AI Security Threat Feed

MLflow: path traversal via URI fragment reads arbitrary files

MLflow: path traversal via ';' smuggling exposes files

MLflow: path traversal allows arbitrary directory deletion

MLflow: path traversal enables arbitrary file read

MLflow: path traversal exposes arbitrary server files

Gradio: path traversal leaks arbitrary files, potential RCE

Gradio: CI/CD command injection enables secrets exfil

LangChain: path traversal enables RCE and API key theft

libtiff: heap overflow DoS in vLLM inference via TIFF input

libtiff: OOM DoS in vLLM inference container images

Nginx-UI: command injection via settings API

Nginx-UI: authenticated command injection to RCE

TP-Link Tapo: hardcoded creds bypass login auth

Gradio: path traversal grants arbitrary file read

Transformers: unsafe deserialization enables RCE on load

HuggingFace Transformers: RCE via unsafe deserialization

MLflow: path traversal exposes arbitrary files (no auth)

MLflow: path traversal allows arbitrary file write

Gradio: command injection enables RCE on ML servers

MLflow: path traversal exposes arbitrary file read/write