What 727 advisories say about AI software security

On the day this site launched, we had published 727 advisories for AI software. About 6 in 10 of them are rated Critical or High. Four products account for most of the list. If your organization runs any AI tool on its own server, the numbers below show where to look first.

What this set covers

Before you read the numbers, it helps to know what they are counting.

• 30 products. Securaity tracks 30 open-source and self-hosted AI tools: LLM app builders, chat interfaces, inference servers, frameworks and vector databases.
• A 180-day window. We publish new advisories only for vulnerability records that their source first published within the last 180 days. The records in this set were first published between 2026-04-30 and 2026-10-27.
• Public records only. The data comes from the National Vulnerability Database (NVD), the GitHub Advisory Database and the CISA Known Exploited Vulnerabilities (KEV) catalog.
• One advisory per record and product. The 727 advisories match 727 distinct vulnerability records. Of those, 690 have a CVE id and 37 are GitHub advisories with no CVE id.

We read the data on 2026-10-27, and the counts include published advisories only. The methodology page explains the matching rules in full.

How serious the flaws are

Each advisory’s severity follows its CVSS score: Critical is 9.0 and above, High is 7.0 to 8.9, Medium is 4.0 to 6.9, and Low is above 0 and below 4.0. Info is reserved for records with no published score.

Severity	Advisories	Share of 727
Critical	106	14.6%
High	331	45.5%
Medium	282	38.8%
Low	8	1.1%
Info	0	0.0%

Critical and High together come to 437 of 727, or 60.1%. Low ratings are rare.

No advisory is rated Info. One record had no CVSS score, so its severity came from GitHub’s reviewed severity label.

At the top of the scale, 74 advisories score 9.8 or higher. One example is SA-26-026, which scores 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms, an attacker can reach the flaw over a network, it is easy to exploit, it needs no account and no action from a user, and the impact on confidentiality, integrity and availability is high. If you want to read vectors like this yourself, see how to read a CVSS score or the CVSS glossary entry.

Attacks have been seen against 6 of the 727, which appear on the CISA KEV list. We cover those in AI vulnerabilities on the CISA KEV list.

Which products have the most advisories

Of the 30 tracked products, 22 have at least one advisory in this window.

Product	Vendor	Advisories	Critical	High	Critical + High
Langflow	Langflow	154	41	78	119
n8n	n8n	150	16	64	80
Open WebUI	Open WebUI	137	6	53	59
Flowise	FlowiseAI	88	23	42	65
vLLM	vLLM project	67	1	25	26
LiteLLM	BerriAI	27	5	11	16
Jupyter	Project Jupyter	18	1	7	8
MLflow	LF Projects	17	3	10	13
NVIDIA Triton Inference Server	NVIDIA	17	6	10	16
llama.cpp	ggml	13	0	11	11
Keras	Keras	9	1	3	4
Chroma	Chroma	5	1	4	5
AnythingLLM	Mintplex Labs	4	0	1	1
Hugging Face Transformers	Hugging Face	4	1	3	4
Gradio	Gradio	3	0	1	1
LangChain	LangChain	3	0	2	2
Ollama	Ollama	3	1	2	3
Dify	LangGenius	2	0	0	0
Ray	Anyscale	2	0	2	2
Weaviate	Weaviate	2	0	1	1
Milvus	Milvus	1	0	1	1
Streamlit	Snowflake	1	0	0	0

The list is top-heavy. Langflow, n8n, Open WebUI and Flowise together account for 529 of 727 advisories (72.8%). The share of serious flaws also differs from product to product:

• Langflow: 119 of 154 are Critical or High (77.3%).
• Flowise: 65 of 88 are Critical or High (73.9%).
• n8n: 80 of 150 are Critical or High (53.3%).
• Open WebUI: 59 of 137 are Critical or High (43.1%).
• vLLM: 26 of 67 are Critical or High (38.8%).

Twelve products have 5 or more advisories. Eight tracked products have none in this window: ComfyUI, LM Studio, LlamaIndex, ONNX Runtime, PyTorch, Qdrant, TensorFlow and text-generation-webui.

Many of the products near the top are tools that people install on their own servers and put on a network. In that setting, a single flaw can expose data or let an attacker run commands. That is context for reading the list. The counts themselves do not measure it.

What these numbers do not show

Read the tables as a map of public records, not as a safety ranking.

• A count is not a safety score. Products that many people examine, and projects that publish advisories actively, tend to have more records. A long list can mean a project is open about its fixes.
• Zero is not a clean bill of health. A product with no advisories here had no matching public record in these 180 days. You still need to keep it updated.
• The method shapes the numbers. The window, the product list and the matching rules (CPE identifiers in the NVD, package names in the GitHub Advisory Database) all affect what gets counted.
• Public records only. Flaws that were never published are not here.

What to do this week

1. List the AI tools you run. Ask your IT staff or developer which of the 30 tracked products are installed, including test servers and anything a volunteer set up.
2. Open each product’s page. Go to /vulnerabilities/ and find every product on your list.
3. Follow the RSS feed. Each product page has a feed, so new advisories reach you without having to check by hand.
4. Read “What to do” on every Critical or High advisory. Start with the products you run that sit near the top of the table. Each such advisory in the advisories list has this section.
5. Check the KEV advisories first. If any of the 6 KEV-listed advisories affect a product you run, treat them as urgent, because attacks have already been seen.