aisecwatch.com
DashboardVulnerabilitiesNewsResearchArchiveStatsDataset
Subscribe
aisecwatch.com

Real-time AI security monitoring. Tracking AI-related vulnerabilities, safety and security incidents, privacy risks, research developments, and policy changes.

Navigation

VulnerabilitiesNewsResearchDigest ArchiveNewsletter ArchiveSubscribeData SourcesStatisticsDatasetAPIIntegrationsWidgetRSS Feed

Maintained by

Truong (Jack) Luu

Information Systems Researcher

AI Sec Watch

The security intelligence platform for AI teams

AI security threats move fast and get buried under hype and noise. Built by an Information Systems Security researcher to help security teams and developers stay ahead of vulnerabilities, privacy incidents, safety research, and policy developments.

Independent research. No sponsors, no paywalls, no conflicts of interest.

[TOTAL_TRACKED]
3,020
[LAST_24H]
4
[LAST_7D]
186
Daily BriefingSaturday, April 11, 2026
>

Anthropic's Claude Code Dominates Enterprise AI Market: At the HumanX AI conference, Anthropic's coding agent (a tool that autonomously generates, edits, and reviews code) has eclipsed OpenAI as the focal point among executives and investors, generating over $2.5 billion in annualized revenue since its May 2025 public launch. The company's concentrated strategy on code generation, rather than diversifying across multiple AI capabilities, is securing significant enterprise adoption despite ongoing legal disputes with the Department of Defense.

>

Spotify Combats AI-Generated Impersonation at Scale: AI bots are uploading fabricated music to Spotify under the identities of legitimate artists, including high-profile musicians like Jason Moran and Drake, prompting the platform to remove over 75 million fraudulent tracks in the past year. Spotify is developing a pre-publication verification tool that will require artist approval before releases appear under their names, addressing a growing identity spoofing problem in content platforms.

Latest Intel

page 302/302
VIEW ALL
01

CVE-2018-3823: X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manag

security
Sep 19, 2018

X-Pack Machine Learning (a tool for building predictive models in Elastic) versions before 6.2.4 and 5.6.9 contained a cross-site scripting vulnerability (XSS, where attackers inject malicious code that runs in users' browsers). Users with manage_ml permissions could hide malicious data in job configurations that would execute when other users viewed the results, allowing attackers to steal sensitive information or perform harmful actions on behalf of those users.

Critical This Week5 issues
critical

GHSA-8x8f-54wf-vv92: PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions

GitHub Advisory DatabaseApr 10, 2026
Apr 10, 2026

Fix: Update X-Pack Machine Learning to version 6.2.4 or 5.6.9 or later. The source references a security update at https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422.

NVD/CVE Database
02

CVE-2017-5719: A vulnerability in the Intel Deep Learning Training Tool Beta 1 allows a network attacker to remotely execute code as a

security
Nov 21, 2017

CVE-2017-5719 is a vulnerability in Intel Deep Learning Training Tool Beta 1 that allows a network attacker to remotely execute code (run commands on a system without authorization) as a local user. The vulnerability has a CVSS score (a 0-10 rating of how severe a vulnerability is) of 4.0. The specific weakness type could not be determined from available information.

NVD/CVE Database
03

CVE-2017-10349: Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that

security
Oct 19, 2017

A vulnerability in Oracle Java SE's JAXP component (a tool for processing XML, a common data format) allows attackers to partially disable Java programs over the network without needing to log in. This mainly affects Java applications running in sandboxes (isolated environments) that execute untrusted code from the internet, and does not affect servers running only trusted code.

NVD/CVE Database
04

CVE-2016-8739: The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyRea

security
Aug 10, 2017

CVE-2016-8739 is a vulnerability in the JAX-RS module (a Java API for building web services) of Apache CXF versions before 3.0.12 and 3.1.x before 3.1.9, involving the Atom JAX-RS MessageBodyReader component. The provided content only lists reference links to advisories and does not include details about the vulnerability's impact or nature.

NVD/CVE Database
05

CVE-2017-3526: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported vers

security
Apr 24, 2017

A vulnerability in Oracle Java SE's JAXP component (a library for processing XML documents) allows attackers over the network to crash Java applications without authentication, affecting Java versions 6u141, 7u131, 8u121 and related products. The attack is difficult to exploit but can be delivered through multiple methods, including malicious Java Web Start applications (Java programs downloaded and run from the web) and web services. The vulnerability has a CVSS score (a 0-10 severity rating) of 5.9, indicating moderate impact focused on availability disruption.

NVD/CVE Database
06

CVE-2017-5653: JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response w

security
Apr 18, 2017

CVE-2017-5653 is a security flaw in Apache CXF (a framework for building web services) versions before 3.1.11 and 3.0.13, where JAX-RS (Java API for REST web services) XML clients do not properly validate responses from services. This could allow attackers to exploit how the software processes XML data from web services it communicates with.

NVD/CVE Database
07

CVE-2016-0466: Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u

security
Jan 21, 2016

CVE-2016-0466 is an unspecified vulnerability in Oracle Java SE (the Java programming language and runtime environment) versions 6u105, 7u91, and 8u66 that affects system availability. The flaw exists in JAXP (Java API for XML Processing, a library for handling XML documents) and can be exploited remotely through Java Web Start applications, Java applets, or web services that use the affected Java components.

NVD/CVE Database
08

CVE-2013-2415: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and

security
Apr 17, 2013

CVE-2013-2415 is an unspecified vulnerability in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, that affects the JAX-WS (Java API for XML Web Services, a tool for building web services) component and may leak sensitive information. The vulnerability requires local access (an attacker already on your computer) to exploit and cannot be used through untrusted applets or Java Web Start applications.

NVD/CVE Database
09

CVE-2013-1518: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 U

security
Apr 17, 2013

A vulnerability exists in Oracle Java SE versions 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier, as well as OpenJDK 6 and 7, related to JAXP (Java API for XML Processing, a tool for handling XML documents). Remote attackers can exploit this unspecified flaw to compromise the confidentiality, integrity, and availability of affected systems.

NVD/CVE Database
10

CVE-2012-5074: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

security
Oct 16, 2012

CVE-2012-5074 is an unspecified vulnerability in Oracle Java SE 7 Update 7 and earlier versions that affects the Java Runtime Environment (JRE, the software that runs Java programs on your computer). The vulnerability can only be exploited through untrusted Java Web Start applications and untrusted Java applets (small programs that run in web browsers), which are limited by the Java sandbox (a restricted environment that prevents programs from accessing sensitive system resources).

NVD/CVE Database
Prev1...300301302
critical

CVE-2026-40111: PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in praisonaiagents passes a us

CVE-2026-40111NVD/CVE DatabaseApr 9, 2026
Apr 9, 2026
critical

GHSA-2763-cj5r-c79m: PraisonAI Vulnerable to OS Command Injection

GitHub Advisory DatabaseApr 8, 2026
Apr 8, 2026
critical

GHSA-qf73-2hrx-xprp: PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)

CVE-2026-39888GitHub Advisory DatabaseApr 8, 2026
Apr 8, 2026
critical

Hackers exploit a critical Flowise flaw affecting thousands of AI workflows

CSO OnlineApr 8, 2026
Apr 8, 2026