CVE-2026-49121

CVE-2026-49121 affects AI Tensor Engine for ROCm (AITER) up to version 0.1.14. The vulnerability exists in the MessageQueue.recv() function in shm_broadcast.py, where an unauthenticated remote attacker can deliver a crafted pickle payload to a ZMQ SUB socket (no authentication, no HMAC, no format...

CVE-2026-49121 AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization

AI Tensor Engine for ROCm AITER through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv function within shmbroadcast.py that allows unauthenticated remote attackers to execute arbitrary code by sending a malicious pickle payload to a ZMQ SUB socket...

SGLang security vulnerabilities

SGLang is a programming language and runtime system developed by SGL-project, aimed at accelerating large model inference. Version SGLang 0.5.10.post1 contains a security vulnerability. This vulnerability stems from an unknown function in the Inference HTTP Endpoint component file...

SkillGuard: A Permission Framework for Agent Skills

Agent skills extend LLM agents with reusable instructions, scripts, tool bindings, and contextual dependencies. However, current skill ecosystems largely rely on trust-based loading and static inspection, leaving a gap between what a skill can inject into an agent's context and what it can cause...

PT-2026-45663

Name of the Vulnerable Software and Affected Versions SGLang version 0.5.10.post1 Description A flaw exists in the Inference HTTP Endpoint component within the file python/sglang/srt/lora/lora manager.py. Remote manipulation of the lora path argument can trigger a reachable assertion, potentially...

CVE-2026-10300: Reachable Assertion

A security vulnerability has been detected in SGLang 0.5.10.post1. Impacted is an unknown function of the file python/sglang/srt/lora/loramanager.py of the component Inference HTTP Endpoint. Such manipulation of the argument lorapath leads to reachable assertion. The attack can be launched...

NVIDIA Triton Inference Server Memory Consumption DoS

The vulnerability of the software for deploying and executing NVIDIA Triton Inference Server previously known as TensorRT Inference Server is related to uncontrolled memory consumption. Exploiting this vulnerability can allow a malicious actor, operating remotely, to trigger a service failure...

NVIDIA Triton Inference Server Synchronization Error

The vulnerability of the software for deploying and executing AI models in NVIDIA Triton Inference Server previously known as TensorRT Inference Server stems from synchronization errors when using a shared resource. Exploiting this vulnerability can allow a malicious actor to cause service failur...

NVIDIA Triton Inference Server Synchronization Error

The vulnerability of the software for deploying and executing AI models in NVIDIA Triton Inference Server previously known as TensorRT Inference Server stems from synchronization errors when using a shared resource. Exploiting this vulnerability can allow a malicious actor to cause service failur...

pharia-data-sdk (>=0.1.1, <=0.1.6), pharia-inference-sdk (>=0.1.2, <=0.1.6) +1 more potentially affected by CVE-2026-45017 via python-liquid (1.9.4)

python-liquid PYPI version 1.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - pharia-data-sdk =0.1.1, =0.1.2, =0.1.0, =0.1.7 Source cves: CVE-2026-45017 Source advisory: OSV:PYSEC-2026-192...

pharia-inference-sdk (0.1.0), solace-agent-mesh (>=1.8.0, <=1.26.0) potentially affected by CVE-2026-45017 via python-liquid (>=2.0.2, <=2.1.0)

python-liquid PYPI version =2.0.2, =1.8.0, =1.26.0 Source cves: CVE-2026-45017 Source advisory: OSV:PYSEC-2026-192...

Protecting On-Device AI Inference: A Systematic Review of Attacks and Defence Mechanisms

The need for secure and private Artificial Intelligence AI and Machine Learning ML on edge and mobile devices has increased the necessity of protecting the architecture of these systems from threats to both security and privacy. With an ever-increasing number of pre-trained AI models being used o...

swimtrack-poc

SwimTrack PoC This directory contains a proof of concept for...

Distributed AI Inference: Why Placement Is the New Bottleneck

In real AI systems, bottlenecks don't disappear, they move. Learn about why inference placement, not raw compute, is the decisive infrastructure question...

On Reliability of Efficient Membership Inference Vulnerability Evaluation

Membership inference attacks MIAs are popular methods for empirically assessing the leakage of sensitive information in the training data through models or statistics learned from the data. The MIA vulnerability is often evaluated through false positive rate FPR and true positive rate TPR of a...

EUVD-2026-31493

The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trustremotecode=True when loading model tokenizers, and runs without sandboxing. This causes transformers.AutoTokenizer.frompretrained to import and execute arbitrary Python files included in any model pulled fr...

CVE-2026-5817

CVE-2026-5817 affects the vllm-metal backend used by Docker Model Runner on macOS. The backend loads model tokenizers with trust_remote_code=True, causing transformers.AutoTokenizer.from_pretrained() to import and execute arbitrary Python files from models pulled from an OCI registry. This can en...

AI Security Research Should Better Incentivize Defense Research

This work examines an imbalance in artificial intelligence AI security research: the field tends to produce more work on attacking AI systems than on defending them. Drawing on related academic papers, we find biased attack-to-defense ratios across subfields, including federated learning, speech...

CVE-2026-5843: Inclusion of Functionality from Untrusted Control Sphere

The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the modelfile configuration field in config.json. When a model's config.json specifies a modelfile pointing to a Python...

Docker Desktop < 4.71.0 Container Escape (CVE-2026-5843)

The version of Docker Desktop installed on the remote host is prior to 4.71.0. It is, therefore, affected by a container escape vulnerability: - A container-to-host code execution vulnerability exists in the Docker Model Runner MLX inference backend. An attacker with access to a container could...