AI Security Threat Feed

TensorFlow: DoS via upper_bound rank validation crash

Langflow: mass assignment grants super admin access

TorchServe: default gRPC exposure allows unauth inference

langchain-experimental: RCE via eval() in VectorSQL chain

Flowise: CORS wildcard enables file read and data theft

Flowise: unauthenticated arbitrary file read via API

LangChain: Python REPL code execution without opt-in

ONNX: path traversal in model download enables RCE

litellm: arbitrary file deletion via audio endpoint

LangChain: SSRF in Web Retriever exposes cloud metadata

MLflow: URI fragment LFI exposes arbitrary files

MLflow: path traversal enables RCE via dataset loading

Gradio: LFI via JSON path key exposes server files

Gradio: SSRF exposes internal network and cloud metadata

MLflow: RCE via malicious MLproject file execution

MLflow: RCE via deserialization in crafted Recipes

MLflow: RCE via malicious PyTorch model deserialization

MLflow: RCE via malicious LangChain model deserialization

MLflow: RCE via malicious TensorFlow model deserialization

MLflow: RCE via LightGBM model deserialization