AI Security Threat Feed

ExecuTorch: heap overflow in method load, RCE risk

llama_index: path traversal allows arbitrary file read

lollms: timing attack enables credential enumeration

llama-index Papers Loader: XML expansion DoS

LlamaIndex Obsidian: symlink traversal exposes host files

Transformers: ReDoS in chat.py causes CPU exhaustion

Langchain-Chatchat: path traversal exposes system files

libssh: OOB read in SFTP handle leaks memory

Karel IP1211: path traversal exposes arbitrary files

Hive Support WP: OpenAI key theft + prompt hijack

jupyter_core: config hijack enables cross-user code exec

Gradio: unauthenticated file copy enables disk DoS

vLLM: image hash collision enables multimodal cache leakage

llama-index-cli: OS command injection enables RCE

label-studio-ml: PyTorch .pt deserialization RCE in YOLO loader

transformers: ReDoS in testing_utils causes DoS

Label Studio: XSS enables unauthorized actions via CSRF

llama_index: DoS via uncapped recursion in web reader

TensorFlow Serving: JSON recursion DoS on inference API

vLLM: pickle RCE in multi-node inference deployments