What changed in AI security, Jul 1 to Jul 7, 2024
Jul 1 to Jul 7, 2024 (ISO week 2024-W27). Weeks run Monday to Sunday in UTC.
9 records published, +4 on the previous week: 8 vulnerabilities (+3), 0 incidents (no change), 0 research items (no change), 0 news items (no change), 1 policy item (+1).
Critical and high advisories
Vulnerability records rated critical or high, newest first.- Critical
CVE-2024-39236: Gradio code injection via component_meta.py
CVE-2024-39236NVD/CVE Database - High
CVE-2024-36421: Flowise CORS misconfiguration allowing arbitrary origin access
CVE-2024-36421NVD/CVE Database - High
CVE-2024-36420: Flowise arbitrary file read through /api/v1/openai-assistants-file endpoint
CVE-2024-36420NVD/CVE Database
Exploitation signals
Vulnerabilities published in the week that are listed in the CISA Known Exploited Vulnerabilities catalog or have an EPSS score of 10% or more.No vulnerability published in this week is listed as exploited or has an EPSS score of 10% or more.
Packages that began delegating to a language model
Exposure Registry packages whose first release declaring an LLM SDK, agent framework or MCP dependency was published in the week.| Package | Ecosystem | LLM SDKs | Release | Released |
|---|---|---|---|---|
| @langchain/baidu-qianfan | npm | LangChain | 0.0.1 | |
| github.com/firebase/genkit/go | Go | Genkit | v0.0.1 | |
| @azure-rest/ai-inference | npm | Azure AI Inference / Azure OpenAI SDK | 1.0.0-beta.1 |
Topics that moved
Largest increases over the mean of the 4 previous weeks, for topics with at least 3 records in the week.No topic had at least 3 records in this week and more than its mean over the 4 previous weeks.
Research
Peer-reviewed first, then newest.No research papers or reports were published in this week.
Policy and regulation
Newest first.Generated from the AI Sec Watch database at . Every item links to its record.