filtering

CRITICAL
CVE-2023-38896 CVSS 9.8

LangChain: RCE via unsandboxed LLM code execution

+ 65 more CVEs mapped to this control

A.6.2.6

AI system risk treatment

521 CVEs
CRITICAL
CVE-2026-54769 CVSS 10.0

Langroid: prompt injection to RCE via broken eval() sandbox

CRITICAL
CVE-2026-46339 CVSS 10.0

9router: unauthenticated RCE exposes LLM API keys

CRITICAL
CVE-2026-34938 CVSS 10.0

praisonaiagents: sandbox bypass enables full host RCE

+ 518 more CVEs mapped to this control

A.7.3

Awareness — AI-specific threats

12 CVEs
CRITICAL
CVE-2025-6853 CVSS 9.8

Langchain-Chatchat: path traversal in KB upload

CRITICAL
CVE-2025-59434 CVSS 9.6

Flowise Cloud: cross-tenant env var exposure leaks API keys

HIGH
CVE-2026-6859 CVSS 8.8

InstructLab: RCE via hardcoded trust_remote_code flag

+ 9 more CVEs mapped to this control

A.10.2

AI system lifecycle

28 CVEs
CRITICAL
CVE-2025-54381 CVSS 9.9

BentoML: unauthenticated SSRF via file upload URLs

CRITICAL
GHSA-8whc-2wmv-ww35 CVSS 9.6

AVideo YPTSocket: Stored DOM XSS enables admin takeover

HIGH
CVE-2026-67425 CVSS 8.6

Flyto2 Core: SSRF leaks LLM API keys via base_url

+ 25 more CVEs mapped to this control

A.10.3

Data quality for AI systems

21 CVEs
CRITICAL
GHSA-9qhq-v63v-fv3j CVSS 9.8

PraisonAI: RCE via MCP command injection

CRITICAL
CVE-2023-25664 CVSS 9.8

TensorFlow: heap overflow in AvgPoolGrad, RCE risk

CRITICAL
CVE-2026-33475 CVSS 9.1

langflow: security flaw enables exploitation

+ 18 more CVEs mapped to this control

A.10.4

AI system testing and validation

2 CVEs
CRITICAL
CVE-2020-15205 CVSS 9.8

TensorFlow: heap overflow in StringNGrams, ASLR bypass

HIGH
CVE-2026-45136

claude-code-cache-fix: hook path injection → RCE

B.4

Monitoring and measurement of AI risks

0 CVEs

Download Full Evidence Pack

Get the complete ISO 42001 evidence pack with all CVE-to-control mappings, rationale, and audit-ready documentation. Exportable as CSV.

Get Evidence Pack