What changed in AI security, Apr 15 to Apr 21, 2024
Apr 15 to Apr 21, 2024 (ISO week 2024-W16). Weeks run Monday to Sunday in UTC.
16 records published, +7 on the previous week: 15 vulnerabilities (+6), 0 incidents (no change), 0 research items (no change), 1 news item (+1), 0 policy items (no change).
Critical and high advisories
Vulnerability records rated critical or high, newest first.- High
CVE-2024-31583: Pytorch use-after-free vulnerability in mobile interpreter
CVE-2024-31583NVD/CVE Database - Critical
CVE-2024-3660: TensorFlow Keras arbitrary code injection through crafted models
CVE-2024-3660NVD/CVE Database - Critical
CVE-2024-3573: mlflow/mlflow local file inclusion through improper URI parsing
CVE-2024-3573NVD/CVE Database - High
CVE-2024-3571: langchain-ai/langchain path traversal in LocalFileStore mset and mget methods
CVE-2024-3571NVD/CVE Database - Critical
CVE-2024-2912: BentoML insecure deserialization leading to remote code execution via POST
CVE-2024-2912NVD/CVE Database - High
CVE-2024-1594: mlflow path traversal through fragment in artifact_location
CVE-2024-1594NVD/CVE Database - High
CVE-2024-1593: mlflow/mlflow path traversal through URL params using semicolon smuggling
CVE-2024-1593NVD/CVE Database - High
CVE-2024-1561: Gradio local file read through /component_server endpoint
CVE-2024-1561NVD/CVE Database - High
CVE-2024-1560: mlflow path traversal in artifact deletion allows arbitrary directory deletion
CVE-2024-1560NVD/CVE Database - High
CVE-2024-1558: MLflow path traversal in model version creation via source parameter
CVE-2024-1558NVD/CVE Database - High
CVE-2024-1483: mlflow path traversal through crafted artifact_location and source parameters
CVE-2024-1483NVD/CVE Database - Critical
GHSA-r6gp-rff2-p3hf: llama-index-core Command Injection vulnerability
CVE-2024-3271GitHub Advisory Database
Exploitation signals
Vulnerabilities published in the week that are listed in the CISA Known Exploited Vulnerabilities catalog or have an EPSS score of 10% or more.No vulnerability published in this week is listed as exploited or has an EPSS score of 10% or more.
Packages that began delegating to a language model
Exposure Registry packages whose first release declaring an LLM SDK, agent framework or MCP dependency was published in the week.| Package | Ecosystem | LLM SDKs | Release | Released |
|---|---|---|---|---|
| inspect-ai | PyPI | Anthropic SDK, Azure AI Inference / Azure OpenAI SDK, Google Gemini SDK, Groq SDK, Hugging Face Hub / Transformers, Model Context Protocol SDK, Mistral AI SDK, OpenAI SDK, Together AI SDK, xAI SDK | 0.3.2 | |
| langchain-rust | crates.io | LangChain | 4.0.0 |
Topics that moved
Largest increases over the mean of the 4 previous weeks, for topics with at least 3 records in the week.No topic had at least 3 records in this week and more than its mean over the 4 previous weeks.
Research
Peer-reviewed first, then newest.No research papers or reports were published in this week.
Policy and regulation
Newest first.No regulatory or policy records were published in this week.
Generated from the AI Sec Watch database at . Every item links to its record.