AI Threat AlertAPI
AI APIs are the boundary between the application and the model. Self-hosted inference servers (vLLM, Triton, Ollama, TGI) and third-party gateways (LiteLLM, OpenRouter) expose OpenAI-compatible endpoints, and the same web-app vulnerability classes appear here: missing or weak authentication on /v1/chat/completions, broken authorization between tenants, lack of rate limiting that lets an attacker drain quota or burn GPU time, and overly permissive CORS that leaks API keys from browser-side calls. The blast radius is unusual: a single auth-bypass on an inference endpoint exposes both data and compute, and in the case of paid hosted models, directly costs money. We have seen production CVEs across most popular self-hosted servers in the last 18 months. Defenses: require auth on every endpoint, per-tenant rate limits, separate key scopes for read vs admin, and pin server versions aggressively.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| HIGH | CVE-2026-91933 | Flowise: cross-workspace tool access via realtime auth gap | flowise | 7.1 |
| HIGH | CVE-2026-18110 | Concrete CMS: missing authz leaks all admin accounts | 7.5 | |
| HIGH | CVE-2026-91929 | Flowise: cross-tenant authorization gaps in Enterprise APIs | flowise | 7.1 |
| HIGH | CVE-2026-91930 | Flowise: cross-tenant org admin takeover via IDOR | flowise | 7.5 |
| HIGH | CVE-2026-91935 | Flowise: SSRF in chat-model baseURL leaks API keys | flowise | 8.3 |
| HIGH | CVE-2026-91937 | Flowise: NoSQL injection exposes other users' chat history | flowise | 7.5 |
| HIGH | GHSA-5648-rgj9-v224 | mcp-gitlab: GraphQL read-only bypass, auth gaps, DoS | 8.1 | |
| MEDIUM | CVE-2026-92298 | EspoCRM: weak PRNG tokens allow opt-in/invite forgery | 4.8 | |
| MEDIUM | CVE-2026-87959 | WPBot: missing capability check exposes Claude API key | wpbot | 5.4 |
| MEDIUM | CVE-2026-57173 | vLLM: unbounded audio decode causes OOM DoS | vllm | 6.5 |
| MEDIUM | CVE-2026-69147 | vLLM: request-selected video backend exhausts GPU memory | vllm | 6.5 |
| MEDIUM | CVE-2026-59823 | LiteLLM: SSRF via user_config api_base bypass | litellm | - |
| HIGH | CVE-2026-92971 | LMDeploy: unauthenticated assertion crash halts inference | lmdeploy | 7.5 |
| MEDIUM | CVE-2026-28465 | OpenClaw voice-call: webhook auth bypass via headers | voice-call | 5.9 |
| HIGH | CVE-2026-77407 | amqp091-go: cleartext AMQP password retained in memory | github.com/rabbitmq/amqp091-go | - |
| HIGH | CVE-2026-93436 | vLLM: memory leak in PD disaggregation causes DoS | vllm | 7.5 |
| HIGH | CVE-2026-54507 | Vvveb CMS: SSRF in oEmbed proxy leaks cloud metadata | - | |
| MEDIUM | CVE-2026-89278 | GPTranslate WP: plaintext AI API key exposed to anyone | 5.3 | |
| HIGH | CVE-2026-93592 | vLLM: negative token ID crashes embeddings engine | vllm | 7.5 |
| HIGH | CVE-2026-93591 | SiYuan: SQL injection in getGraph exposes private notes | 7.6 |