AI Security Threat Feed

Data Extraction Data Leakage Framework Training Data

MLflow: path traversal allows arbitrary file read via DBFS

mlflow CWE-22 624 5 ATLAS

DoS Supply Chain Inference Model Framework

ollama: divide-by-zero DoS via crafted GGUF model import

ollama 1.5K 4 ATLAS

Social Engineering Auth Bypass Framework API

Gradio: open redirect exposes AI demo users to phishing

gradio CWE-601 679 4 ATLAS

Data Extraction Auth Bypass Code Execution API Framework

Open-WebUI: SSRF via unchecked OpenAI URL leaks internal secrets

open-webui CWE-918 5 ATLAS

mlflow CWE-400 624 3 ATLAS

MLflow: unconstrained input causes UI denial of service

Supply Chain Data Leakage Data Extraction Framework Inference

TorchServe: unverified S3 bucket exposes benchmark data

3 ATLAS

Prompt Injection Code Execution DoS Framework Agent

llama-index: SQLi+DoS via prompt injection in query engine

llamaindex CWE-89 6 ATLAS

Dify: SSRF via custom tool URL enables credential theft

CVE-2024-12775

EPSS 0.3%

Data Extraction Auth Bypass Framework API Agent

5 ATLAS

transformers CWE-1333 7.9K 3 ATLAS

Transformers: ReDoS in Nougat tokenizer causes DoS

DoS Framework Inference

llamaindex CWE-755 3 ATLAS

llama-index: DoS via infinite loop in LangChain LLM

Data Extraction Data Leakage Auth Bypass Framework API

Gradio: NTFS ADS bypass exposes blocked file paths

gradio CWE-22 679 3 ATLAS

LLaVA: path traversal allows arbitrary file read

CVE-2024-12065

EPSS 0.6%

Data Extraction Data Leakage Framework Inference

4 ATLAS

DoS Supply Chain Inference Model Framework

Ollama: DoS via malicious gguf model file upload

ollama 1.5K 4 ATLAS

CRITICAL EXPLOIT AVAIL

vllm: RCE via unsafe pickle deserialization in MessageQueue

Code Execution Framework Inference

vllm CWE-502 127 4 ATLAS

gpt_academic: path traversal exposes LLM API keys

CVE-2024-11037

EPSS 0.2%

Data Extraction Auth Bypass API Framework

gpt_academic 5 ATLAS

Data Extraction Auth Bypass Framework Plugin

GPT Academic: SSRF in Markdown plugin leaks credentials

gpt_academic 4 ATLAS

Data Extraction Auth Bypass Framework Plugin

GPT Academic: SSRF via unsanitized HotReload plugin

gpt_academic 4 ATLAS

gpt_academic: RCE via unsandboxed prompt injection

CVE-2024-10950

EPSS 2.8%

Prompt Injection Code Execution Framework Plugin

gpt_academic 6 ATLAS

Data Extraction Data Leakage Privacy Violation Framework Agent

langchain-core: file read via prompt template inputs

langchain-core Patch: 0.1.53 CWE-497 4.4K 4 ATLAS

ChuanhuChatGPT: path traversal exposes server files unauthed

CVE-2024-10707

EPSS 0.2%