What changed in AI security, May 27 to Jun 2, 2024
May 27 to Jun 2, 2024 (ISO week 2024-W22). Weeks run Monday to Sunday in UTC.
6 records published, no change on the previous week: 5 vulnerabilities (+1), 0 incidents (no change), 0 research items (no change), 1 news item (no change), 0 policy items (-1).
Critical and high advisories
Vulnerability records rated critical or high, newest first.- High
CVE-2024-5565: Vanna prompt injection leads to remote code execution via ask method
CVE-2024-5565NVD/CVE Database - High
CVE-2024-37032: Ollama path traversal in digest validation when getting model path
CVE-2024-37032NVD/CVE Database - High
CVE-2024-3924: A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the…
CVE-2024-3924NVD/CVE Database - High
CVE-2024-3584: qdrant path traversal in snapshot upload endpoint
CVE-2024-3584NVD/CVE Database - High
CVE-2024-5185: EmbedAI data poisoning through CSRF via malicious webpage
CVE-2024-5185NVD/CVE Database
Exploitation signals
Vulnerabilities published in the week that are listed in the CISA Known Exploited Vulnerabilities catalog or have an EPSS score of 10% or more.| Advisory | Exploitation | EPSS | Published |
|---|---|---|---|
| CVE-2024-37032: Ollama path traversal in digest validation when getting model path CVE-2024-37032NVD/CVE Database | Not listed | 89.6% | |
| CVE-2024-5565: Vanna prompt injection leads to remote code execution via ask method CVE-2024-5565NVD/CVE Database | Not listed | 15.2% |
Packages that began delegating to a language model
Exposure Registry packages whose first release declaring an LLM SDK, agent framework or MCP dependency was published in the week.| Package | Ecosystem | LLM SDKs | Release | Released |
|---|---|---|---|---|
| optimum-quanto | PyPI | Hugging Face Hub / Transformers | 0.2.1 | |
| mlflow | PyPI | FastMCP, LangChain | 2.13.1 | |
| mlflow-skinny | PyPI | FastMCP, LangChain | 2.13.1 | |
| rig-core | crates.io | Rig | 0.0.0 | |
| sqlframe | PyPI | OpenAI SDK | 1.3.0 |
Topics that moved
Largest increases over the mean of the 4 previous weeks, for topics with at least 3 records in the week.No topic had at least 3 records in this week and more than its mean over the 4 previous weeks.
Research
Peer-reviewed first, then newest.No research papers or reports were published in this week.
Policy and regulation
Newest first.No regulatory or policy records were published in this week.
Generated from the AI Sec Watch database at . Every item links to its record.