What changed in AI security, Oct 28 to Nov 3, 2024
Oct 28 to Nov 3, 2024 (ISO week 2024-W44). Weeks run Monday to Sunday in UTC.
9 records published, +1 on the previous week: 9 vulnerabilities (+2), 0 incidents (no change), 0 research items (no change), 0 news items (-1), 0 policy items (no change).
Critical and high advisories
Vulnerability records rated critical or high, newest first.- High
CVE-2024-39722: Ollama path traversal in api/push route exposes server file existence
CVE-2024-39722NVD/CVE Database - High
CVE-2024-39721: Ollama infinite goroutine via blocking file path in CreateModelHandler
CVE-2024-39721NVD/CVE Database - High
CVE-2024-39720: Ollama crash via malformed GGUF file in CreateModel route
CVE-2024-39720NVD/CVE Database - High
CVE-2024-39719: Ollama file existence disclosure via api/create
CVE-2024-39719NVD/CVE Database - Critical
CVE-2024-42835: langflow remote code execution via the PythonCodeTool component
CVE-2024-42835NVD/CVE Database - Critical
CVE-2024-48063: PyTorch RemoteModule deserialization remote code execution
CVE-2024-48063NVD/CVE Database - Critical
CVE-2024-8309: langchain GraphCypherQAChain SQL injection through prompt injection
CVE-2024-8309NVD/CVE Database - Critical
CVE-2024-7774: langchainjs path traversal in getFullPath method
CVE-2024-7774NVD/CVE Database - Critical
CVE-2024-7042: langchainjs GraphCypherQAChain prompt injection leading to SQL injection
CVE-2024-7042NVD/CVE Database
Exploitation signals
Vulnerabilities published in the week that are listed in the CISA Known Exploited Vulnerabilities catalog or have an EPSS score of 10% or more.| Advisory | Exploitation | EPSS | Published |
|---|---|---|---|
| CVE-2024-8309: langchain GraphCypherQAChain SQL injection through prompt injection CVE-2024-8309NVD/CVE Database | Not listed | 13.7% |
Packages that began delegating to a language model
Exposure Registry packages whose first release declaring an LLM SDK, agent framework or MCP dependency was published in the week.| Package | Ecosystem | LLM SDKs | Release | Released |
|---|---|---|---|---|
| @llamaindex/node-parser | npm | LlamaIndex | 0.0.1 | |
| @llamaindex/workflow | npm | LlamaIndex | 0.0.2 | |
| openlit | PyPI | Anthropic SDK, OpenAI SDK | 1.27.0 |
Topics that moved
Largest increases over the mean of the 4 previous weeks, for topics with at least 3 records in the week.| Topic | Records | Weekly mean, previous 4 | Difference |
|---|---|---|---|
| Inference infrastructure | 4 | 0.3 | +3.8 |
Research
Peer-reviewed first, then newest.No research papers or reports were published in this week.
Policy and regulation
Newest first.No regulatory or policy records were published in this week.
Generated from the AI Sec Watch database at . Every item links to its record.