AI Security Threat Feed

Gradio: unauthenticated file copy enables disk DoS

vLLM: image hash collision enables multimodal cache leakage

llama-index-cli: OS command injection enables RCE

label-studio-ml: PyTorch .pt deserialization RCE in YOLO loader

transformers: ReDoS in testing_utils causes DoS

TensorFlow Serving: JSON recursion DoS on inference API

vLLM: pickle RCE in multi-node inference deployments

vLLM: DoS via quadratic multimodal tokenizer input

vLLM: ZeroMQ socket exposure enables DoS in multi-node

Mesop: class pollution enables DoS and LLM jailbreak

LiteLLM: Langfuse API key leak via error handling

open-webui: DoS via unauthenticated multipart parsing

pytorch-lightning: unauthenticated DoS crashes LightningApp

Open-WebUI: unauthenticated PDF endpoint enables DoS

open-webui: unauthenticated DoS via markdown parser

open-webui: Stored XSS enables admin session hijack

open-webui: XSS enables admin session hijack via chat

LiteLLM: RCE via post_call_rules callback injection

Open WebUI: auth bypass exposes all user files

open-webui: Privilege bypass enables admin account deletion