AI Threat AlertAPI
AI APIs are the boundary between the application and the model. Self-hosted inference servers (vLLM, Triton, Ollama, TGI) and third-party gateways (LiteLLM, OpenRouter) expose OpenAI-compatible endpoints, and the same web-app vulnerability classes appear here: missing or weak authentication on /v1/chat/completions, broken authorization between tenants, lack of rate limiting that lets an attacker drain quota or burn GPU time, and overly permissive CORS that leaks API keys from browser-side calls. The blast radius is unusual: a single auth-bypass on an inference endpoint exposes both data and compute, and in the case of paid hosted models, directly costs money. We have seen production CVEs across most popular self-hosted servers in the last 18 months. Defenses: require auth on every endpoint, per-tenant rate limits, separate key scopes for read vs admin, and pin server versions aggressively.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| LOW | CVE-2026-114049 | vLLM: stale token mask leaks across requests | vllm | 3.7 |
| HIGH | CVE-2026-114050 | vLLM: forged multimodal UUID crashes inference engine | vllm | 7.5 |
| HIGH | CVE-2026-114051 | vLLM: unauth DoS via min_tokens hangs generation | vllm | 7.5 |
| HIGH | CVE-2026-114052 | vLLM: unauthenticated /tokenize exhausts memory (MOSS-Audio) | vllm | 7.5 |
| HIGH | CVE-2026-114053 | vLLM: RCE via code_revision in /tokenize endpoint | vllm | 8.1 |
| HIGH | CVE-2026-114055 | vLLM: unvalidated mm_processor_kwargs enables remote DoS | vllm | 7.5 |
| MEDIUM | CVE-2026-76297 | Splunk Enterprise: CSRF via GET disables federated search | 5.4 | |
| CRITICAL | CVE-2026-114612 | LiteLLM: forged admin token enables RCE via MCP stdio | litellm | 9.9 |
| CRITICAL | CVE-2026-107685 | req_llm: TLS verification disabled in OpenAI WebSockets | openai | - |
| HIGH | CVE-2026-56837 | PraisonAI: missing webhook auth lets forged Linear events drive agent | PraisonAI | 8.6 |
| HIGH | CVE-2026-56836 | PraisonAI: unauthenticated recipe server exposes admin | PraisonAI | 8.2 |
| HIGH | CVE-2026-57114 | PraisonAI: SSRF via webhook DNS rebinding bypass | praisonai | 7.2 |
| CRITICAL | CVE-2026-57116 | PraisonAI: unauthenticated AgentOS chat API drives agents | praisonai | 9.8 |
| HIGH | CVE-2026-57146 | PraisonAI: unauthenticated A2U event streaming exposed | praisonai | 7.5 |
| MEDIUM | CVE-2026-55465 | Goobi viewer: Solr injection exposes restricted records | 5.3 | |
| HIGH | CVE-2026-73054 | SiYuan: WebSocket auth bypass leaks live event stream | github.com/siyuan-note/siyuan/kernel | 7.5 |
| MEDIUM | CVE-2026-73630 | SiYuan: auth oracle leaks hidden document existence | github.com/siyuan-note/siyuan/kernel | 5.8 |
| MEDIUM | CVE-2026-73049 | SiYuan: hidden-tier docs leak via AV backlinks API | github.com/siyuan-note/siyuan/kernel | 5.8 |
| MEDIUM | GHSA-xp3q-r38w-vgqm | SiYuan: publish storage endpoint leaks admin context | github.com/siyuan-note/siyuan/kernel | 5.8 |
| MEDIUM | CVE-2026-115886 | MLflow: unsafe scorer deserialization enables SSRF | mlflow | 6.5 |