aisecwatch.com
DashboardVulnerabilitiesNewsResearchArchiveStatsDatasetFor devs
Subscribe
aisecwatch.com

Real-time AI security monitoring. Tracking AI-related vulnerabilities, safety and security incidents, privacy risks, research developments, and policy changes.

Navigation

VulnerabilitiesNewsResearchDigest ArchiveNewsletter ArchiveSubscribeData SourcesStatisticsDatasetAPIIntegrationsWidgetRSS Feed

Maintained by

Truong (Jack) Luu

Information Systems Researcher

AI Sec Watch

The security intelligence platform for AI teams

AI security threats move fast and get buried under hype and noise. Built by an Information Systems Security researcher to help security teams and developers stay ahead of vulnerabilities, privacy incidents, safety research, and policy developments.

Independent research. No sponsors, no paywalls, no conflicts of interest.

[TOTAL_TRACKED]
4,642
[LAST_24H]
4
[LAST_7D]
96
Daily BriefingSunday, June 14, 2026
>

Neural Network Robustness Testing Methods Surveyed: An academic review catalogs techniques for assessing whether image recognition systems maintain accuracy when confronted with adversarial inputs (deliberately crafted inputs designed to fool AI models) or unexpected conditions.

>

Generative AI Reshapes Ransomware Defense Calculus: Analysis argues that conventional defenses against ransomware (malicious software that encrypts files and demands payment) may prove inadequate as generative AI tools enable more sophisticated attacks and alter the threat landscape.

Latest Intel

page 464/465
VIEW ALL
01

CVE-2018-20301: An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In pa

security
Dec 20, 2018

CVE-2018-20301 is a mass assignment vulnerability (a flaw where an attacker can modify data fields they shouldn't be able to change) in Steve Pallen Coherence before version 0.5.2. The vulnerability allows users registering for accounts to update any field in the system, including automatically confirming their own accounts by adding a confirmed_at parameter to their registration request.

Critical This Week5 issues
critical

CVE-2026-45833: A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacke

CVE-2026-45833NVD/CVE DatabaseJun 12, 2026
Jun 12, 2026
NVD/CVE Database
02

CVE-2018-3824: X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker i

security
Sep 19, 2018

X-Pack Machine Learning (a tool for automated data analysis in Elasticsearch) versions before 6.2.4 and 5.6.9 contained a cross-site scripting vulnerability (XSS, a flaw where attackers inject malicious code into web pages). An attacker could inject harmful data into a database index being analyzed by the machine learning tool, and when another user views the results, the attacker could steal sensitive information or perform actions as that user.

Fix: Update X-Pack Machine Learning to version 6.2.4 or 5.6.9 or later.

NVD/CVE Database
03

CVE-2018-3823: X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manag

security
Sep 19, 2018

X-Pack Machine Learning (a tool for building predictive models in Elastic) versions before 6.2.4 and 5.6.9 contained a cross-site scripting vulnerability (XSS, where attackers inject malicious code that runs in users' browsers). Users with manage_ml permissions could hide malicious data in job configurations that would execute when other users viewed the results, allowing attackers to steal sensitive information or perform harmful actions on behalf of those users.

Fix: Update X-Pack Machine Learning to version 6.2.4 or 5.6.9 or later. The source references a security update at https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422.

NVD/CVE Database
04

CVE-2017-5719: A vulnerability in the Intel Deep Learning Training Tool Beta 1 allows a network attacker to remotely execute code as a

security
Nov 21, 2017

CVE-2017-5719 is a vulnerability in Intel Deep Learning Training Tool Beta 1 that allows a network attacker to remotely execute code (run commands on a system without authorization) as a local user. The vulnerability has a CVSS score (a 0-10 rating of how severe a vulnerability is) of 4.0. The specific weakness type could not be determined from available information.

NVD/CVE Database
05

CVE-2017-10349: Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that

security
Oct 19, 2017

A vulnerability in Oracle Java SE's JAXP component (a tool for processing XML, a common data format) allows attackers to partially disable Java programs over the network without needing to log in. This mainly affects Java applications running in sandboxes (isolated environments) that execute untrusted code from the internet, and does not affect servers running only trusted code.

NVD/CVE Database
06

CVE-2016-8739: The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyRea

security
Aug 10, 2017

CVE-2016-8739 is a vulnerability in the JAX-RS module (a Java API for building web services) of Apache CXF versions before 3.0.12 and 3.1.x before 3.1.9, involving the Atom JAX-RS MessageBodyReader component. The provided content only lists reference links to advisories and does not include details about the vulnerability's impact or nature.

NVD/CVE Database
07

CVE-2017-3526: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported vers

security
Apr 24, 2017

A vulnerability in Oracle Java SE's JAXP component (a library for processing XML documents) allows attackers over the network to crash Java applications without authentication, affecting Java versions 6u141, 7u131, 8u121 and related products. The attack is difficult to exploit but can be delivered through multiple methods, including malicious Java Web Start applications (Java programs downloaded and run from the web) and web services. The vulnerability has a CVSS score (a 0-10 severity rating) of 5.9, indicating moderate impact focused on availability disruption.

NVD/CVE Database
08

CVE-2017-5653: JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response w

security
Apr 18, 2017

CVE-2017-5653 is a security flaw in Apache CXF (a framework for building web services) versions before 3.1.11 and 3.0.13, where JAX-RS (Java API for REST web services) XML clients do not properly validate responses from services. This could allow attackers to exploit how the software processes XML data from web services it communicates with.

NVD/CVE Database
09

CVE-2016-0466: Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u

security
Jan 21, 2016

CVE-2016-0466 is an unspecified vulnerability in Oracle Java SE (the Java programming language and runtime environment) versions 6u105, 7u91, and 8u66 that affects system availability. The flaw exists in JAXP (Java API for XML Processing, a library for handling XML documents) and can be exploited remotely through Java Web Start applications, Java applets, or web services that use the affected Java components.

NVD/CVE Database
10

CVE-2013-2415: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and

security
Apr 17, 2013

CVE-2013-2415 is an unspecified vulnerability in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, that affects the JAX-WS (Java API for XML Web Services, a tool for building web services) component and may leak sensitive information. The vulnerability requires local access (an attacker already on your computer) to exploit and cannot be used through untrusted applets or Java Web Start applications.

NVD/CVE Database
Prev1...462463464465Next
critical

CVE-2026-46442: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /a

CVE-2026-46442NVD/CVE DatabaseJun 8, 2026
Jun 8, 2026
high

CVE-2026-50287: AgenticMail gives AI agents real email addresses and phone numbers. Prior to version 0.9.27, @agenticmail/mcp exposes a

CVE-2026-50287NVD/CVE DatabaseJun 12, 2026
Jun 12, 2026
high

CVE-2026-47138: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

CVE-2026-47138NVD/CVE DatabaseJun 12, 2026
Jun 12, 2026
high

Google Sues Chinese Smishing Network Accused of Using Gemini AI in Phishing

The Hacker NewsJun 12, 2026
Jun 12, 2026