AI Threat Alert

AI/ML Package Security Tracker

AI Threat Alert tracks known vulnerabilities across 125 AI/ML packages — LLM frameworks, ML libraries, vector databases, agent platforms, and inference servers — spanning the PyPI and npm ecosystems. Each package is ranked by 2398 known CVEs, severity, and a composite risk score, so the highest-risk dependencies in your AI stack surface first.

Per package you'll find
  • CVE count
  • Severity breakdown
  • Risk score
  • Patch status
  • Ecosystem
Data sources

AI Agents 21

AutoGen

pip
0
CVEs
Risk: 22

Browser Use

pip
1
CVEs
Risk: 35 1 CRITICAL

Cline

npm
2
CVEs
1 CRITICAL

Composio

pip
4
CVEs

CrewAI

pip
0
CVEs
Risk: 30

Flowise

npm
115
CVEs
27 CRITICAL

Langroid

pip
7
CVEs
4 CRITICAL

Local Deep Research

pip
3
CVEs

MCP Atlassian

pip
5
CVEs
Risk: 45 1 CRITICAL

MCP Server K8s

npm
2
CVEs

Mobile MCP

npm
2
CVEs

OpenClaw

pip
426
CVEs
15 CRITICAL

PPTAgent

pip
1
CVEs

Phidata

pip
0
CVEs
Risk: 28

PraisonAI

pip
114
CVEs
32 CRITICAL

PraisonAI Agents

pip
48
CVEs
11 CRITICAL

Pydantic AI

pip
5
CVEs
Risk: 28

TaskWeaver

pip
1
CVEs

auth-fetch MCP

npm
2
CVEs

n8n

npm
116
CVEs
Risk: 69 22 CRITICAL

smolagents

pip
5
CVEs
Risk: 50 3 CRITICAL

AI Security 11

ART

pip
0
CVEs

Boxlite

cargo
1
CVEs
1 CRITICAL

Boxlite

pip
2
CVEs
1 CRITICAL

Boxlite

npm
2
CVEs
2 CRITICAL

Fickling

pip
14
CVEs
Risk: 27

Garak

pip
0
CVEs
Risk: 26

Giskard

pip
1
CVEs

Guardrails AI

pip
2
CVEs
Risk: 27 2 CRITICAL

NeMo Guardrails

pip
0
CVEs
Risk: 27

Promptfoo

npm
0
CVEs
Risk: 25

picklescan

pip
90
CVEs
Risk: 53 12 CRITICAL

AI Tools 10

Claude Code

npm
15
CVEs
1 CRITICAL

DeepSeek TUI

cargo
2
CVEs
1 CRITICAL

DeepSeek TUI

npm
2
CVEs
1 CRITICAL

Gemini CLI

npm
2
CVEs
2 CRITICAL

Jupyter

pip
27
CVEs
Risk: 28 7 CRITICAL

Jupyter Notebook

pip
18
CVEs
Risk: 32 3 CRITICAL

Label Studio

pip
7
CVEs
Risk: 39

Microsoft APM

pip
7
CVEs
1 CRITICAL

PDFMathTranslate

pip
1
CVEs

WPBot

pip
6
CVEs

LLM APIs 8

Anthropic Node

npm
3
CVEs
Risk: 11

Anthropic Python

pip
19
CVEs
Risk: 31 1 CRITICAL

Cohere

pip
8
CVEs
Risk: 27 7 CRITICAL

Google GenAI

pip
0
CVEs
Risk: 36

Mistral AI

pip
2
CVEs
Risk: 32 1 CRITICAL

OpenAI Node

npm
7
CVEs
Risk: 34 1 CRITICAL

OpenAI Python

pip
7
CVEs
Risk: 65 2 CRITICAL

Vertex AI SDK

pip
2
CVEs

LLM Frameworks 15

ChuanhuChatGPT

pip
4
CVEs
1 CRITICAL

DSPy

pip
1
CVEs
Risk: 29

GPT Academic

pip
6
CVEs
1 CRITICAL

Haystack

pip
0
CVEs
Risk: 20

LLaMA Factory

pip
4
CVEs
2 CRITICAL

LangChain

pip
56
CVEs
Risk: 77 23 CRITICAL

LangChain Community

pip
7
CVEs
Risk: 49 2 CRITICAL

LangChain Core

pip
9
CVEs
Risk: 22

LangGraph

pip
10
CVEs
Risk: 23

Langflow

pip
57
CVEs
Risk: 77 17 CRITICAL

Llama Stack

pip
2
CVEs

LlamaIndex

pip
13
CVEs
Risk: 58 3 CRITICAL

LlamaIndex

pip
6
CVEs
Risk: 60 1 CRITICAL

LlamaIndex Core

pip
7
CVEs
Risk: 39

Semantic Kernel

pip
2
CVEs
Risk: 35 2 CRITICAL

LLM Inference 7

LMDeploy

pip
3
CVEs

LiteLLM

pip
35
CVEs
Risk: 79 7 CRITICAL

Ollama

pip
27
CVEs
Risk: 84 6 CRITICAL

TGI

pip
1
CVEs
Risk: 25

Triton

pip
1
CVEs
Risk: 19

llama.cpp Python

pip
0
CVEs
Risk: 31

vLLM

pip
75
