PT-2025-18649 · Nvidia · Nvidia Tensorrt-Llm +1

Name of the Vulnerable Software and Affected Versions: NVIDIA TensorRT-LLM affected versions not specified NVIDIA vGPU software affected versions not specified Description: The issue concerns a data validation problem in the python executor of NVIDIA TensorRT-LLM, which can be exploited by an...

PT-2025-18651

Name of the Vulnerable Software and Affected Versions NVIDIA TensorRT-LLM affected versions not specified Description The issue concerns a data validation problem in the python executor of NVIDIA TensorRT-LLM, which can be exploited by an attacker with local access to the TRTLLM server. A...

NVIDIA TensorRT-LLM 代码问题漏洞

NVIDIA TensorRT-LLM is a high-performance inference acceleration library from NVIDIA for defining, optimizing, and executing inference in production environments for large language models LLMs. A code issue vulnerability exists in NVIDIA TensorRT-LLM that stems from insufficient data validation a...

CVE-2025-46560

CVE-2025-46560 affects vLLM 0.8.0–0.8.4, where the multimodal tokenizer’s input preprocessing uses placeholder tokens replaced by repeated tokens. The replacement logic relies on inefficient list concatenation, yielding quadratic time complexity (O(n²)) and enabling resource exhaustion via crafte...

GHSA-HJ4W-HM2G-P6W5 vLLM Vulnerable to Remote Code Execution via Mooncake Integration

Impacted Deployments Note that vLLM instances that do NOT make use of the mooncake integration are NOT vulnerable. Description vLLM integration with mooncake is vaulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. The vulnerable sockets were...

Akamai Firewall for AI: Get Powerful Protection for New LLM App Threats

Protect against LLM attacks such as prompt injection, exfiltration and extraction, and toxic AI outputs with Akamai Firewall for AI...

Adversarial Attacks on LLM-As-A-Judge Systems: Insights from Prompt Injections

LLM as judge systems used to assess text quality code correctness and argument strength are vulnerable to prompt injection attacks. We introduce a framework that separates content author attacks from system prompt attacks and evaluate five models Gemma 3.27B Gemma 3.4B Llama 3.2 3B GPT 4 and Clau...

CVE-2025-3578

A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in the application, list credentials of users in production or development environments. In addition, it would be possible to cause bugs that would result in the...

CVE-2025-3578 Adversarial Input Handling Vulnerability in AiDex

A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in the application, list credentials of users in production or development environments. In addition, it would be possible to cause bugs that would result in the...

CVE-2025-3578 Adversarial Input Handling Vulnerability in AiDex

A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in the application, list credentials of users in production or development environments. In addition, it would be possible to cause bugs that would result in the...

Top 10 for LLM & Gen AI Project Ranked by OWASP

Trend Micro has become a Gold sponsor of the OWASP Top 10 for LLM and Gen AI Project, merging cybersecurity expertise with OWASP's collaborative efforts to address emerging AI security risks. This partnership underscores Trend Micro's unwavering commitment to advancing AI security, ensuring a...

Wallarm Research Releases Nuclei Template to Counter Threats Targeting LLM Apps

Wallarm Research has just released a powerful new Nuclei template targeting a new kind of exposure: the Model Context Protocol MCP. This isn’t about legacy devtools or generic JSON-RPC pinging. It’s about the protocol fueling next-gen LLM applications — and it’s already showing up exposed in the...

Prompt Engineering Techniques with Spring AI

This blog post demonstrates practical implementations of Prompt Engineering techniques using Spring AI. The examples and patterns in this article are based on the comprehensive Prompt Engineering Guide that covers the theory, principles, and patterns of effective prompt engineering. The blog show...

CVE-2024-12720 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-tensorrtllm-24.04...

Unspecified Vulnerability in GPT Academic

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a security vulnerability that originates from a specially crafted zip bomb upload that can be exploited by an attacker to cause a memory exhaustion crash...

CVE-2024-8196

In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace...

GHSA-879V-FGGM-VXW2 LiteLLM Has a Leakage of Langfuse API Keys

In berriai/litellm version v1.52.1, an issue in proxyserver.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfusesecret and langfusepublickey, which can provide full access to the Langfuse...

PYSEC-2025-244

A vulnerability in the LangChainLLM class of the run-llama/llamaindex repository, version v0.12.5, allows for a Denial of Service DoS attack. The streamcomplete method executes the llm using a thread and retrieves the result via the getresponsegen method of the StreamingGeneratorCallbackHandler...

CVE-2024-8196 Missing Authentication for Critical Function in mintplex-labs/anything-llm

In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace...

CVE-2024-8196

CVE-2024-8196 affects mintplex-labs/anything-llm v1.5.11 desktop for Windows. The app opens server port 3001 on 0.0.0.0 with no authentication by default, enabling an attacker to gain full backend access and potentially delete all data from the workspace. Connected sources reiterate the same beha...