AI Security Threat Feed

llama-index: JSONReader DoS via recursive JSON parsing

llama-index Obsidian reader: hardlink path traversal leaks files

llama-index ArxivReader: MD5 collision corrupts training data

Transformers: ReDoS in dynamic module loader causes DoS

Transformers: ReDoS in config loader causes serving DoS

llama-index: RCE via unsafe pickle deserialization

n8n: broken authz enables cross-user workflow termination

LiteLLM: SQL injection in key management API

n8n: DoS via empty filesystem URI in binary-data API

Langchain-Chatchat: path traversal in file API exposes host FS

n8n: open redirect enables phishing via login flow

MLflow: unauthenticated SSRF in gateway proxy

vLLM: input validation DoS crashes inference worker

vLLM: ReDoS crashes inference server via malformed regex

vLLM: DoS via malformed JSON schema guided param

vLLM: ReDoS in tool parser causes service outage

vllm: ReDoS in inference endpoints enables DoS

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the...

transformers: ReDoS in GPT-NeoX Japanese tokenizer

n8n: stored XSS enables account takeover