AI Threat AlertAPI
AI APIs are the boundary between the application and the model. Self-hosted inference servers (vLLM, Triton, Ollama, TGI) and third-party gateways (LiteLLM, OpenRouter) expose OpenAI-compatible endpoints, and the same web-app vulnerability classes appear here: missing or weak authentication on /v1/chat/completions, broken authorization between tenants, lack of rate limiting that lets an attacker drain quota or burn GPU time, and overly permissive CORS that leaks API keys from browser-side calls. The blast radius is unusual: a single auth-bypass on an inference endpoint exposes both data and compute, and in the case of paid hosted models, directly costs money. We have seen production CVEs across most popular self-hosted servers in the last 18 months. Defenses: require auth on every endpoint, per-tenant rate limits, separate key scopes for read vs admin, and pin server versions aggressively.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| HIGH | CVE-2026-103257 | n8n: path traversal in n8n node exposes credentials | n8n | 7.7 |
| MEDIUM | CVE-2026-73606 | SiYuan: publish password bypass leaks block references | github.com/siyuan-note/siyuan/kernel | 5.8 |
| HIGH | GHSA-9cqf-hhrq-7v45 | SiYuan: missing authz in AV search leaks DB rows | github.com/siyuan-note/siyuan/kernel | 8.6 |
| MEDIUM | CVE-2026-73609 | SiYuan: missing authz leaks bookmark labels in publish mode | github.com/siyuan-note/siyuan/kernel | 5.8 |
| CRITICAL | CVE-2026-51882 | Langchain-Chatchat: path traversal in /v1/files file write | 9.1 | |
| CRITICAL | CVE-2026-51884 | Langchain-Chatchat: path traversal enables arbitrary file write | 9.8 | |
| HIGH | CVE-2026-51888 | Langflow: absolute path traversal allows arbitrary file write | langflow | 7.5 |
| MEDIUM | CVE-2026-103762 | SiYuan: missing authz leaks hidden notebook IDs | 5.3 | |
| MEDIUM | CVE-2026-103763 | SiYuan: info disclosure via getNotebookInfo endpoint | 5.8 | |
| HIGH | CVE-2026-104873 | LangGraph SDK: auth decorator flaw enables cross-user access | langgraph | - |
| CRITICAL | GHSA-jqmf-mx4f-hfr6 | Vibe-Trading: unauth agent RCE via shell tools, exec | 10.0 | |
| HIGH | GHSA-x8gv-g2g3-65fj | SiYuan: DNS-rebinding SSRF bypass in AI agent tools | github.com/siyuan-note/siyuan/kernel | 8.2 |
| MEDIUM | GHSA-p23f-cm6q-2qp8 | SiYuan MCP: asset.upload reads arbitrary host files | 5.7 | |
| HIGH | CVE-2026-74904 | SiYuan: missing authorization in 17 block API endpoints | github.com/siyuan-note/siyuan/kernel | 7.5 |
| HIGH | GHSA-cjcg-cxmh-9wcr | Praxis: HTTP/2 HPACK bomb enables memory-exhaustion DoS | praxis-proxy | 7.5 |
| HIGH | CVE-2026-105115 | OpenAM: unauthenticated class instantiation via JAX-RPC | 8.6 | |
| MEDIUM | CVE-2026-105758 | vLLM: unbounded video frame decoding enables DoS | vllm | 5.3 |
| MEDIUM | CVE-2026-105760 | vLLM: unbounded video frame options enable DoS | vllm | 5.3 |
| MEDIUM | CVE-2026-105754 | vLLM: input validation flaws let attacker crash EngineCore | vllm | 6.5 |
| MEDIUM | CVE-2026-105757 | vLLM: unhandled structured-output errors crash engine (DoS) | vllm | 6.5 |