CVE-2024-55241

An issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py component...

CVE-2024-55241

The deep-diver LLM-As-Chatbot software is vulnerable to remote code execution (RCE) in versions prior to commit 99c2c03 . The flaw originates within the modelsbyom.py component, specifically related to the improper control of generation of code (CWE-94). This allows a remote attacker to execute a...

CVE-2024-55241

An issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py component...

CVE-2024-55241: Improper Control of Generation of Code

An issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py component...

CVE-2024-3569

A Denial of Service DoS vulnerability exists in the mintplex-labs/anything-llm repository when the application is running in 'just me' mode with a password. An attacker can exploit this vulnerability by making a request to the endpoint using the validatedRequest middleware with a specially crafte...

CVE-2024-3033

An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes. This flaw allows unauthenticated users to perform destructive actions on the VectorDB, including resetting the database and deleting specifi...

CVE-2024-3104

A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the POST /api/system/update-env endpoint, which allows for the execution of...

Malicious code in aws-genai-llm-chatbot (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-1021 Malicious code in aws-genai-llm-chatbot (npm)

The package communicates with a domain associated with malicious activity...

PYSEC-2025-58

vLLM is a library for LLM inference and serving. vllm/modelexecutor/weightutils.py implements hfmodelweightsiterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weightsonly parameter defaults to False. When torch.load loads malicious...

Malicious code in mlc-llm-nightly-cu123 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 99d49619be0a9e2bcedb22bd4ea489b5cb31a56558e763a78fd09a6f948f2d9e Installing the package exfiltrates information about the host, including environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2025-1983 Malicious code in mlc-llm-nightly-cu123 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 99d49619be0a9e2bcedb22bd4ea489b5cb31a56558e763a78fd09a6f948f2d9e Installing the package exfiltrates information about the host, including environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious...

cochise

Cochise: Autonomous LLM-Driven Pen-Testing in 630 Lines of Py...

Sweet Security Introduces Patent-Pending LLM-Powered Detection Engine, Reducing Cloud Detection Noise to 0.04%

Tel Aviv, Israel, 15th January 2025, CyberNewsWire...

PT-2025-1977

Name of the Vulnerable Software and Affected Versions No specific software name or affected versions are mentioned in the provided descriptions. Description A security issue has been discovered in a famous LLM product. The estimated number of potentially affected devices worldwide is not specifie...

New Developments in LLM Hijacking Activity

Discover the latest in LLM hijacking activity, including a dive into the JINX-2401 campaign targeting AWS environments with IAM privilege escalation tactics...

Jailbreaking LLM-Controlled Robots

Surprising no one, it's easy to trick an LLM-controlled robot into ignoring its safety instructions...

Announcing the Adaptive Prompt Injection Challenge (LLMail-Inject)

We are excited to introduce LLMail-Inject, a new challenge focused on evaluating state-of-the-art prompt injection defenses in a realistic simulated LLM-integrated email client. In this challenge, participants assume the role of an attacker who sends an email to a user. The user then queries the...

Qualys TotalAI: The Journey from LLM Scanner to Comprehensive AI Security Solution

Embarking on the AI/ML Journey The launch of Qualys TotalAI marks a significant milestone in our journey with AI/ML. It all began in March 2024 when we ventured into the rapidly evolving AI/ML landscape and the emerging LLM ecosystem. Recognizing the potential of these technologies to revolutioni...

MAI-2024-0017

Large Language Models LLMs utilizing Reinforcement Learning from Human Feedback RLHF for safety alignment are susceptible to a sophisticated "alignment-based" jailbreak attack. This attack employs a best-of-N sampling strategy in conjunction with an adversarial LLM to efficiently craft prompts th...