AI Threat AlertAPI
AI APIs are the boundary between the application and the model. Self-hosted inference servers (vLLM, Triton, Ollama, TGI) and third-party gateways (LiteLLM, OpenRouter) expose OpenAI-compatible endpoints, and the same web-app vulnerability classes appear here: missing or weak authentication on /v1/chat/completions, broken authorization between tenants, lack of rate limiting that lets an attacker drain quota or burn GPU time, and overly permissive CORS that leaks API keys from browser-side calls. The blast radius is unusual: a single auth-bypass on an inference endpoint exposes both data and compute, and in the case of paid hosted models, directly costs money. We have seen production CVEs across most popular self-hosted servers in the last 18 months. Defenses: require auth on every endpoint, per-tenant rate limits, separate key scopes for read vs admin, and pin server versions aggressively.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| MEDIUM | CVE-2026-105755 | vLLM: request-ID cache key collision corrupts rerank scores | vllm | 4.2 |
| MEDIUM | CVE-2026-105756 | vLLM: unvalidated cache_salt crashes EngineCore (DoS) | vllm | 6.5 |
| LOW | CVE-2026-105752 | vLLM: cache_salt dropped on tool continuations leaks prefixes | vllm | 3.1 |
| HIGH | CVE-2026-105759 | vLLM: unbounded metrics labels allow memory-exhaustion DoS | vllm | 7.5 |
| HIGH | CVE-2026-105786 | Joplin Server: app-auth flaw enables account takeover | - | |
| HIGH | CVE-2026-105783 | Joplin: Web Clipper CORS flaw leaks permanent API token | 8.0 | |
| MEDIUM | CVE-2026-105785 | Joplin Server: reset-token reuse enables account takeover | 4.8 | |
| MEDIUM | CVE-2026-105775 | vLLM: OOB read in Mamba2 mixer enables remote DoS | vLLM | 4.3 |
| MEDIUM | CVE-2026-105922 | vLLM: penalty handler flaw allows remote DoS | vllm | 4.3 |
| MEDIUM | CVE-2026-106119 | LangChain MongoDB: NoSQL injection exposes chat histories | @langchain/mongodb | - |
| HIGH | CVE-2026-41510 | Coraza WAF: ARGS limit silent drop bypasses WAF rules | github.com/corazawaf/coraza/v3 | 7.2 |
| MEDIUM | CVE-2026-93448 | Langflow: path traversal lets authenticated users read files | langflow | 6.5 |
| MEDIUM | CVE-2026-93679 | Langflow: ZIP extraction resource exhaustion allows DoS | langflow | 4.3 |
| MEDIUM | CVE-2026-97671 | Langflow: path traversal exposes sensitive files | langflow | 6.5 |
| MEDIUM | CVE-2026-62179 | PraisonAI Platform: authz flaw lets members delete issue links | praisonai-platform | 6.5 |
| CRITICAL | CVE-2026-62176 | PraisonAI: code injection in deploy API enables RCE | PraisonAI | 9.1 |
| MEDIUM | CVE-2026-106123 | RabbitMQ Java Client: AMQP password leaked in exception | com.rabbitmq:amqp-client | - |
| UNKNOWN | CVE-2026-103663 | Ollama: path traversal in /api/pull enables root RCE | ollama | - |
| MEDIUM | GHSA-w253-m66g-rx24 | Coraza WAF: Content-Type parsing flaw bypasses body inspection | github.com/corazawaf/coraza/v3 | 5.8 |
| MEDIUM | GHSA-3wr7-993q-jrff | Coraza WAF: filename* charset bypass evades upload rules | github.com/corazawaf/coraza/v3 | 4.0 |