Vulnerabilities

CVEs, exploits, and security flaws in AI frameworks, models, and infrastructure.

Jun 9, 2026 3 min read

LiteLLM RCE: CVE-2026-42271, CISA KEV

CISA added CVE-2026-42271 to KEV after Horizon3.ai chained the LiteLLM MCP command injection flaw with a Starlette auth bypass for unauthenticated RCE. Federal deadline: June 22.

img of Claude Code Action Prompt Injection Flaw

Jun 4, 2026 4 min read

Vulnerabilities

Claude Code Action Prompt Injection Flaw

A flawed permission check in Anthropic's Claude Code GitHub Action allowed attackers to use prompt injection via a crafted issue to steal CI/CD secrets. Patched in v1.0.94.

img of Malicious AI Models: Supply Chain Threat

Jun 4, 2026 7 min read

Vulnerabilities

Malicious AI Models: Supply Chain Threat

Hundreds of backdoored and malware-laced models have been found in public AI registries. Covers pickle RCE, activation-trigger backdoors, and enterprise controls for model intake.

img of Gemini Hijacked via Android Notifications

Jun 3, 2026 3 min read

Vulnerabilities

Gemini Hijacked via Android Notifications

SafeBreach Labs documented a prompt injection attack hiding malicious commands inside WhatsApp, Slack, or SMS notifications. Gemini treats hostile text as trusted. Patched Nov 2025.

img of RAG Security: Attack Surface for AI Teams

May 27, 2026 7 min read

Vulnerabilities

RAG Security: Attack Surface for AI Teams

RAG pipelines introduce document poisoning, indirect prompt injection via retrieved content, and semantic access control gaps that most security teams have not assessed.