AI Threat AlertAPI
AI APIs are the boundary between the application and the model. Self-hosted inference servers (vLLM, Triton, Ollama, TGI) and third-party gateways (LiteLLM, OpenRouter) expose OpenAI-compatible endpoints, and the same web-app vulnerability classes appear here: missing or weak authentication on /v1/chat/completions, broken authorization between tenants, lack of rate limiting that lets an attacker drain quota or burn GPU time, and overly permissive CORS that leaks API keys from browser-side calls. The blast radius is unusual: a single auth-bypass on an inference endpoint exposes both data and compute, and in the case of paid hosted models, directly costs money. We have seen production CVEs across most popular self-hosted servers in the last 18 months. Defenses: require auth on every endpoint, per-tenant rate limits, separate key scopes for read vs admin, and pin server versions aggressively.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| HIGH | CVE-2026-61433 | PraisonAI: code injection via unsafe config codegen | PraisonAI | 7.8 |
| HIGH | CVE-2026-61436 | PraisonAI: missing webhook signature check spoofs agents | PraisonAI | 8.6 |
| HIGH | CVE-2026-63086 | TGI: SSRF via image_url exposes cloud metadata creds | text-generation-inference | 8.6 |
| MEDIUM | CVE-2026-55406 | buffa: use-after-free in Rust protobuf OwnedView type | buffa | - |
| MEDIUM | CVE-2026-55407 | Buffa: protobuf decoder DoS via 22x memory amplification | buffa | - |
| HIGH | CVE-2026-44433 | Quicly/H2O: QUIC flow-control bug enables memory exhaustion DoS | 7.5 | |
| HIGH | CVE-2026-44435 | H2O/Quicly: unauthenticated QUIC DoS via assertion crash | 7.5 | |
| HIGH | CVE-2026-44436 | Quicly: QUIC DoS via oversized Connection ID overflow | 7.5 | |
| MEDIUM | CVE-2026-44452 | h2o HTTP server: NULL SNI crash causes DoS | 5.9 | |
| HIGH | CVE-2026-54340 | H2O: HTTP/2 HPACK amplification enables DoS | h2o | 7.5 |
| HIGH | CVE-2026-50273 | Datadog .NET Tracer: DoS via unbounded baggage header | 7.5 | |
| HIGH | CVE-2026-8056 | Langflow: auth'd param injection via apply_tweaks() enables code exec | langflow | 8.8 |
| HIGH | CVE-2026-50271 | dd-trace-py: unbounded baggage header parsing causes DoS | 7.5 | |
| HIGH | CVE-2026-50272 | dd-trace: unbounded W3C baggage parsing enables DoS | 7.5 | |
| CRITICAL | CVE-2026-65007 | Grav CMS API plugin: forged keys enable account takeover | 9.6 | |
| HIGH | CVE-2026-15829 | MCP Toolbox: SQLi bypasses BigQuery allowedDatasets ACL | - | |
| HIGH | CVE-2026-63764 | lmdeploy: SSRF via redirect bypasses private IP guard | lmdeploy | 8.6 |
| HIGH | CVE-2026-47237 | Kubeflow: token theft lets any user hijack accounts | 8.0 | |
| MEDIUM | CVE-2026-65589 | n8n: plaintext credential leak in LLM node logs | n8n | - |
| MEDIUM | CVE-2026-65593 | n8n: SSRF bypass in dynamic-node-parameters endpoint | n8n | - |