AI Threat Alert AI Threat Alert

AI Security Threat Feed

Latest CVEs affecting AI/ML systems, updated continuously. Tracked from NVD, GitHub Advisory, and CISA KEV.

1,604

AI/ML CVEs Tracked

225

Critical

76

New This Week

16

In CISA KEV

Sort: Date CVSS EPSS KEV first Most exploited
Filter: All Critical High Medium KEV only Active exploitation Has patch No patch

Latest AI Security Threats

Showing 20 of 684 results — High severity
HIGH

mistune: ReDoS exposes Jupyter/AI services to DoS

CVE-2026-33079
--
EPSS 0.0%
DoS Supply Chain Framework API
mistune Patch: 3.2.1 CWE-1333 1.9K 4 ATLAS
HIGH

JupyterLab: Extension allow-list bypass enables privesc

CVE-2026-42266
8.8
Supply Chain Auth Bypass Code Execution Framework Plugin
jupyterlab Patch: 4.5.7 CWE-20 1.9K 4 ATLAS
HIGH

PPTAgent: eval injection enables RCE via LLM prompt injection

CVE-2026-42079
8.6
EPSS 0.0%
Prompt Injection Code Execution Agent Framework
CWE-95 5 ATLAS
HIGH

openclaw: Model bypasses authz to persist unsafe config

GHSA-cwj3-vqpp-pmxr
8.8
Prompt Injection Auth Bypass Code Execution Agent Plugin Framework
openclaw Patch: 2026.4.23 CWE-862 4 5 ATLAS 1 incident
HIGH

OpenClaw: RCE via malicious repo setup-api.js

GHSA-r39h-4c2p-3jxp
7.8
Supply Chain Code Execution Agent Plugin
openclaw Patch: 2026.4.23 CWE-94 4 4 ATLAS 1 incident
HIGH

Jupyter Server: CORS bypass via regex anchor omission

CVE-2026-40110
--
EPSS 0.0%
Auth Bypass Code Execution Data Extraction Framework API
jupyter-server Patch: 2.18.0 CWE-777 1.9K 4 ATLAS
HIGH

Jupyter Server: path traversal leaks sibling directories

CVE-2026-35397
7.1
EPSS 0.0%
Data Extraction Privacy Violation Framework
jupyter-server Patch: 2.18.0 CWE-22 1.9K 4 ATLAS
HIGH

openclaw: TOCTOU sandbox escape via symlink swap

GHSA-wppj-c6mr-83jj
--
Code Execution Supply Chain Auth Bypass Agent Plugin
openclaw Patch: 2026.4.22 CWE-367 4 4 ATLAS 1 incident
HIGH

openclaw: MCP owner-context spoofing, privilege escalation

GHSA-r6xh-pqhr-v4xh
--
Auth Bypass Code Execution Agent Framework
openclaw Patch: 2026.4.22 CWE-284 4 4 ATLAS 1 incident
HIGH

Langflow: RCE exposes API keys and DB credentials

CVE-2026-6543
8.8
EPSS 0.0%
Code Execution Data Extraction Supply Chain Framework Agent
langflow CWE-94 5 ATLAS
HIGH

Langflow Desktop: IDOR leaks user images unauthenticated

CVE-2026-4503
7.5
EPSS 0.1%
Privacy Violation Data Extraction Auth Bypass Framework Agent
langflow CWE-639 3 ATLAS
HIGH

n8n-mcp: SSRF bypass via IPv6 leaks API keys

CVE-2026-42449
8.5
EPSS 0.0%
Data Extraction Auth Bypass Supply Chain Agent Plugin
n8n-mcp Patch: 2.47.14 CWE-918 16 5 ATLAS
HIGH

Jupyter Notebook: stored XSS enables full account takeover

CVE-2026-40171
--
EPSS 0.1%
Auth Bypass Code Execution Data Extraction Framework Training Data
@jupyterlab/help-extension Patch: 4.5.7 CWE-79 1.9K 7 ATLAS
HIGH EXPLOIT AVAIL

marked: infinite recursion DoS crashes Node.js via OOM

CVE-2026-41680
7.5
EPSS 0.1%
DoS Framework
marked Patch: 18.0.2 CWE-400 3.8K 4 ATLAS
HIGH

litellm: RCE via MCP test endpoints privilege bypass

GHSA-v4p8-mg3p-g94g
--
Auth Bypass Code Execution API Inference
litellm Patch: 1.83.7 CWE-78 4 5 ATLAS
HIGH

Claude Code: git worktree trust bypass executes hooks

CVE-2026-40068
--
EPSS 0.1%
Auth Bypass Code Execution Supply Chain Agent Framework Plugin
@anthropic-ai/claude-code Patch: 2.1.84 CWE-20 5 ATLAS
HIGH

Ray: Parquet RCE via Arrow extension deserialization

CVE-2026-41486
--
EPSS 0.1%
Code Execution Supply Chain Framework Training Data
ray Patch: 2.55.0 CWE-94 847 5 ATLAS
HIGH

LiteLLM: RCE via unsandboxed prompt template rendering

GHSA-xqmj-j6mv-4862
--
Code Execution Data Extraction Inference API
litellm Patch: 1.83.7 CWE-1336 4 5 ATLAS
HIGH EXPLOIT AVAIL

Flowise: unauth API key abuse via TTS endpoint IDOR

CVE-2026-41279
7.5
EPSS 0.1%
Auth Bypass DoS Data Extraction Agent API Framework
flowise CWE-639 5 ATLAS
HIGH EXPLOIT AVAIL

Flowise: credential exposure in public chatflow API

CVE-2026-41278
7.5
EPSS 0.0%
Data Extraction Auth Bypass Agent Framework
flowise CWE-200 5 ATLAS

Need deeper analysis?

Get ATLAS technique mappings, compliance reports (ISO 42001, EU AI Act), breaking alerts, and full CISO analysis with a Pro subscription.

Start 14-Day Free Trial