What changed in AI security, Jun 3 to Jun 9, 2024
Jun 3 to Jun 9, 2024 (ISO week 2024-W23). Weeks run Monday to Sunday in UTC.
30 records published, +24 on the previous week: 29 vulnerabilities (+24), 0 incidents (no change), 0 research items (no change), 0 news items (-1), 1 policy item (+1).
Critical and high advisories
Vulnerability records rated critical or high, newest first.- High
CVE-2024-5187: onnx/onnx arbitrary file overwrite via path traversal in tar extraction
CVE-2024-5187NVD/CVE Database - High
CVE-2024-4888: BerriAI litellm arbitrary file deletion through /audio/transcriptions endpoint
CVE-2024-4888NVD/CVE Database - Critical
CVE-2024-3234: gaizhenbiao/chuanhuchatgpt path traversal through outdated gradio component
CVE-2024-3234NVD/CVE Database - High
CVE-2024-3095: langchain Web Research Retriever SSRF to local and internal addresses
CVE-2024-3095NVD/CVE Database - High
CVE-2024-2928: mlflow/mlflow local file inclusion through URI fragment traversal
CVE-2024-2928NVD/CVE Database - High
CVE-2024-0520: MLflow command injection when loading dataset from HTTP source URL
CVE-2024-0520NVD/CVE Database - Critical
CVE-2024-5452: pytorch-lightning remote code execution via deepdiff Delta input
CVE-2024-5452NVD/CVE Database - High
CVE-2024-4941: Gradio JSON component local file inclusion via postprocess
CVE-2024-4941NVD/CVE Database - High
CVE-2024-4325: Gradio SSRF through the queue/join endpoint and save_url_to_cache
CVE-2024-4325NVD/CVE Database - High
CVE-2024-4254: gradio-app/gradio deploy-website.yml secrets exfiltration via fork checkout
CVE-2024-4254NVD/CVE Database - High
CVE-2024-37061: MLflow remote code execution through maliciously crafted MLproject
CVE-2024-37061NVD/CVE Database - High
CVE-2024-37060: MLflow deserialization of untrusted data via malicious Recipe
CVE-2024-37060NVD/CVE Database - High
CVE-2024-37059: MLflow deserialization of untrusted data via malicious PyTorch model
CVE-2024-37059NVD/CVE Database - High
CVE-2024-37058: MLflow deserialization of untrusted data via Langchain AgentExecutor model
CVE-2024-37058NVD/CVE Database - High
CVE-2024-37057: MLflow deserialization flaw allows code execution via TensorFlow model
CVE-2024-37057NVD/CVE Database - High
CVE-2024-37056: MLflow deserialization of untrusted data via uploaded LightGBM model
CVE-2024-37056NVD/CVE Database - High
CVE-2024-37055: MLflow deserialization flaw allows code execution via pmdarima
CVE-2024-37055NVD/CVE Database - High
CVE-2024-37054: MLflow deserialization of untrusted data via malicious PyFunc model
CVE-2024-37054NVD/CVE Database - High
CVE-2024-37053: MLflow deserialization of untrusted data via scikit-learn model
CVE-2024-37053NVD/CVE Database - High
CVE-2024-37052: MLflow deserialization of untrusted data via uploaded scikit-learn model
CVE-2024-37052NVD/CVE Database - High
CVE-2024-37065: skops python library deserialization of untrusted data via malicious model
CVE-2024-37065NVD/CVE Database - Critical
CVE-2024-4253: gradio-app/gradio command injection in test-functional.yml workflow
CVE-2024-4253NVD/CVE Database - Critical
CVE-2024-3829: qdrant arbitrary file read and write during snapshot recovery
CVE-2024-3829NVD/CVE Database
Exploitation signals
Vulnerabilities published in the week that are listed in the CISA Known Exploited Vulnerabilities catalog or have an EPSS score of 10% or more.| Advisory | Exploitation | EPSS | Published |
|---|---|---|---|
| CVE-2024-4325: Gradio SSRF through the queue/join endpoint and save_url_to_cache CVE-2024-4325NVD/CVE Database | Not listed | 37.1% | |
| CVE-2024-5452: pytorch-lightning remote code execution via deepdiff Delta input CVE-2024-5452NVD/CVE Database | Not listed | 26.8% | |
| CVE-2024-2928: mlflow/mlflow local file inclusion through URI fragment traversal CVE-2024-2928NVD/CVE Database | Not listed | 21.8% |
Packages that began delegating to a language model
Exposure Registry packages whose first release declaring an LLM SDK, agent framework or MCP dependency was published in the week.| Package | Ecosystem | LLM SDKs | Release | Released |
|---|---|---|---|---|
| graphrag-sdk | PyPI | Anthropic SDK, Cohere SDK, LiteLLM, OpenAI SDK | 0.1.0 |
Topics that moved
Largest increases over the mean of the 4 previous weeks, for topics with at least 3 records in the week.No topic had at least 3 records in this week and more than its mean over the 4 previous weeks.
Research
Peer-reviewed first, then newest.No research papers or reports were published in this week.
Policy and regulation
Newest first.Generated from the AI Sec Watch database at . Every item links to its record.