What changed in AI security, Apr 8 to Apr 14, 2024
Apr 8 to Apr 14, 2024 (ISO week 2024-W15). Weeks run Monday to Sunday in UTC.
9 records published, +7 on the previous week: 9 vulnerabilities (+9), 0 incidents (no change), 0 research items (no change), 0 news items (-2), 0 policy items (no change).
Critical and high advisories
Vulnerability records rated critical or high, newest first.- Critical
CVE-2023-51409: AI Engine: ChatGPT Chatbot unrestricted upload of dangerous file type
CVE-2023-51409NVD/CVE Database - Critical
CVE-2024-3568: huggingface/transformers arbitrary code execution via untrusted deserialization
CVE-2024-3568NVD/CVE Database - High
CVE-2024-2221: qdrant/qdrant path traversal and arbitrary file upload via snapshot
CVE-2024-2221NVD/CVE Database - High
CVE-2024-1728: gradio-app/gradio local file inclusion in UploadButton via /queue/join
CVE-2024-1728NVD/CVE Database - Critical
GHSA-46cm-pfwv-cgf8: LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint
CVE-2024-2952GitHub Advisory Database - High
CVE-2024-3098: llama_index code execution via prompt injection in safe_eval
CVE-2024-3098NVD/CVE Database - Critical
CVE-2024-31224: GPT Academic unsafe deserialization of client data enabling code execution
CVE-2024-31224NVD/CVE Database
Exploitation signals
Vulnerabilities published in the week that are listed in the CISA Known Exploited Vulnerabilities catalog or have an EPSS score of 10% or more.| Advisory | Exploitation | EPSS | Published |
|---|---|---|---|
| CVE-2024-1728: gradio-app/gradio local file inclusion in UploadButton via /queue/join CVE-2024-1728NVD/CVE Database | Not listed | 85.4% | |
| CVE-2023-51409: AI Engine: ChatGPT Chatbot unrestricted upload of dangerous file type CVE-2023-51409NVD/CVE Database | Not listed | 63.1% |
Packages that began delegating to a language model
Exposure Registry packages whose first release declaring an LLM SDK, agent framework or MCP dependency was published in the week.| Package | Ecosystem | LLM SDKs | Release | Released |
|---|---|---|---|---|
| dspy | PyPI | DSPy | 0.0.1 | |
| opentelemetry-instrumentation-bedrock | PyPI | Anthropic SDK | 0.16.2 | |
| @ai-sdk/openai | npm | Vercel AI SDK | 0.0.0 | |
| @ai-sdk/provider-utils | npm | Vercel AI SDK | 0.0.0 | |
| @ai-sdk/mistral | npm | Vercel AI SDK | 0.0.0 | |
| @ai-sdk/google | npm | Vercel AI SDK | 0.0.0 | |
| @ai-sdk/anthropic | npm | Vercel AI SDK | 0.0.0 | |
| gpt-researcher | PyPI | AutoGen / AG2, Hugging Face Hub / Transformers, LangChain, LangGraph, LiteLLM, Model Context Protocol SDK, Ollama client, OpenAI SDK | 0.2.2 | |
| @ai-sdk/provider | npm | Vercel AI SDK | 0.0.0 | |
| langchain-postgres | PyPI | LangChain, pgvector | 0.0.1 |
Topics that moved
Largest increases over the mean of the 4 previous weeks, for topics with at least 3 records in the week.No topic had at least 3 records in this week and more than its mean over the 4 previous weeks.
Research
Peer-reviewed first, then newest.No research papers or reports were published in this week.
Policy and regulation
Newest first.No regulatory or policy records were published in this week.
Generated from the AI Sec Watch database at . Every item links to its record.