CVEs
Risk: 61 11 CRITICAL

ML Data 2

HF Datasets

pip
4
CVEs
Risk: 28 2 CRITICAL

HF Hub

pip
0
CVEs
Risk: 30

ML Libraries 26

Accelerate

pip
0
CVEs
Risk: 28

Diffusers

pip
3
CVEs
Risk: 26

ExecuTorch

pip
7
CVEs
Risk: 49 5 CRITICAL

H2O

pip
13
CVEs
4 CRITICAL

H2O XGBoost

maven
1
CVEs

JAX

pip
0
CVEs
Risk: 33

Keras

pip
16
CVEs
Risk: 60 5 CRITICAL

LightGBM

pip
1
CVEs
Risk: 31

MLX

pip
2
CVEs
Risk: 56 1 CRITICAL

MONAI

pip
5
CVEs
Risk: 26

ONNX

pip
10
CVEs
Risk: 55 1 CRITICAL

ONNX Runtime

pip
0
CVEs
Risk: 27

PEFT

pip
0
CVEs
Risk: 32

PyTorch

pip
45
CVEs
Risk: 85 9 CRITICAL

PyTorch Lightning

pip
7
CVEs
Risk: 52 4 CRITICAL

Safetensors

pip
0
CVEs
Risk: 35

Sentence Transformers

pip
0
CVEs
Risk: 29

TRL

pip
0
CVEs
Risk: 30

TensorFlow

pip
434
CVEs
Risk: 67 17 CRITICAL

Tokenizers

pip
1
CVEs
Risk: 30

TorchGeo

pip
1
CVEs

Transformers

pip
35
CVEs
Risk: 62 4 CRITICAL

XGBoost

pip
0
CVEs
Risk: 27

XGrammar

pip
4
CVEs
Risk: 33

scikit-learn

pip
3
CVEs
Risk: 64 1 CRITICAL

spaCy

pip
2
CVEs
Risk: 25 1 CRITICAL

MLOps 11

BentoML

pip
15
CVEs
Risk: 58 4 CRITICAL

ClearML

pip
2
CVEs
Risk: 15

DVC

pip
1
CVEs
Risk: 24

InstructLab

pip
1
CVEs

LLaMA Factory

pip
4
CVEs
Risk: 53 2 CRITICAL

MLflow

pip
74
CVEs
Risk: 81 18 CRITICAL

MS Swift

pip
4
CVEs
1 CRITICAL

Ray

pip
13
CVEs
Risk: 64 6 CRITICAL

SageMaker

pip
6
CVEs
Risk: 30

Weights & Biases

pip
0
CVEs
Risk: 33

skops

pip
3
CVEs

ML UI 7

Chainlit

pip
3
CVEs
Risk: 33

Gradio

pip
56
CVEs
Risk: 80 7 CRITICAL

InvokeAI

pip
5
CVEs
3 CRITICAL

LoLLMs

pip
9
CVEs
Risk: 36 1 CRITICAL

Open WebUI

pip
109
CVEs
Risk: 38 1 CRITICAL

Panel

pip
43
CVEs
Risk: 26 15 CRITICAL

Streamlit

pip
14
CVEs
Risk: 47 9 CRITICAL

Vector DBs 7

ChromaDB

pip
6
CVEs
Risk: 27 1 CRITICAL

FAISS

pip
1
CVEs
Risk: 27

Milvus

pip
1
CVEs
Risk: 22

Pinecone

pip
0
CVEs
Risk: 30

Qdrant

pip
0
CVEs
Risk: 32

Weaviate

pip
0
CVEs
Risk: 30

pgvector

pip
2
CVEs
Risk: 31

Frequently asked questions

What AI/ML packages does AI Threat Alert track?

AI Threat Alert tracks 125 AI/ML packages — LLM frameworks, ML libraries, vector databases, agent platforms, and inference servers — across the PyPI and npm ecosystems, grouped by category and ranked by CVE count.

How many AI package vulnerabilities are tracked?

2,398 known CVEs across the tracked AI/ML packages, updated as new advisories are published.

Which package ecosystems are covered?

Coverage spans the PyPI (Python) and npm (JavaScript) ecosystems, where most AI/ML libraries, frameworks, and tooling are distributed.

How is each package's risk scored?

Each package carries a risk score derived from its CVE count, severity distribution, and number of critical vulnerabilities, so the highest-risk dependencies surface first.

Where does the package vulnerability data come from?

Vulnerability data is sourced from NVD and GitHub Advisory and cross-referenced with package metadata from PyPI, npm, and deps.dev.

Monitor your AI stack

Get real-time alerts when new vulnerabilities affect the AI/ML packages in your stack. Filter by severity, get CISO analysis, and compliance mappings.

View Plans