AI Security Threat Feed

ONNX: null deref/oversized alloc in Scan inference DoS

ONNX: ConvTranspose shape inference crash causes DoS

ONNX: OOB read in RNN shape inference crashes app

vLLM: chat template bypass enables DoS via /v1/responses

vLLM: off-by-one token ID check crashes engine (DoS)

vLLM: Phi-4 audio attention causes GPU OOM DoS

vLLM: chat template DoS via unbounded Jinja rendering

vLLM: zero-sum OCR image crashes engine (DoS)

Camel OAuth: shared token cache leaks cross-profile tokens

Apache Camel CoAP: error responses leak internal details

vLLM: invalid stop_token_ids crash engine, GPU OOB write

vLLM: audio decompression bomb exhausts server memory

filelock: rename-to-rmtree deletes other users' dirs

virtualenv: stale temp-cache symlink enables local code exec

virtualenv: cached file modes expose seeded envs to tampering

virtualenv: path traversal in seed cleanup deletes files

LangGraph CLI: deploy --verbose leaks registry token in logs

MLflow: unsafe scorer deserialization enables SSRF

LangGraph stores: namespace label injection crosses tenants

filelock: soft-lock inode-reuse race allows double lock