AI Security Threat Feed

ltiauthenticator: OAuth nonce leak causes server DoS

DoS Framework

CWE-401 3 ATLAS

JupyterHub: open redirect enables post-login phishing

CVE-2026-33709

EPSS 0.0%

Social Engineering Auth Bypass Framework

CWE-601 4 ATLAS

Auth Bypass Code Execution DoS Framework Training Data

oauthenticator: auth bypass enables JupyterHub account takeover

Auth Bypass Framework

CWE-287 4 ATLAS

CRITICAL EXPLOIT AVAIL

MLflow: auth bypass in job API enables unauthenticated RCE

mlflow CWE-306 624 5 ATLAS

vllm Patch: 0.19.0 CWE-770 127 4 ATLAS

vLLM: DoS via unbounded n parameter causes OOM crash

Ajenti: missing authz lets any user install packages

CVE-2026-35175

EPSS 0.0%

Auth Bypass Supply Chain Code Execution Framework Plugin

CWE-862 4 ATLAS

OpenClaw: SSRF in marketplace fetch hits internal AI infra

GHSA-9q7v-8mr7-g23p

Supply Chain Data Extraction Auth Bypass Plugin Inference Agent

openclaw Patch: 2026.3.31 CWE-918 4 4 ATLAS

Adversarial Examples Supply Chain Inference Framework

vLLM: audio downmix mismatch enables adversarial input

CWE-20 4 ATLAS

onnx: TOCTOU symlink following enables arbitrary file write

GHSA-q56x-g2fj-4rj6

7.1

Supply Chain Code Execution Framework Model

onnx Patch: 1.21.0 CWE-22 1.2K 4 ATLAS

Prompt Injection Data Extraction Agent Framework

praisonaiagents: SSRF leaks cloud IAM credentials

praisonaiagents Patch: 1.5.95 CWE-918 11 5 ATLAS

Code Execution Prompt Injection Auth Bypass Agent Framework Plugin

PraisonAI: sandbox escape via shell=True blocklist bypass

praisonai Patch: 4.5.97 CWE-78 1 6 ATLAS 1 incident

Data Extraction Auth Bypass Supply Chain Framework API Agent

PraisonAI: SSRF via api_base steals cloud IAM credentials

praisonai Patch: 4.5.90 CWE-918 1 5 ATLAS

Code Execution Prompt Injection Auth Bypass Agent Framework Plugin

PraisonAI: OS command injection via run_python() shell escape

praisonaiagents Patch: 1.5.90 CWE-78 11 6 ATLAS 1 incident

CRITICAL EXPLOIT AVAIL

praisonaiagents: sandbox bypass enables full host RCE

Code Execution Prompt Injection Supply Chain Agent Framework Plugin

praisonaiagents Patch: 1.5.90 CWE-693 11 7 ATLAS

Auth Bypass Data Extraction Agent Plugin Framework

Open WebUI: access control bypass leaks Tool Valve API keys

open-webui Patch: 0.8.11 CWE-285 5 ATLAS

MEDIUM EXPLOIT AVAIL

ONNX: symlink traversal reads host files via model loading

Supply Chain Data Extraction Framework Model

onnx Patch: 1.21.0 CWE-22 1.2K 5 ATLAS

Supply Chain Data Extraction Framework Model

ONNX: hardlink path traversal leaks sensitive files

onnx Patch: 1.21.0 CWE-22 1.2K 4 ATLAS

Supply Chain DoS Code Execution Framework Model Inference

ONNX: property overwrite via crafted model file

onnx Patch: 1.21.0 CWE-20 1.2K 5 ATLAS

UNKNOWN EXPLOIT AVAIL

ONNX: symlink path traversal allows arbitrary file read

CVE-2026-27489

EPSS 0.1%

Supply Chain Data Extraction Framework Model

onnx Patch: 1.21.0 CWE-23 1.2K 5 ATLAS

Anthropic SDK: TOCTOU symlink escape in async memory tool

CVE-2026-34452

EPSS 0.0%