AI Threat AlertAPI
AI APIs are the boundary between the application and the model. Self-hosted inference servers (vLLM, Triton, Ollama, TGI) and third-party gateways (LiteLLM, OpenRouter) expose OpenAI-compatible endpoints, and the same web-app vulnerability classes appear here: missing or weak authentication on /v1/chat/completions, broken authorization between tenants, lack of rate limiting that lets an attacker drain quota or burn GPU time, and overly permissive CORS that leaks API keys from browser-side calls. The blast radius is unusual: a single auth-bypass on an inference endpoint exposes both data and compute, and in the case of paid hosted models, directly costs money. We have seen production CVEs across most popular self-hosted servers in the last 18 months. Defenses: require auth on every endpoint, per-tenant rate limits, separate key scopes for read vs admin, and pin server versions aggressively.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| CRITICAL | CVE-2025-66455 | LMDeploy: pickle deserialization RCE in DistServe | lmdeploy | 9.8 |
| HIGH | GHSA-39wr-7q6h-cf68 | lmdeploy: URL parser mismatch enables SSRF bypass | lmdeploy | 7.5 |
| MEDIUM | CVE-2026-93840 | vLLM: token ID validation flaw corrupts cross-request logits | vllm | 5.3 |
| MEDIUM | CVE-2026-93989 | vLLM: bad_words OOB index corrupts cross-request logits | vllm | 4.3 |
| CRITICAL | CVE-2026-46649 | Joplin Server: SSO code brute force yields session takeover | - | |
| MEDIUM | CVE-2026-55179 | Joplin Server: IDOR exposes other users' note content | 6.5 | |
| MEDIUM | CVE-2026-59816 | Joplin Server: path traversal in transcribe API leaks data | 4.3 | |
| HIGH | CVE-2026-61647 | NotebookLM MCP: path traversal enables arbitrary file write | @roomi-fields/notebooklm-mcp | - |
| HIGH | CVE-2026-94626 | vLLM: unvalidated tp_size allows memory-exhaustion DoS | vllm | 7.5 |
| HIGH | CVE-2026-94623 | vLLM: NIXL multi-prompt assertion crash causes DoS | vllm | 7.5 |
| HIGH | CVE-2026-94627 | vLLM: Mooncake KV cache leak enables GPU DoS | vllm | 7.5 |
| HIGH | CVE-2026-55210 | Joplin Server: SAML login bypass takes over local accounts | 7.4 | |
| MEDIUM | CVE-2025-14486 | PixelPlay WP: missing auth lets attackers delete API keys | 5.3 | |
| MEDIUM | CVE-2026-61612 | CKAN MCP Server: DNS-based SSRF reaches cloud metadata | 5.7 | |
| CRITICAL | CVE-2026-94127 | F5 BIG-IP APM: unauthenticated RCE via OAuth server | 9.8 | |
| MEDIUM | CVE-2026-85709 | LightRAG: error messages leak paths and DB credentials | lightrag-hku | 5.3 |
| HIGH | CVE-2026-77274 | mcp-atlassian: SSRF via backslash URL parsing confusion | mcp-atlassian | - |
| CRITICAL | CVE-2026-77244 | MCP Atlassian: unauthenticated access to operator Jira/Confluence | mcp-atlassian | 10.0 |
| MEDIUM | CVE-2026-77265 | MCP Atlassian: DNS-rebinding SSRF exposes internal services | mcp-atlassian | 5.9 |
| HIGH | CVE-2026-77242 | MCP Atlassian: DNS rebinding bypasses SSRF protection | mcp-atlassian | 7.5 |