2007 matches found
CVE-2026-102274 vulnerabilities
Vulnerabilities for packages: datahub-ingestion, netbox-fips, nemo-rl-cuda-13.0, airflow-core, authentik, openstack-cinder-2026.1, openstack-keystone-2025.1-fips, openstack-octavia-2025.2, openstack-placement-2025.1-fips, kserve-huggingfaceserver-cuda-13.3, azureml-inference-server-http,...
GHSA-P4G4-X82P-Q773 vulnerabilities
Vulnerabilities for packages: datahub-ingestion, netbox-fips, nemo-rl-cuda-13.0, airflow-core, authentik, openstack-cinder-2026.1, openstack-keystone-2025.1-fips, openstack-octavia-2025.2, openstack-placement-2025.1-fips, kserve-huggingfaceserver-cuda-13.3, azureml-inference-server-http,...
GHSA-2GX3-RCP4-G85Q vulnerabilities
Vulnerabilities for packages: datahub-ingestion, netbox-fips, nemo-rl-cuda-13.0, airflow-core, authentik, openstack-cinder-2026.1, openstack-keystone-2025.1-fips, openstack-octavia-2025.2, openstack-placement-2025.1-fips, kserve-huggingfaceserver-cuda-13.3, azureml-inference-server-http,...
CVE-2026-102271 vulnerabilities
Vulnerabilities for packages: datahub-ingestion, netbox-fips, nemo-rl-cuda-13.0, airflow-core, authentik, openstack-cinder-2026.1, openstack-keystone-2025.1-fips, openstack-octavia-2025.2, openstack-placement-2025.1-fips, kserve-huggingfaceserver-cuda-13.3, azureml-inference-server-http,...
CVE-2026-103270
LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...
CVE-2026-103270 LightLLM through 1.2.0 Missing Authentication on RL Control Routes
LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...
EUVD-2026-89989
LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...
CVE-2026-103270
LightLLM versions up to and including 1.2.0 are vulnerable to a missing authentication flaw on reinforcement learning (RL) control routes. When deployments are started with the --enable_rl flag, the software mounts specific control routes on the public HTTP API without requiring authentication ch...
CVE-2026-103270 LightLLM through 1.2.0 Missing Authentication on RL Control Routes
LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...
Important: Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (rocm)
Red Hat AI Inference Server 3.2.2 rocm is now available. Red Hat® AI Inference Server...
Important: Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (cuda)
Red Hat AI Inference Server 3.2.2 cuda is now available. Red Hat® AI Inference Server...
Important: Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
Red Hat AI Inference Server Model Optimization Tools 3.2.2 CUDA is now available. Red Hat® AI Inference Server Model Optimization Tools...
Link Inference Attack on Privacy-Preserving Knowledge Graphs
Knowledge Graphs KGs are widely used to store and share structured information across sensitive domains such as healthcare, fi- nance, and social networks. A common privacy practice is to delete sen- sitive relations before publishing the graph, under the assumption that removing edges is...
CVE-2026-103270: Missing Authentication for Critical Function
LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...
PT-2026-103286
LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause generation, /abort request, /flush cache, and /init weights update group to disrupt inference operations and wedge...
argostranslate (>=1.4.0, <=1.9.5), audim (>=0.0.6, <=0.0.7) +64 more potentially affected by CVE-2026-102567 via ctranslate2 (>=1.20.1, <=4.7.2)
ctranslate2 PYPI version =1.20.1, =1.4.0, =0.0.6, =0.2.1, =2.1.0, =0.0.1, =1.4.0, =0.0.9, =0.1.0, =0.2.0, =0.3.1, =0.0.15, =0.0.30 and more Source cves: CVE-2026-102567 Source advisory: MEND:CVE-2026-102567...
Deep Learning Latency Attacks and Defenses: A Cross-Domain Survey of Availability Threats
Adversarial machine learning has focused mainly on integrity, but availability is an increasingly consequential complement. Latency attacks also energy-latency attacks increase inference-time work, energy, or response time, causing deadline misses, throughput collapse, or resource exhaustion in...
GAZEleak: Passcode Inference against Eye-Tracking XR Devices through External Observation
Mixed-reality headsets such as Apple Vision Pro replace the touch screen with gaze-as-pointer interaction: the wearer looks at a target and confirms with an air pinch. Because the display is inside the headset and the eye tracker is walled off from third-party software, such input is widely assum...
Inference-Layer Security: Defending against Adversarial Inference and Infrastructure Abuse
A Technical Report: Operating a large language model LLM as a service requires more than inference infrastructure: the provider must also defend against adversarial interactions that seek to exploit the service, including jailbreaking for harmful use, sophisticated denial of service, and...
CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering
Indirect prompt injection makes an LLM agent treat untrusted retrieved text as instructions. We present CounterSteer, an inference-time defense that suppresses this behavior inside the model. Per model, a five-step recipe fits a residual-stream direction from paired episodes differing only in...