What changed in AI security, Nov 18 to Nov 24, 2024
Nov 18 to Nov 24, 2024 (ISO week 2024-W47). Weeks run Monday to Sunday in UTC.
6 records published, +1 on the previous week: 4 vulnerabilities (+1), 0 incidents (no change), 1 research item (-1), 0 news items (no change), 1 policy item (+1).
Critical and high advisories
Vulnerability records rated critical or high, newest first.- High
CVE-2024-11394: Hugging Face Transformers Trax model deserialization remote code execution
CVE-2024-11394NVD/CVE Database - High
CVE-2024-11393: Hugging Face Transformers MaskFormer deserialization flaw enables code execution
CVE-2024-11393NVD/CVE Database - High
CVE-2024-11392: Hugging Face Transformers MobileViTV2 deserialization leads to code execution
CVE-2024-11392NVD/CVE Database - High
CVE-2024-52803: LLama Factory remote OS command injection in the training process
CVE-2024-52803NVD/CVE Database
Exploitation signals
Vulnerabilities published in the week that are listed in the CISA Known Exploited Vulnerabilities catalog or have an EPSS score of 10% or more.No vulnerability published in this week is listed as exploited or has an EPSS score of 10% or more.
Packages that began delegating to a language model
Exposure Registry packages whose first release declaring an LLM SDK, agent framework or MCP dependency was published in the week.| Package | Ecosystem | LLM SDKs | Release | Released |
|---|---|---|---|---|
| @ai-sdk/openai-compatible | npm | Vercel AI SDK | 0.0.1 | |
| xgrammar | PyPI | Hugging Face Hub / Transformers | 0.1.0 | |
| mcp-server-fetch | PyPI | Model Context Protocol SDK | 0.1.0 | |
| mcp | PyPI | Model Context Protocol SDK | 0.9.1 | |
| @modelcontextprotocol/server-slack | npm | Model Context Protocol SDK | 0.1.0 | |
| @modelcontextprotocol/server-postgres | npm | Model Context Protocol SDK | 0.1.0 | |
| @ai-sdk/xai | npm | Vercel AI SDK | 1.0.0-canary.1 |
Topics that moved
Largest increases over the mean of the 4 previous weeks, for topics with at least 3 records in the week.No topic had at least 3 records in this week and more than its mean over the 4 previous weeks.
Research
Peer-reviewed first, then newest.Policy and regulation
Newest first.Generated from the AI Sec Watch database at . Every item links to its record.