Advisories

Security advisories for popular AI software, newest first, each linked to its public source.

All Critical High Medium Low Info

8 advisories rated Low

2026-10-27 // 17:46 UTC Low SA-26-679

vLLM: Harmony tool continuations drop `cache_salt`, restoring a cross-tenant prefix-cache membership…

Affects: vLLM

2026-10-27 // 17:46 UTC Low SA-26-385

Jupyter: JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for…

Affects: Jupyter

2026-10-27 // 17:46 UTC Low SA-26-313

Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

Affects: Open WebUI

2026-10-27 // 17:46 UTC Low SA-26-134

MLflow: Deterministic sampling in dataset digest enables predictable collisions

Affects: MLflow

2026-10-27 // 17:46 UTC Low SA-26-133

Gradio: Audio cache key ignores metadata when saving numpy audio outputs

Affects: Gradio

2026-10-27 // 17:46 UTC Low SA-26-127

AnythingLLM: Prior to 1.13.0, the AnythingLLM agent filesystem copy tool validates only the top-level source…

Affects: AnythingLLM

2026-10-27 // 17:46 UTC Low SA-26-090

Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only…

Affects: Open WebUI

2026-10-27 // 17:46 UTC Low SA-26-023

Flowise: A vulnerability was detected in FlowiseAI Flowise up to 3.0.12

Affects: Flowise