11 CRIT · 2 HIGH · 1 MED · THREAT RED · 14 items · Generated in 448s
vulnerability in vLLM library could affect data integrity
Improper handling of image metadata can lead to model misinterpretation and data integrity issues
allows writing events into another user
vLLM's audio decoder can exhaust server memory with a small number of concurrent requests, leading to a denial-of-service attack.
uninitialized GPU memory in multi-tenant serving exposes information disclosure
Failing to normalize EXIF orientation and PNG tRNS transparency can introduce interpretation bias and distort input content.
Crashing inference worker on GPU kernel execution with NaN/Inf softmax input, degrading service for all concurrent users.
allows local low-privilege user to pre-create symlink to file writable by victim, truncating target file to daemon PID string
MCP tool bypasses token redaction, exposing admin-level API key values
No authentication or origin validation on MCP SSE transport, allowing host-based attacks
vulnerable to OS command injection and @file exfiltration via prompt quoting
MCP Streamable HTTP redirects could forward configured custom headers to another origin, potentially exfiltrating sensitive headers
Custom headers could be sent to the redirect target, exposing credential scope
incomplete fix for CVE-2026-22778 allows heap address leakage
No new AI-centered threat headlines found.