AI Threat AlertAPI
AI APIs are the boundary between the application and the model. Self-hosted inference servers (vLLM, Triton, Ollama, TGI) and third-party gateways (LiteLLM, OpenRouter) expose OpenAI-compatible endpoints, and the same web-app vulnerability classes appear here: missing or weak authentication on /v1/chat/completions, broken authorization between tenants, lack of rate limiting that lets an attacker drain quota or burn GPU time, and overly permissive CORS that leaks API keys from browser-side calls. The blast radius is unusual: a single auth-bypass on an inference endpoint exposes both data and compute, and in the case of paid hosted models, directly costs money. We have seen production CVEs across most popular self-hosted servers in the last 18 months. Defenses: require auth on every endpoint, per-tenant rate limits, separate key scopes for read vs admin, and pin server versions aggressively.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| LOW | CVE-2026-116004 | Onyx: stored XSS in craft PreviewTab output panel | 3.5 | |
| HIGH | CVE-2026-116172 | vLLM: gRPC top_n validation flaw crashes EngineCore | vllm | 7.5 |
| HIGH | CVE-2026-116173 | vLLM: gRPC logprob limit bypass crashes EngineCore | vllm | 7.5 |
| HIGH | CVE-2026-116174 | vLLM: gRPC invalid token IDs crash EngineCore (DoS) | vllm | 7.5 |
| MEDIUM | CVE-2026-116175 | vLLM: audio decompression bomb exhausts server memory | vllm | 6.5 |
| HIGH | CVE-2026-116176 | vLLM: SSRF via X-Request-Id leaks NCCL KV-cache data | vllm | 8.2 |
| HIGH | CVE-2026-116177 | vLLM: decompression bomb in Nemotron-VL causes DoS | vllm | 7.5 |
| HIGH | CVE-2026-116178 | vLLM: multimodal metadata DoS crashes inference engine | vllm | 7.5 |
| HIGH | CVE-2026-116179 | vLLM: num_frames override enables memory-exhaustion DoS | vllm | 7.5 |
| MEDIUM | CVE-2026-116181 | vLLM: invalid stop_token_ids crash engine, GPU OOB write | vllm | 6.5 |
| MEDIUM | CVE-2026-101259 | Apache Camel CoAP: error responses leak internal details | 5.3 | |
| MEDIUM | CVE-2026-115911 | vLLM: chat template DoS via unbounded Jinja rendering | vllm | 6.5 |
| MEDIUM | CVE-2026-94386 | Camel OAuth: shared token cache leaks cross-profile tokens | 4.8 | |
| HIGH | CVE-2026-115915 | vLLM: image decoder abuse enables RCE/DoS | vllm | 8.1 |
| MEDIUM | CVE-2026-115914 | vLLM: zero-sum OCR image crashes engine (DoS) | vllm | 6.5 |
| LOW | CVE-2026-115917 | vLLM: wildcard CORS lets web pages reach local servers | vllm | 3.4 |
| MEDIUM | CVE-2026-115918 | vLLM: chat template bypass enables DoS via /v1/responses | vllm | 6.5 |
| HIGH | CVE-2026-115924 | Rembg: unauthenticated path traversal leaks files | rembg | 8.6 |
| UNKNOWN | CVE-2026-116588 | dd-trace-py: ReDoS in query-string obfuscation causes DoS | - | |
| UNKNOWN | CVE-2026-116589 | dd-trace-py: IAST % formatting error crashes process | - |