2 CRIT · 8 HIGH · 1 MED · 1 INFO · THREAT RED · 12 items · Generated in 223s
Patch bypass allows unauthenticated remote code execution on default Flowise deployments via npx auto-install.
Unsanitized input lets attackers inject Stata shell commands and get OS-level RCE on the server account.
Unauthenticated requests can trigger regex-based CPU exhaustion and stall structured output serving until vLLM is upgraded.
One API call can trigger many backend requests, enabling authenticated DoS and bypassing request-budget controls.
An authenticated client can send one crafted request to exhaust vLLM server resources and disrupt inference availability.
A batching bug can leak one user's prompt or output to another user in the same inference batch.
Concurrent requests can bypass sparse tensor safety checks in vLLM and let invalid tensors reach execution paths.
Unauthenticated requests can leak server paths, usernames, Python details, and code structure that help attackers target the host.
Hidden instructions in Word docs can hijack Copilot and replicate into new documents, spreading prompt injection across workflows.
Active exploitation of an Adobe Commerce flaw could let attackers take over customer accounts on affected stores.
A model tuned to reduce exploit-related refusals can lower barriers to harmful vulnerability research and weaponization.
This is a security practice update, not a direct AI vulnerability or exploit, so it mainly informs team operations.