Skip to content

What changed in AI security, Dec 29, 2025 to Jan 4, 2026

Dec 29, 2025 to Jan 4, 2026 (ISO week 2026-W01). Weeks run Monday to Sunday in UTC.

23 records published, -1 on the previous week: 4 vulnerabilities (-11), 0 incidents (no change), 17 research items (+8), 2 news items (+2), 0 policy items (no change).

Critical and high advisories

Vulnerability records rated critical or high, newest first.

Exploitation signals

Vulnerabilities published in the week that are listed in the CISA Known Exploited Vulnerabilities catalog or have an EPSS score of 10% or more.
AdvisoryExploitationEPSSPublished
CVE-2026-21445: Langflow missing authentication on API endpoints exposes user data
CVE-2026-21445NVD/CVE Database
Not listed33.3%

Packages that began delegating to a language model

Exposure Registry packages whose first release declaring an LLM SDK, agent framework or MCP dependency was published in the week.
PackageEcosystemLLM SDKsReleaseReleased
sauerkrautlm-colpaliPyPIHugging Face Hub / Transformers0.1.0

Topics that moved

Largest increases over the mean of the 4 previous weeks, for topics with at least 3 records in the week.

No topic had at least 3 records in this week and more than its mean over the 4 previous weeks.

Research

Peer-reviewed first, then newest. Showing 8 of 17.

Policy and regulation

Newest first.

No regulatory or policy records were published in this week.

Generated from the AI Sec Watch database at . Every item links to its record.

RSS feed of weekly changesPrevious week