CVE-2025-3578 Adversarial Input Handling Vulnerability in AiDex

A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in the application, list credentials of users in production or development environments. In addition, it would be possible to cause bugs that would result in the...

CVE-2025-3578 Adversarial Input Handling Vulnerability in AiDex

A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in the application, list credentials of users in production or development environments. In addition, it would be possible to cause bugs that would result in the...

Top 10 for LLM & Gen AI Project Ranked by OWASP

Trend Micro has become a Gold sponsor of the OWASP Top 10 for LLM and Gen AI Project, merging cybersecurity expertise with OWASP's collaborative efforts to address emerging AI security risks. This partnership underscores Trend Micro's unwavering commitment to advancing AI security, ensuring a...

Wallarm Research Releases Nuclei Template to Counter Threats Targeting LLM Apps

Wallarm Research has just released a powerful new Nuclei template targeting a new kind of exposure: the Model Context Protocol MCP. This isn’t about legacy devtools or generic JSON-RPC pinging. It’s about the protocol fueling next-gen LLM applications — and it’s already showing up exposed in the...

Prompt Engineering Techniques with Spring AI

This blog post demonstrates practical implementations of Prompt Engineering techniques using Spring AI. The examples and patterns in this article are based on the comprehensive Prompt Engineering Guide that covers the theory, principles, and patterns of effective prompt engineering. The blog show...

CVE-2024-12720 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-tensorrtllm-24.04...

Unspecified Vulnerability in GPT Academic

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a security vulnerability that originates from a specially crafted zip bomb upload that can be exploited by an attacker to cause a memory exhaustion crash...

CVE-2024-8196

In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace...

rails-mcp-server

Rails MCP Server A Ruby implementation of a Model Context Pro...

GHSA-879V-FGGM-VXW2 LiteLLM Has a Leakage of Langfuse API Keys

In berriai/litellm version v1.52.1, an issue in proxyserver.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfusesecret and langfusepublickey, which can provide full access to the Langfuse...

dsipts (>=1.1.5, <=1.1.19), llm-toys (0.1.1) +2 more potentially affected by CVE-2025-0190 via aim (>=3.17.4, <=3.20.1)

aim PYPI version =3.17.4, =1.1.5, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2025-0190 Source advisory: OSV:GHSA-FM93-G6XP-35XQ...

dsipts (>=1.1.5, <=1.1.19), llm-toys (0.1.1) +2 more potentially affected by CVE-2025-0189 via aim (>=3.17.4, <=3.20.1)

aim PYPI version =3.17.4, =1.1.5, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2025-0189 Source advisory: OSV:GHSA-J5QJ-RG5J-J7C2...

dsipts (>=1.1.5, <=1.1.19), llm-toys (0.1.1) +2 more potentially affected by CVE-2025-0190 via aim (>=3.17.4, <=3.20.1)

aim PYPI version =3.17.4, =1.1.5, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2025-0190 Source advisory: GHSA-FM93-G6XP-35XQ...

askdoc (0.1.1), chat-with-mlx (>=0.1.6, <=0.1.11) +1 more potentially affected by CVE-2024-8966 via gradio (4.19.2)

gradio PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - askdoc 0.1.1 - chat-with-mlx =0.1.6, =0.1.11 - hugegraph-llm 1.3.0 Source cves: CVE-2024-8966 Source advisory: OSV:GHSA-5CPQ-9538-JM2J...

aqueduct-llm (0.0.1), fschat (>=0.1.1, <=0.2.15) +3 more potentially affected by CVE-2024-8966 via gradio (3.23.0)

gradio PYPI version 3.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - aqueduct-llm 0.0.1 - fschat =0.1.1, =0.0.1, =0.0.16 Source cves: CVE-2024-8966 Source advisory: OSV:GHSA-5CPQ-9538-JM2J...

dsipts (>=1.1.5, <=1.1.19), llm-toys (0.1.1) +2 more potentially affected by CVE-2024-8769 via aim (>=3.17.4, <=3.20.1)

aim PYPI version =3.17.4, =1.1.5, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-8769 Source advisory: GHSA-4QCX-JX49-6QRH...

dsipts (>=1.1.5, <=1.1.19), llm-toys (0.1.1) +2 more potentially affected by CVE-2024-8769 via aim (>=3.17.4, <=3.20.1)

aim PYPI version =3.17.4, =1.1.5, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-8769 Source advisory: OSV:GHSA-4QCX-JX49-6QRH...

aqueduct-llm (0.0.1), fschat (>=0.1.1, <=0.2.15) +3 more potentially affected by CVE-2024-8021 via gradio (3.23.0)

gradio PYPI version 3.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - aqueduct-llm 0.0.1 - fschat =0.1.1, =0.0.1, =0.0.16 Source cves: CVE-2024-8021 Source advisory: OSV:GHSA-7V2W-H4GH-W5CV...

dsipts (>=1.1.5, <=1.1.19), llm-toys (0.1.1) +2 more potentially affected by CVE-2024-8061 via aim (>=3.17.4, <=3.20.1)

aim PYPI version =3.17.4, =1.1.5, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-8061 Source advisory: OSV:GHSA-6W7P-XRVP-P7XV...

dsipts (>=1.1.5, <=1.1.19), llm-toys (0.1.1) +2 more potentially affected by CVE-2024-7760 via aim (>=3.17.4, <=3.20.1)

aim PYPI version =3.17.4, =1.1.5, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-7760 Source advisory: GHSA-38R9-3J52-H92V...